zgrat | 3682f63442374a284f1b5f996da477f3cf024ffd5fa5f2bf064ef80136b81a04

Analysis

max time kernel
300s
max time network
319s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-04-2024 07:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Quasar_Gold/Include/dotNET_Reactor.Console.exe
Size

14KB
MD5

0b4dbf61a98f3e34cdd3a1b08a6a4609
SHA1

73587f1f5d040541b230513d22d696513dbd4cf9
SHA256

e817802f166662a7df0b144571354d74b10e34d120f91ae9d84ca3ba925241c6
SHA512

7cca370890e4e245c84507623531b5f54b76ced3e8c6b87cdfc47ed16560b6a0a5cf9e0556075cd0d9266908e445b854114edd69d50870839624589676c0e688
SSDEEP

192:8jY53csvsqHwrHEdSAejbMfDn1Gp78dsKGXOdlWW1ksTkwy:8jEnskskQlm1GRJKGXOdlWW1XTR

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral13/memory/2588-2-0x00000000008D0000-0x0000000000EA2000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Loads dropped DLL 1 IoCs

pid	Process
2588	dotNET_Reactor.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2588	dotNET_Reactor.exe
2588	dotNET_Reactor.exe
2588	dotNET_Reactor.exe
2588	dotNET_Reactor.exe
2588	dotNET_Reactor.exe
2588	dotNET_Reactor.exe
2588	dotNET_Reactor.exe
2588	dotNET_Reactor.exe
2588	dotNET_Reactor.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2588	dotNET_Reactor.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 2588	2720	dotNET_Reactor.Console.exe	29
PID 2720 wrote to memory of 2588	2720	dotNET_Reactor.Console.exe	29
PID 2720 wrote to memory of 2588	2720	dotNET_Reactor.Console.exe	29
PID 2720 wrote to memory of 2588	2720	dotNET_Reactor.Console.exe	29

C:\Users\Admin\AppData\Local\Temp\Quasar_Gold\Include\dotNET_Reactor.Console.exe
"C:\Users\Admin\AppData\Local\Temp\Quasar_Gold\Include\dotNET_Reactor.Console.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Users\Admin\AppData\Local\Temp\Quasar_Gold\Include\dotNET_Reactor.exe
  "C:\Users\Admin\AppData\Local\Temp\Quasar_Gold\Include\dotNET_Reactor.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\SkinSoft\dotNET_Reactor\x86\ssapihook.dll

Filesize
68KB

MD5
bc6887aa21e7794a2c27e3ffd3dc3ed0

SHA1
2b845941c93094d7203553582f69d0c61a9fcee4

SHA256
919130e16d33fd58d0370b06b7fb0fc253f5b571fc33ad5c21eb8dafe4760c94

SHA512
9e952ae72851ba081809ea5d7a86108b0355f0882bae912e0ecf931fde2e878994142b6c16094473305392981439e49d9a32aa6aaf94edd07238a0ecb787e834

Download Submit
memory/2588-12-0x0000000004E70000-0x0000000004E71000-memory.dmp

Filesize
4KB

Download
memory/2588-16-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

Filesize
4KB

Download
memory/2588-3-0x0000000074830000-0x0000000074F1E000-memory.dmp

Filesize
6.9MB

Download
memory/2588-4-0x0000000004F60000-0x0000000004FA0000-memory.dmp

Filesize
256KB

Download
memory/2588-5-0x0000000004F60000-0x0000000004FA0000-memory.dmp

Filesize
256KB

Download
memory/2588-6-0x0000000004F60000-0x0000000004FA0000-memory.dmp

Filesize
256KB

Download
memory/2588-7-0x0000000004E30000-0x0000000004E58000-memory.dmp

Filesize
160KB

Download
memory/2588-13-0x0000000004E80000-0x0000000004E81000-memory.dmp

Filesize
4KB

Download
memory/2588-29-0x0000000004F60000-0x0000000004FA0000-memory.dmp

Filesize
256KB

Download
memory/2588-11-0x0000000004E60000-0x0000000004E61000-memory.dmp

Filesize
4KB

Download
memory/2588-28-0x0000000074830000-0x0000000074F1E000-memory.dmp

Filesize
6.9MB

Download
memory/2588-14-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

Filesize
4KB

Download
memory/2588-15-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

Filesize
4KB

Download
memory/2588-2-0x00000000008D0000-0x0000000000EA2000-memory.dmp

Filesize
5.8MB

Download
memory/2588-17-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

Filesize
4KB

Download
memory/2588-18-0x0000000004FD0000-0x0000000004FD1000-memory.dmp

Filesize
4KB

Download
memory/2588-19-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

Filesize
4KB

Download
memory/2720-0-0x0000000000AD0000-0x0000000000ADA000-memory.dmp

Filesize
40KB

Download
memory/2720-1-0x000007FEF5C90000-0x000007FEF667C000-memory.dmp

Filesize
9.9MB

Download
memory/2720-27-0x000007FEF5C90000-0x000007FEF667C000-memory.dmp

Filesize
9.9MB

Download