zgrat | 3682f63442374a284f1b5f996da477f3cf024ffd5fa5f2bf064ef80136b81a04

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-04-2024 07:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Quasar_Gold/Include/dotNET_Reactor.exe
Size

5.8MB
MD5

7429e30caa2a8b41d926ffef1a05b347
SHA1

32abbd56225cd7379bb1cca8f6749d43916efe2b
SHA256

1efc5368bcd9704d7df85e2e143936d6ee4509ac31a7ca6d3eb4cf3b18c5ef27
SHA512

55243a97d9a7fcd43d531bb61615e734c8bfea242f6e28d67ce09cee586d032d83709a3b8c4ecf9b567252a53d1dad1853aca669316aa2ae62422386156b77c1
SSDEEP

49152:VoMLez0fgPdLl8HC5IaKSihCwc0YMOBf7BfKjGO+XYSaqNuT1i:Vy0fgPVwy70GUO

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral15/memory/300-1-0x0000000000C70000-0x0000000001242000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Loads dropped DLL 1 IoCs

pid	Process
300	dotNET_Reactor.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
300	dotNET_Reactor.exe
300	dotNET_Reactor.exe
300	dotNET_Reactor.exe
300	dotNET_Reactor.exe
300	dotNET_Reactor.exe
300	dotNET_Reactor.exe
300	dotNET_Reactor.exe
300	dotNET_Reactor.exe
300	dotNET_Reactor.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
300	dotNET_Reactor.exe

C:\Users\Admin\AppData\Local\Temp\Quasar_Gold\Include\dotNET_Reactor.exe
"C:\Users\Admin\AppData\Local\Temp\Quasar_Gold\Include\dotNET_Reactor.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\SkinSoft\dotNET_Reactor\x86\ssapihook.dll

Filesize
68KB

MD5
bc6887aa21e7794a2c27e3ffd3dc3ed0

SHA1
2b845941c93094d7203553582f69d0c61a9fcee4

SHA256
919130e16d33fd58d0370b06b7fb0fc253f5b571fc33ad5c21eb8dafe4760c94

SHA512
9e952ae72851ba081809ea5d7a86108b0355f0882bae912e0ecf931fde2e878994142b6c16094473305392981439e49d9a32aa6aaf94edd07238a0ecb787e834

Download Submit
memory/300-10-0x00000000051E0000-0x00000000051E1000-memory.dmp

Filesize
4KB

Download
memory/300-5-0x00000000051B0000-0x00000000051D8000-memory.dmp

Filesize
160KB

Download
memory/300-11-0x00000000051F0000-0x00000000051F1000-memory.dmp

Filesize
4KB

Download
memory/300-4-0x00000000046A0000-0x00000000046E0000-memory.dmp

Filesize
256KB

Download
memory/300-12-0x0000000005200000-0x0000000005201000-memory.dmp

Filesize
4KB

Download
memory/300-1-0x0000000000C70000-0x0000000001242000-memory.dmp

Filesize
5.8MB

Download
memory/300-9-0x0000000005160000-0x0000000005161000-memory.dmp

Filesize
4KB

Download
memory/300-13-0x0000000005350000-0x0000000005351000-memory.dmp

Filesize
4KB

Download
memory/300-3-0x00000000046A0000-0x00000000046E0000-memory.dmp

Filesize
256KB

Download
memory/300-2-0x00000000046A0000-0x00000000046E0000-memory.dmp

Filesize
256KB

Download
memory/300-0-0x0000000074C80000-0x000000007536E000-memory.dmp

Filesize
6.9MB

Download
memory/300-14-0x0000000005460000-0x0000000005461000-memory.dmp

Filesize
4KB

Download
memory/300-15-0x0000000005470000-0x0000000005471000-memory.dmp

Filesize
4KB

Download
memory/300-16-0x0000000005480000-0x0000000005481000-memory.dmp

Filesize
4KB

Download
memory/300-17-0x0000000005490000-0x0000000005491000-memory.dmp

Filesize
4KB

Download
memory/300-25-0x0000000074C80000-0x000000007536E000-memory.dmp

Filesize
6.9MB

Download
memory/300-26-0x00000000046A0000-0x00000000046E0000-memory.dmp

Filesize
256KB

Download