resource	yara_rule
behavioral2/memory/1372-5-0x0000000000EC0000-0x0000000000F42000-memory.dmp	family_zgrat_v1
behavioral2/memory/1372-6-0x0000000000EC0000-0x0000000000F3C000-memory.dmp	family_zgrat_v1
behavioral2/memory/1372-7-0x0000000000EC0000-0x0000000000F3C000-memory.dmp	family_zgrat_v1
behavioral2/memory/1372-9-0x0000000000EC0000-0x0000000000F3C000-memory.dmp	family_zgrat_v1
behavioral2/memory/1372-11-0x0000000000EC0000-0x0000000000F3C000-memory.dmp	family_zgrat_v1
behavioral2/memory/1372-13-0x0000000000EC0000-0x0000000000F3C000-memory.dmp	family_zgrat_v1
behavioral2/memory/1372-15-0x0000000000EC0000-0x0000000000F3C000-memory.dmp	family_zgrat_v1
behavioral2/memory/1372-17-0x0000000000EC0000-0x0000000000F3C000-memory.dmp	family_zgrat_v1
behavioral2/memory/1372-19-0x0000000000EC0000-0x0000000000F3C000-memory.dmp	family_zgrat_v1
behavioral2/memory/1372-21-0x0000000000EC0000-0x0000000000F3C000-memory.dmp	family_zgrat_v1
behavioral2/memory/1372-23-0x0000000000EC0000-0x0000000000F3C000-memory.dmp	family_zgrat_v1
behavioral2/memory/1372-25-0x0000000000EC0000-0x0000000000F3C000-memory.dmp	family_zgrat_v1
behavioral2/memory/1372-27-0x0000000000EC0000-0x0000000000F3C000-memory.dmp	family_zgrat_v1
behavioral2/memory/1372-29-0x0000000000EC0000-0x0000000000F3C000-memory.dmp	family_zgrat_v1
behavioral2/memory/1372-31-0x0000000000EC0000-0x0000000000F3C000-memory.dmp	family_zgrat_v1
behavioral2/memory/1372-33-0x0000000000EC0000-0x0000000000F3C000-memory.dmp	family_zgrat_v1
behavioral2/memory/1372-35-0x0000000000EC0000-0x0000000000F3C000-memory.dmp	family_zgrat_v1
behavioral2/memory/1372-37-0x0000000000EC0000-0x0000000000F3C000-memory.dmp	family_zgrat_v1
behavioral2/memory/1372-39-0x0000000000EC0000-0x0000000000F3C000-memory.dmp	family_zgrat_v1
behavioral2/memory/1372-44-0x0000000000EC0000-0x0000000000F3C000-memory.dmp	family_zgrat_v1
behavioral2/memory/1372-48-0x0000000000EC0000-0x0000000000F3C000-memory.dmp	family_zgrat_v1
behavioral2/memory/1372-52-0x0000000000EC0000-0x0000000000F3C000-memory.dmp	family_zgrat_v1
behavioral2/memory/1372-56-0x0000000000EC0000-0x0000000000F3C000-memory.dmp	family_zgrat_v1
behavioral2/memory/1372-60-0x0000000000EC0000-0x0000000000F3C000-memory.dmp	family_zgrat_v1
behavioral2/memory/1372-64-0x0000000000EC0000-0x0000000000F3C000-memory.dmp	family_zgrat_v1
behavioral2/memory/1372-68-0x0000000000EC0000-0x0000000000F3C000-memory.dmp	family_zgrat_v1
behavioral2/memory/1372-70-0x0000000000EC0000-0x0000000000F3C000-memory.dmp	family_zgrat_v1
behavioral2/memory/1372-66-0x0000000000EC0000-0x0000000000F3C000-memory.dmp	family_zgrat_v1
behavioral2/memory/1372-62-0x0000000000EC0000-0x0000000000F3C000-memory.dmp	family_zgrat_v1
behavioral2/memory/1372-58-0x0000000000EC0000-0x0000000000F3C000-memory.dmp	family_zgrat_v1
behavioral2/memory/1372-54-0x0000000000EC0000-0x0000000000F3C000-memory.dmp	family_zgrat_v1
behavioral2/memory/1372-50-0x0000000000EC0000-0x0000000000F3C000-memory.dmp	family_zgrat_v1
behavioral2/memory/1372-46-0x0000000000EC0000-0x0000000000F3C000-memory.dmp	family_zgrat_v1
behavioral2/memory/1372-42-0x0000000000EC0000-0x0000000000F3C000-memory.dmp	family_zgrat_v1

pid	process
1372	75bff99becc32bcbe56efbe7a75f4d45.exe
1372	75bff99becc32bcbe56efbe7a75f4d45.exe
1372	75bff99becc32bcbe56efbe7a75f4d45.exe
1372	75bff99becc32bcbe56efbe7a75f4d45.exe
1372	75bff99becc32bcbe56efbe7a75f4d45.exe
1372	75bff99becc32bcbe56efbe7a75f4d45.exe
1372	75bff99becc32bcbe56efbe7a75f4d45.exe
1372	75bff99becc32bcbe56efbe7a75f4d45.exe
1372	75bff99becc32bcbe56efbe7a75f4d45.exe
1372	75bff99becc32bcbe56efbe7a75f4d45.exe
1372	75bff99becc32bcbe56efbe7a75f4d45.exe
1372	75bff99becc32bcbe56efbe7a75f4d45.exe
1372	75bff99becc32bcbe56efbe7a75f4d45.exe
1372	75bff99becc32bcbe56efbe7a75f4d45.exe
1372	75bff99becc32bcbe56efbe7a75f4d45.exe
1372	75bff99becc32bcbe56efbe7a75f4d45.exe
1372	75bff99becc32bcbe56efbe7a75f4d45.exe
1372	75bff99becc32bcbe56efbe7a75f4d45.exe
1372	75bff99becc32bcbe56efbe7a75f4d45.exe
1372	75bff99becc32bcbe56efbe7a75f4d45.exe

description	pid	process	target process
PID 1372 wrote to memory of 2452	1372	75bff99becc32bcbe56efbe7a75f4d45.exe	75bff99becc32bcbe56efbe7a75f4d45.exe
PID 1372 wrote to memory of 2452	1372	75bff99becc32bcbe56efbe7a75f4d45.exe	75bff99becc32bcbe56efbe7a75f4d45.exe
PID 1372 wrote to memory of 2452	1372	75bff99becc32bcbe56efbe7a75f4d45.exe	75bff99becc32bcbe56efbe7a75f4d45.exe
PID 1372 wrote to memory of 2452	1372	75bff99becc32bcbe56efbe7a75f4d45.exe	75bff99becc32bcbe56efbe7a75f4d45.exe
PID 1372 wrote to memory of 2460	1372	75bff99becc32bcbe56efbe7a75f4d45.exe	75bff99becc32bcbe56efbe7a75f4d45.exe
PID 1372 wrote to memory of 2460	1372	75bff99becc32bcbe56efbe7a75f4d45.exe	75bff99becc32bcbe56efbe7a75f4d45.exe
PID 1372 wrote to memory of 2460	1372	75bff99becc32bcbe56efbe7a75f4d45.exe	75bff99becc32bcbe56efbe7a75f4d45.exe
PID 1372 wrote to memory of 2460	1372	75bff99becc32bcbe56efbe7a75f4d45.exe	75bff99becc32bcbe56efbe7a75f4d45.exe
PID 1372 wrote to memory of 2488	1372	75bff99becc32bcbe56efbe7a75f4d45.exe	75bff99becc32bcbe56efbe7a75f4d45.exe
PID 1372 wrote to memory of 2488	1372	75bff99becc32bcbe56efbe7a75f4d45.exe	75bff99becc32bcbe56efbe7a75f4d45.exe
PID 1372 wrote to memory of 2488	1372	75bff99becc32bcbe56efbe7a75f4d45.exe	75bff99becc32bcbe56efbe7a75f4d45.exe
PID 1372 wrote to memory of 2488	1372	75bff99becc32bcbe56efbe7a75f4d45.exe	75bff99becc32bcbe56efbe7a75f4d45.exe
PID 1372 wrote to memory of 2508	1372	75bff99becc32bcbe56efbe7a75f4d45.exe	75bff99becc32bcbe56efbe7a75f4d45.exe
PID 1372 wrote to memory of 2508	1372	75bff99becc32bcbe56efbe7a75f4d45.exe	75bff99becc32bcbe56efbe7a75f4d45.exe
PID 1372 wrote to memory of 2508	1372	75bff99becc32bcbe56efbe7a75f4d45.exe	75bff99becc32bcbe56efbe7a75f4d45.exe
PID 1372 wrote to memory of 2508	1372	75bff99becc32bcbe56efbe7a75f4d45.exe	75bff99becc32bcbe56efbe7a75f4d45.exe
PID 1372 wrote to memory of 2468	1372	75bff99becc32bcbe56efbe7a75f4d45.exe	75bff99becc32bcbe56efbe7a75f4d45.exe
PID 1372 wrote to memory of 2468	1372	75bff99becc32bcbe56efbe7a75f4d45.exe	75bff99becc32bcbe56efbe7a75f4d45.exe
PID 1372 wrote to memory of 2468	1372	75bff99becc32bcbe56efbe7a75f4d45.exe	75bff99becc32bcbe56efbe7a75f4d45.exe
PID 1372 wrote to memory of 2468	1372	75bff99becc32bcbe56efbe7a75f4d45.exe	75bff99becc32bcbe56efbe7a75f4d45.exe
PID 1372 wrote to memory of 2576	1372	75bff99becc32bcbe56efbe7a75f4d45.exe	75bff99becc32bcbe56efbe7a75f4d45.exe
PID 1372 wrote to memory of 2576	1372	75bff99becc32bcbe56efbe7a75f4d45.exe	75bff99becc32bcbe56efbe7a75f4d45.exe
PID 1372 wrote to memory of 2576	1372	75bff99becc32bcbe56efbe7a75f4d45.exe	75bff99becc32bcbe56efbe7a75f4d45.exe
PID 1372 wrote to memory of 2576	1372	75bff99becc32bcbe56efbe7a75f4d45.exe	75bff99becc32bcbe56efbe7a75f4d45.exe
PID 1372 wrote to memory of 1984	1372	75bff99becc32bcbe56efbe7a75f4d45.exe	75bff99becc32bcbe56efbe7a75f4d45.exe
PID 1372 wrote to memory of 1984	1372	75bff99becc32bcbe56efbe7a75f4d45.exe	75bff99becc32bcbe56efbe7a75f4d45.exe
PID 1372 wrote to memory of 1984	1372	75bff99becc32bcbe56efbe7a75f4d45.exe	75bff99becc32bcbe56efbe7a75f4d45.exe
PID 1372 wrote to memory of 1984	1372	75bff99becc32bcbe56efbe7a75f4d45.exe	75bff99becc32bcbe56efbe7a75f4d45.exe
PID 1372 wrote to memory of 2924	1372	75bff99becc32bcbe56efbe7a75f4d45.exe	75bff99becc32bcbe56efbe7a75f4d45.exe
PID 1372 wrote to memory of 2924	1372	75bff99becc32bcbe56efbe7a75f4d45.exe	75bff99becc32bcbe56efbe7a75f4d45.exe
PID 1372 wrote to memory of 2924	1372	75bff99becc32bcbe56efbe7a75f4d45.exe	75bff99becc32bcbe56efbe7a75f4d45.exe
PID 1372 wrote to memory of 2924	1372	75bff99becc32bcbe56efbe7a75f4d45.exe	75bff99becc32bcbe56efbe7a75f4d45.exe
PID 1372 wrote to memory of 2900	1372	75bff99becc32bcbe56efbe7a75f4d45.exe	75bff99becc32bcbe56efbe7a75f4d45.exe
PID 1372 wrote to memory of 2900	1372	75bff99becc32bcbe56efbe7a75f4d45.exe	75bff99becc32bcbe56efbe7a75f4d45.exe
PID 1372 wrote to memory of 2900	1372	75bff99becc32bcbe56efbe7a75f4d45.exe	75bff99becc32bcbe56efbe7a75f4d45.exe
PID 1372 wrote to memory of 2900	1372	75bff99becc32bcbe56efbe7a75f4d45.exe	75bff99becc32bcbe56efbe7a75f4d45.exe
PID 1372 wrote to memory of 3028	1372	75bff99becc32bcbe56efbe7a75f4d45.exe	75bff99becc32bcbe56efbe7a75f4d45.exe
PID 1372 wrote to memory of 3028	1372	75bff99becc32bcbe56efbe7a75f4d45.exe	75bff99becc32bcbe56efbe7a75f4d45.exe
PID 1372 wrote to memory of 3028	1372	75bff99becc32bcbe56efbe7a75f4d45.exe	75bff99becc32bcbe56efbe7a75f4d45.exe
PID 1372 wrote to memory of 3028	1372	75bff99becc32bcbe56efbe7a75f4d45.exe	75bff99becc32bcbe56efbe7a75f4d45.exe

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads