zgrat | 3682f63442374a284f1b5f996da477f3cf024ffd5fa5f2bf064ef80136b81a04

Analysis

max time kernel
147s
max time network
303s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 07:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Quasar_Gold/Include/dotNET_Reactor.Console.exe
Size

14KB
MD5

0b4dbf61a98f3e34cdd3a1b08a6a4609
SHA1

73587f1f5d040541b230513d22d696513dbd4cf9
SHA256

e817802f166662a7df0b144571354d74b10e34d120f91ae9d84ca3ba925241c6
SHA512

7cca370890e4e245c84507623531b5f54b76ced3e8c6b87cdfc47ed16560b6a0a5cf9e0556075cd0d9266908e445b854114edd69d50870839624589676c0e688
SSDEEP

192:8jY53csvsqHwrHEdSAejbMfDn1Gp78dsKGXOdlWW1ksTkwy:8jEnskskQlm1GRJKGXOdlWW1XTR

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral14/memory/3236-3-0x0000000000640000-0x0000000000C12000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Loads dropped DLL 1 IoCs

pid	Process
3236	dotNET_Reactor.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3236	dotNET_Reactor.exe
3236	dotNET_Reactor.exe
3236	dotNET_Reactor.exe
3236	dotNET_Reactor.exe
3236	dotNET_Reactor.exe
3236	dotNET_Reactor.exe
3236	dotNET_Reactor.exe
3236	dotNET_Reactor.exe
3236	dotNET_Reactor.exe
3236	dotNET_Reactor.exe
3236	dotNET_Reactor.exe
3236	dotNET_Reactor.exe
3236	dotNET_Reactor.exe
3236	dotNET_Reactor.exe
3236	dotNET_Reactor.exe
3236	dotNET_Reactor.exe
3236	dotNET_Reactor.exe
3236	dotNET_Reactor.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3236	dotNET_Reactor.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3608 wrote to memory of 3236	3608	dotNET_Reactor.Console.exe	86
PID 3608 wrote to memory of 3236	3608	dotNET_Reactor.Console.exe	86
PID 3608 wrote to memory of 3236	3608	dotNET_Reactor.Console.exe	86

C:\Users\Admin\AppData\Local\Temp\Quasar_Gold\Include\dotNET_Reactor.Console.exe
"C:\Users\Admin\AppData\Local\Temp\Quasar_Gold\Include\dotNET_Reactor.Console.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Users\Admin\AppData\Local\Temp\Quasar_Gold\Include\dotNET_Reactor.exe
  "C:\Users\Admin\AppData\Local\Temp\Quasar_Gold\Include\dotNET_Reactor.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3236

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\SkinSoft\dotNET_Reactor\x86\ssapihook.dll

Filesize
68KB

MD5
bc6887aa21e7794a2c27e3ffd3dc3ed0

SHA1
2b845941c93094d7203553582f69d0c61a9fcee4

SHA256
919130e16d33fd58d0370b06b7fb0fc253f5b571fc33ad5c21eb8dafe4760c94

SHA512
9e952ae72851ba081809ea5d7a86108b0355f0882bae912e0ecf931fde2e878994142b6c16094473305392981439e49d9a32aa6aaf94edd07238a0ecb787e834

Download Submit
memory/3236-6-0x0000000005780000-0x00000000057E6000-memory.dmp

Filesize
408KB

Download
memory/3236-5-0x0000000005620000-0x00000000056B2000-memory.dmp

Filesize
584KB

Download
memory/3236-16-0x0000000000010000-0x0000000000011000-memory.dmp

Filesize
4KB

Download
memory/3236-4-0x0000000005CC0000-0x0000000006264000-memory.dmp

Filesize
5.6MB

Download
memory/3236-17-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/3236-35-0x0000000075390000-0x0000000075B40000-memory.dmp

Filesize
7.7MB

Download
memory/3236-7-0x00000000055F0000-0x0000000005600000-memory.dmp

Filesize
64KB

Download
memory/3236-18-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/3236-9-0x00000000055F0000-0x0000000005600000-memory.dmp

Filesize
64KB

Download
memory/3236-10-0x0000000009A60000-0x0000000009A80000-memory.dmp

Filesize
128KB

Download
memory/3236-11-0x0000000009C00000-0x0000000009C28000-memory.dmp

Filesize
160KB

Download
memory/3236-31-0x00000000055F0000-0x0000000005600000-memory.dmp

Filesize
64KB

Download
memory/3236-3-0x0000000000640000-0x0000000000C12000-memory.dmp

Filesize
5.8MB

Download
memory/3236-2-0x0000000075390000-0x0000000075B40000-memory.dmp

Filesize
7.7MB

Download
memory/3236-8-0x00000000065C0000-0x00000000065CA000-memory.dmp

Filesize
40KB

Download
memory/3236-19-0x0000000000040000-0x0000000000041000-memory.dmp

Filesize
4KB

Download
memory/3236-20-0x0000000000050000-0x0000000000051000-memory.dmp

Filesize
4KB

Download
memory/3236-21-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/3236-22-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/3236-23-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/3236-24-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/3236-25-0x000000000A830000-0x000000000ACFC000-memory.dmp

Filesize
4.8MB

Download
memory/3608-1-0x00007FFA9B020000-0x00007FFA9BAE1000-memory.dmp

Filesize
10.8MB

Download
memory/3608-0-0x0000000000C60000-0x0000000000C6A000-memory.dmp

Filesize
40KB

Download
memory/3608-37-0x00007FFA9B020000-0x00007FFA9BAE1000-memory.dmp

Filesize
10.8MB

Download