zgrat | 5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191

General

Target

5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe
Size

209KB
MD5

37b1b265010213a6b399f256f0f30612
SHA1

efb26dc10127cb575729fd19d308dad01e4d2484
SHA256

5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191
SHA512

46ad0cd7651230e4b5aba1117f1aa0f215389188d112a783b37818db7b66ac0783634300e2d943c802e9028459e775492d844ed9f87b3aa45405c9d0e567e7f8
SSDEEP

3072:riBtuH8wrbjHTKXr9i0XqRwtWRB4uLalQrm06fG4R+ZIc:mBtuH8wrWRiZRkWYuLLrJ67+

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1720-4-0x00000000064E0000-0x00000000067D4000-memory.dmp	family_zgrat_v1
behavioral2/memory/1720-7-0x00000000064E0000-0x00000000067CF000-memory.dmp	family_zgrat_v1
behavioral2/memory/1720-8-0x00000000064E0000-0x00000000067CF000-memory.dmp	family_zgrat_v1
behavioral2/memory/1720-10-0x00000000064E0000-0x00000000067CF000-memory.dmp	family_zgrat_v1
behavioral2/memory/1720-12-0x00000000064E0000-0x00000000067CF000-memory.dmp	family_zgrat_v1
behavioral2/memory/1720-14-0x00000000064E0000-0x00000000067CF000-memory.dmp	family_zgrat_v1
behavioral2/memory/1720-16-0x00000000064E0000-0x00000000067CF000-memory.dmp	family_zgrat_v1
behavioral2/memory/1720-18-0x00000000064E0000-0x00000000067CF000-memory.dmp	family_zgrat_v1
behavioral2/memory/1720-20-0x00000000064E0000-0x00000000067CF000-memory.dmp	family_zgrat_v1
behavioral2/memory/1720-22-0x00000000064E0000-0x00000000067CF000-memory.dmp	family_zgrat_v1
behavioral2/memory/1720-24-0x00000000064E0000-0x00000000067CF000-memory.dmp	family_zgrat_v1
behavioral2/memory/1720-26-0x00000000064E0000-0x00000000067CF000-memory.dmp	family_zgrat_v1
behavioral2/memory/1720-28-0x00000000064E0000-0x00000000067CF000-memory.dmp	family_zgrat_v1
behavioral2/memory/1720-30-0x00000000064E0000-0x00000000067CF000-memory.dmp	family_zgrat_v1
behavioral2/memory/1720-32-0x00000000064E0000-0x00000000067CF000-memory.dmp	family_zgrat_v1
behavioral2/memory/1720-34-0x00000000064E0000-0x00000000067CF000-memory.dmp	family_zgrat_v1
behavioral2/memory/1720-36-0x00000000064E0000-0x00000000067CF000-memory.dmp	family_zgrat_v1
behavioral2/memory/1720-38-0x00000000064E0000-0x00000000067CF000-memory.dmp	family_zgrat_v1
behavioral2/memory/1720-40-0x00000000064E0000-0x00000000067CF000-memory.dmp	family_zgrat_v1
behavioral2/memory/1720-42-0x00000000064E0000-0x00000000067CF000-memory.dmp	family_zgrat_v1
behavioral2/memory/1720-44-0x00000000064E0000-0x00000000067CF000-memory.dmp	family_zgrat_v1
behavioral2/memory/1720-46-0x00000000064E0000-0x00000000067CF000-memory.dmp	family_zgrat_v1
behavioral2/memory/1720-48-0x00000000064E0000-0x00000000067CF000-memory.dmp	family_zgrat_v1
behavioral2/memory/1720-50-0x00000000064E0000-0x00000000067CF000-memory.dmp	family_zgrat_v1
behavioral2/memory/1720-52-0x00000000064E0000-0x00000000067CF000-memory.dmp	family_zgrat_v1
behavioral2/memory/1720-54-0x00000000064E0000-0x00000000067CF000-memory.dmp	family_zgrat_v1
behavioral2/memory/1720-56-0x00000000064E0000-0x00000000067CF000-memory.dmp	family_zgrat_v1
behavioral2/memory/1720-58-0x00000000064E0000-0x00000000067CF000-memory.dmp	family_zgrat_v1
behavioral2/memory/1720-60-0x00000000064E0000-0x00000000067CF000-memory.dmp	family_zgrat_v1
behavioral2/memory/1720-62-0x00000000064E0000-0x00000000067CF000-memory.dmp	family_zgrat_v1
behavioral2/memory/1720-64-0x00000000064E0000-0x00000000067CF000-memory.dmp	family_zgrat_v1
behavioral2/memory/1720-66-0x00000000064E0000-0x00000000067CF000-memory.dmp	family_zgrat_v1
behavioral2/memory/1720-68-0x00000000064E0000-0x00000000067CF000-memory.dmp	family_zgrat_v1
behavioral2/memory/1720-70-0x00000000064E0000-0x00000000067CF000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe

description	pid	process	target process
PID 1720 set thread context of 5032	1720	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe

description	pid	process
Token: SeDebugPrivilege	1720	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe
Token: SeDebugPrivilege	1720	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe
Token: SeDebugPrivilege	5032	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe

description	pid	process	target process
PID 1720 wrote to memory of 5032	1720	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe
PID 1720 wrote to memory of 5032	1720	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe
PID 1720 wrote to memory of 5032	1720	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe
PID 1720 wrote to memory of 5032	1720	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe
PID 1720 wrote to memory of 5032	1720	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe
PID 1720 wrote to memory of 5032	1720	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe
PID 1720 wrote to memory of 5032	1720	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe
PID 1720 wrote to memory of 5032	1720	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe

C:\Users\Admin\AppData\Local\Temp\5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe
"C:\Users\Admin\AppData\Local\Temp\5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1720

C:\Users\Admin\AppData\Local\Temp\5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe
"C:\Users\Admin\AppData\Local\Temp\5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe.log
Filesize
1KB

MD5
3c485da05806092761ed2c34cdf66ea8

SHA1
0694a1877b60e9f15508c8f1086142453d3b71b3

SHA256
90cad9ea7e0a84213929adaf934daf8447f2bb99027fb90648a9d2cf0b36300e

SHA512
04397f7e882aaff541d5a332260119d1468977958ae9b2f3905e98c0c20bc6cd695a3b9fe92c8f538872666417ab77c517c3543cf787ddf18bfe491c82b886cb

Download Submit
memory/1720-0-0x0000000000160000-0x0000000000196000-memory.dmp

Filesize
216KB

Download
memory/1720-1-0x0000000074910000-0x00000000750C0000-memory.dmp

Filesize
7.7MB

Download
memory/1720-2-0x0000000004D20000-0x0000000004D30000-memory.dmp

Filesize
64KB

Download
memory/1720-3-0x0000000002660000-0x0000000002666000-memory.dmp

Filesize
24KB

Download
memory/1720-4-0x00000000064E0000-0x00000000067D4000-memory.dmp

Filesize
3.0MB

Download
memory/1720-5-0x0000000006D80000-0x0000000007324000-memory.dmp

Filesize
5.6MB

Download
memory/1720-6-0x00000000069B0000-0x0000000006A42000-memory.dmp

Filesize
584KB

Download
memory/1720-7-0x00000000064E0000-0x00000000067CF000-memory.dmp

Filesize
2.9MB

Download
memory/1720-8-0x00000000064E0000-0x00000000067CF000-memory.dmp

Filesize
2.9MB

Download
memory/1720-10-0x00000000064E0000-0x00000000067CF000-memory.dmp

Filesize
2.9MB

Download
memory/1720-12-0x00000000064E0000-0x00000000067CF000-memory.dmp

Filesize
2.9MB

Download
memory/1720-14-0x00000000064E0000-0x00000000067CF000-memory.dmp

Filesize
2.9MB

Download
memory/1720-16-0x00000000064E0000-0x00000000067CF000-memory.dmp

Filesize
2.9MB

Download
memory/1720-18-0x00000000064E0000-0x00000000067CF000-memory.dmp

Filesize
2.9MB

Download
memory/1720-20-0x00000000064E0000-0x00000000067CF000-memory.dmp

Filesize
2.9MB

Download
memory/1720-22-0x00000000064E0000-0x00000000067CF000-memory.dmp

Filesize
2.9MB

Download
memory/1720-24-0x00000000064E0000-0x00000000067CF000-memory.dmp

Filesize
2.9MB

Download
memory/1720-26-0x00000000064E0000-0x00000000067CF000-memory.dmp

Filesize
2.9MB

Download
memory/1720-28-0x00000000064E0000-0x00000000067CF000-memory.dmp

Filesize
2.9MB

Download
memory/1720-30-0x00000000064E0000-0x00000000067CF000-memory.dmp

Filesize
2.9MB

Download
memory/1720-32-0x00000000064E0000-0x00000000067CF000-memory.dmp

Filesize
2.9MB

Download
memory/1720-34-0x00000000064E0000-0x00000000067CF000-memory.dmp

Filesize
2.9MB

Download
memory/1720-36-0x00000000064E0000-0x00000000067CF000-memory.dmp

Filesize
2.9MB

Download
memory/1720-38-0x00000000064E0000-0x00000000067CF000-memory.dmp

Filesize
2.9MB

Download
memory/1720-40-0x00000000064E0000-0x00000000067CF000-memory.dmp

Filesize
2.9MB

Download
memory/1720-42-0x00000000064E0000-0x00000000067CF000-memory.dmp

Filesize
2.9MB

Download
memory/1720-44-0x00000000064E0000-0x00000000067CF000-memory.dmp

Filesize
2.9MB

Download
memory/1720-46-0x00000000064E0000-0x00000000067CF000-memory.dmp

Filesize
2.9MB

Download
memory/1720-48-0x00000000064E0000-0x00000000067CF000-memory.dmp

Filesize
2.9MB

Download
memory/1720-50-0x00000000064E0000-0x00000000067CF000-memory.dmp

Filesize
2.9MB

Download
memory/1720-52-0x00000000064E0000-0x00000000067CF000-memory.dmp

Filesize
2.9MB

Download
memory/1720-54-0x00000000064E0000-0x00000000067CF000-memory.dmp

Filesize
2.9MB

Download
memory/1720-56-0x00000000064E0000-0x00000000067CF000-memory.dmp

Filesize
2.9MB

Download
memory/1720-58-0x00000000064E0000-0x00000000067CF000-memory.dmp

Filesize
2.9MB

Download
memory/1720-60-0x00000000064E0000-0x00000000067CF000-memory.dmp

Filesize
2.9MB

Download
memory/1720-62-0x00000000064E0000-0x00000000067CF000-memory.dmp

Filesize
2.9MB

Download
memory/1720-64-0x00000000064E0000-0x00000000067CF000-memory.dmp

Filesize
2.9MB

Download
memory/1720-66-0x00000000064E0000-0x00000000067CF000-memory.dmp

Filesize
2.9MB

Download
memory/1720-68-0x00000000064E0000-0x00000000067CF000-memory.dmp

Filesize
2.9MB

Download
memory/1720-70-0x00000000064E0000-0x00000000067CF000-memory.dmp

Filesize
2.9MB

Download
memory/1720-459-0x0000000074910000-0x00000000750C0000-memory.dmp

Filesize
7.7MB

Download
memory/1720-729-0x0000000004D20000-0x0000000004D30000-memory.dmp

Filesize
64KB

Download
memory/1720-4889-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/1720-4890-0x00000000054F0000-0x0000000005620000-memory.dmp

Filesize
1.2MB

Download
memory/1720-4891-0x0000000000B10000-0x0000000000B5C000-memory.dmp

Filesize
304KB

Download
memory/1720-4892-0x00000000053D0000-0x0000000005424000-memory.dmp

Filesize
336KB

Download
memory/1720-4897-0x0000000074910000-0x00000000750C0000-memory.dmp

Filesize
7.7MB

Download
memory/5032-4896-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/5032-4898-0x0000000074910000-0x00000000750C0000-memory.dmp

Filesize
7.7MB

Download
memory/5032-4899-0x0000000005460000-0x0000000005576000-memory.dmp

Filesize
1.1MB

Download
memory/5032-4900-0x0000000005580000-0x0000000005590000-memory.dmp

Filesize
64KB

Download
memory/5032-7205-0x0000000005610000-0x0000000005618000-memory.dmp

Filesize
32KB

Download
memory/5032-7206-0x00000000057B0000-0x000000000584E000-memory.dmp

Filesize
632KB

Download
memory/5032-7207-0x0000000074910000-0x00000000750C0000-memory.dmp

Filesize
7.7MB

Download
memory/5032-7208-0x0000000005580000-0x0000000005590000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads