zgrat | 37d22bf567962bb14412f2034d9e9338feb599fe214a59d73cb47929e0de9957

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 13:23

Target

29d409af265261b204f6eeeedb5e9bb1f7a829b723a5d1d78384066744bddbe1.exe
Size

451KB
MD5

b2b60c50903a73efffcb4e33ce49238f
SHA1

9b6f27fc410748ae1570978d7a6aba95a1041eea
SHA256

29d409af265261b204f6eeeedb5e9bb1f7a829b723a5d1d78384066744bddbe1
SHA512

2c66a1615de77157f57c662de2e3ec97deb8cb6aadc0a03ff0acc3b269affd5ae0d50dfef85939ca9c1a8c6d47ff915061157e7da92dc286cb6ddd9b06a88126
SSDEEP

6144:dI6go9vB3SD75MlCe8KihsZC2uLrfA1v6OvNMpP/Ao+gK:dtgKdSv5M41KkK4LzgyoNMpP/Ao+

Score

10^/10

zgrat rat

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral2/memory/4684-0-0x0000000000B70000-0x0000000000BE8000-memory.dmp	family_zgrat_v1

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4684 set thread context of 2088	4684	29d409af265261b204f6eeeedb5e9bb1f7a829b723a5d1d78384066744bddbe1.exe	88

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 1808	4684	29d409af265261b204f6eeeedb5e9bb1f7a829b723a5d1d78384066744bddbe1.exe	87
PID 4684 wrote to memory of 1808	4684	29d409af265261b204f6eeeedb5e9bb1f7a829b723a5d1d78384066744bddbe1.exe	87
PID 4684 wrote to memory of 1808	4684	29d409af265261b204f6eeeedb5e9bb1f7a829b723a5d1d78384066744bddbe1.exe	87
PID 4684 wrote to memory of 2088	4684	29d409af265261b204f6eeeedb5e9bb1f7a829b723a5d1d78384066744bddbe1.exe	88
PID 4684 wrote to memory of 2088	4684	29d409af265261b204f6eeeedb5e9bb1f7a829b723a5d1d78384066744bddbe1.exe	88
PID 4684 wrote to memory of 2088	4684	29d409af265261b204f6eeeedb5e9bb1f7a829b723a5d1d78384066744bddbe1.exe	88
PID 4684 wrote to memory of 2088	4684	29d409af265261b204f6eeeedb5e9bb1f7a829b723a5d1d78384066744bddbe1.exe	88
PID 4684 wrote to memory of 2088	4684	29d409af265261b204f6eeeedb5e9bb1f7a829b723a5d1d78384066744bddbe1.exe	88
PID 4684 wrote to memory of 2088	4684	29d409af265261b204f6eeeedb5e9bb1f7a829b723a5d1d78384066744bddbe1.exe	88
PID 4684 wrote to memory of 2088	4684	29d409af265261b204f6eeeedb5e9bb1f7a829b723a5d1d78384066744bddbe1.exe	88
PID 4684 wrote to memory of 2088	4684	29d409af265261b204f6eeeedb5e9bb1f7a829b723a5d1d78384066744bddbe1.exe	88
PID 4684 wrote to memory of 2088	4684	29d409af265261b204f6eeeedb5e9bb1f7a829b723a5d1d78384066744bddbe1.exe	88

C:\Users\Admin\AppData\Local\Temp\29d409af265261b204f6eeeedb5e9bb1f7a829b723a5d1d78384066744bddbe1.exe
"C:\Users\Admin\AppData\Local\Temp\29d409af265261b204f6eeeedb5e9bb1f7a829b723a5d1d78384066744bddbe1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1808
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2088

memory/2088-5-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2088-8-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2088-12-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/2088-13-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/2088-14-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/2088-15-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4684-0-0x0000000000B70000-0x0000000000BE8000-memory.dmp

Filesize
480KB

Download
memory/4684-1-0x0000000074BD0000-0x0000000075380000-memory.dmp

Filesize
7.7MB

Download
memory/4684-2-0x0000000005430000-0x0000000005440000-memory.dmp

Filesize
64KB

Download
memory/4684-10-0x0000000002E80000-0x0000000004E80000-memory.dmp

Filesize
32.0MB

Download
memory/4684-11-0x0000000074BD0000-0x0000000075380000-memory.dmp

Filesize
7.7MB

Download
memory/4684-16-0x0000000002E80000-0x0000000004E80000-memory.dmp

Filesize
32.0MB

Download