zgrat | 30202655ac09c4e87af419d8b461a2195fcc353f6ee7a6816b8075726e3e750b

Resubmissions

19/04/2024, 14:52

240419-r82wmafb32 10

19/04/2024, 14:48

240419-r6mnxsfa59 10

Analysis

max time kernel
91s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
19/04/2024, 14:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dotNET_Reactor/dotNET_Reactor.Console.exe
Size

34KB
MD5

69d18a3245f3c2fd02c82304c494e977
SHA1

049cda6bc59daeadfe82fce2197e0e15c2847a7b
SHA256

b55b0a652538836ed681c2afd985310fd39ad2f31ac159847fc46a6065f3232e
SHA512

5791cffbc2389eaaf18e4f31c320325d4bdfadf7ab00c847bfedccbea8fec26a3f4452877d00c95e0573e90306d7a2c988c00fcb7d495ac22955c7f64fb047c3
SSDEEP

768:5oOABBREOgrMTPrZwbiRPp7yMkZwuzZyiRYn7:5oHB2OlfZwbixp7yMkZwWZyien7

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 2 IoCs

resource	yara_rule
behavioral12/memory/4240-4-0x0000000000E70000-0x000000000211A000-memory.dmp	family_zgrat_v1
behavioral12/memory/4240-12-0x0000000000E70000-0x000000000211A000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

.NET Reactor proctector 2 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral12/memory/4240-4-0x0000000000E70000-0x000000000211A000-memory.dmp	net_reactor
behavioral12/memory/4240-12-0x0000000000E70000-0x000000000211A000-memory.dmp	net_reactor

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4240	dotNET_Reactor.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4240	dotNET_Reactor.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3644 wrote to memory of 4240	3644	dotNET_Reactor.Console.exe	79
PID 3644 wrote to memory of 4240	3644	dotNET_Reactor.Console.exe	79
PID 3644 wrote to memory of 4240	3644	dotNET_Reactor.Console.exe	79

C:\Users\Admin\AppData\Local\Temp\dotNET_Reactor\dotNET_Reactor.Console.exe
"C:\Users\Admin\AppData\Local\Temp\dotNET_Reactor\dotNET_Reactor.Console.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3644
- C:\Users\Admin\AppData\Local\Temp\dotNET_Reactor\dotNET_Reactor.exe
  "C:\Users\Admin\AppData\Local\Temp\dotNET_Reactor\dotNET_Reactor.exe" "--noargs"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetWindowsHookEx
  PID:4240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3644-0-0x0000000000920000-0x000000000092A000-memory.dmp

Filesize
40KB

Download
memory/3644-1-0x00007FFA9D210000-0x00007FFA9DCD2000-memory.dmp

Filesize
10.8MB

Download
memory/3644-15-0x00007FFA9D210000-0x00007FFA9DCD2000-memory.dmp

Filesize
10.8MB

Download
memory/4240-2-0x0000000000E70000-0x000000000211A000-memory.dmp

Filesize
18.7MB

Download
memory/4240-3-0x0000000074540000-0x0000000074CF1000-memory.dmp

Filesize
7.7MB

Download
memory/4240-4-0x0000000000E70000-0x000000000211A000-memory.dmp

Filesize
18.7MB

Download
memory/4240-5-0x0000000006B50000-0x00000000070F6000-memory.dmp

Filesize
5.6MB

Download
memory/4240-8-0x0000000006670000-0x0000000006680000-memory.dmp

Filesize
64KB

Download
memory/4240-9-0x0000000006680000-0x00000000066E6000-memory.dmp

Filesize
408KB

Download
memory/4240-10-0x00000000075A0000-0x0000000007632000-memory.dmp

Filesize
584KB

Download
memory/4240-12-0x0000000000E70000-0x000000000211A000-memory.dmp

Filesize
18.7MB

Download
memory/4240-13-0x0000000074540000-0x0000000074CF1000-memory.dmp

Filesize
7.7MB

Download