zgrat | 086bcb65380fa0e4d23c07fbff58863949f8158b87d07cd6eac6485d99b3bf0d

General

Target

086bcb65380fa0e4d23c07fbff58863949f8158b87d07cd6eac6485d99b3bf0d.exe
Size

2.8MB
MD5

7f1e688e77760ad29c560404a2fb9d2f
SHA1

7c06e05c8e13d01df26653cbe12695af139c5854
SHA256

086bcb65380fa0e4d23c07fbff58863949f8158b87d07cd6eac6485d99b3bf0d
SHA512

e841524c36ec9f550bbd299fbd33bbf15587dde922c747ae719bea03c387e62bbb9a73fdee0188dfb1586cca5b9dc81745144e633ed3dcb661434ab1c87e393e
SSDEEP

49152:lAfXmQ/GT5+pDEuOwHLHE83/G9+SbSyCfHtl8/ioefjKxAd2jVAeIXT:2+4GT0OSL04Dl8/gcAsJAeIj

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3220-3-0x0000000004F70000-0x00000000051A4000-memory.dmp	family_zgrat_v1
behavioral2/memory/3220-6-0x0000000004F70000-0x000000000519E000-memory.dmp	family_zgrat_v1
behavioral2/memory/3220-9-0x0000000004F70000-0x000000000519E000-memory.dmp	family_zgrat_v1
behavioral2/memory/3220-11-0x0000000004F70000-0x000000000519E000-memory.dmp	family_zgrat_v1
behavioral2/memory/3220-7-0x0000000004F70000-0x000000000519E000-memory.dmp	family_zgrat_v1
behavioral2/memory/3220-13-0x0000000004F70000-0x000000000519E000-memory.dmp	family_zgrat_v1
behavioral2/memory/3220-15-0x0000000004F70000-0x000000000519E000-memory.dmp	family_zgrat_v1
behavioral2/memory/3220-17-0x0000000004F70000-0x000000000519E000-memory.dmp	family_zgrat_v1
behavioral2/memory/3220-19-0x0000000004F70000-0x000000000519E000-memory.dmp	family_zgrat_v1
behavioral2/memory/3220-21-0x0000000004F70000-0x000000000519E000-memory.dmp	family_zgrat_v1
behavioral2/memory/3220-23-0x0000000004F70000-0x000000000519E000-memory.dmp	family_zgrat_v1
behavioral2/memory/3220-25-0x0000000004F70000-0x000000000519E000-memory.dmp	family_zgrat_v1
behavioral2/memory/3220-29-0x0000000004F70000-0x000000000519E000-memory.dmp	family_zgrat_v1
behavioral2/memory/3220-31-0x0000000004F70000-0x000000000519E000-memory.dmp	family_zgrat_v1
behavioral2/memory/3220-33-0x0000000004F70000-0x000000000519E000-memory.dmp	family_zgrat_v1
behavioral2/memory/3220-35-0x0000000004F70000-0x000000000519E000-memory.dmp	family_zgrat_v1
behavioral2/memory/3220-27-0x0000000004F70000-0x000000000519E000-memory.dmp	family_zgrat_v1
behavioral2/memory/3220-37-0x0000000004F70000-0x000000000519E000-memory.dmp	family_zgrat_v1
behavioral2/memory/3220-39-0x0000000004F70000-0x000000000519E000-memory.dmp	family_zgrat_v1
behavioral2/memory/3220-41-0x0000000004F70000-0x000000000519E000-memory.dmp	family_zgrat_v1
behavioral2/memory/3220-43-0x0000000004F70000-0x000000000519E000-memory.dmp	family_zgrat_v1
behavioral2/memory/3220-45-0x0000000004F70000-0x000000000519E000-memory.dmp	family_zgrat_v1
behavioral2/memory/3220-47-0x0000000004F70000-0x000000000519E000-memory.dmp	family_zgrat_v1
behavioral2/memory/3220-51-0x0000000004F70000-0x000000000519E000-memory.dmp	family_zgrat_v1
behavioral2/memory/3220-53-0x0000000004F70000-0x000000000519E000-memory.dmp	family_zgrat_v1
behavioral2/memory/3220-57-0x0000000004F70000-0x000000000519E000-memory.dmp	family_zgrat_v1
behavioral2/memory/3220-55-0x0000000004F70000-0x000000000519E000-memory.dmp	family_zgrat_v1
behavioral2/memory/3220-49-0x0000000004F70000-0x000000000519E000-memory.dmp	family_zgrat_v1
behavioral2/memory/3220-59-0x0000000004F70000-0x000000000519E000-memory.dmp	family_zgrat_v1
behavioral2/memory/3220-63-0x0000000004F70000-0x000000000519E000-memory.dmp	family_zgrat_v1
behavioral2/memory/3220-61-0x0000000004F70000-0x000000000519E000-memory.dmp	family_zgrat_v1
behavioral2/memory/3220-65-0x0000000004F70000-0x000000000519E000-memory.dmp	family_zgrat_v1
behavioral2/memory/3220-69-0x0000000004F70000-0x000000000519E000-memory.dmp	family_zgrat_v1
behavioral2/memory/3220-67-0x0000000004F70000-0x000000000519E000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

086bcb65380fa0e4d23c07fbff58863949f8158b87d07cd6eac6485d99b3bf0d.exe

description	pid	process	target process
PID 3220 set thread context of 4668	3220	086bcb65380fa0e4d23c07fbff58863949f8158b87d07cd6eac6485d99b3bf0d.exe	MSBuild.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1864 4668 WerFault.exe MSBuild.exe

pid	pid_target	process	target process
1864	4668	WerFault.exe	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

086bcb65380fa0e4d23c07fbff58863949f8158b87d07cd6eac6485d99b3bf0d.exe

description	pid	process
Token: SeDebugPrivilege	3220	086bcb65380fa0e4d23c07fbff58863949f8158b87d07cd6eac6485d99b3bf0d.exe
Token: SeDebugPrivilege	3220	086bcb65380fa0e4d23c07fbff58863949f8158b87d07cd6eac6485d99b3bf0d.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

086bcb65380fa0e4d23c07fbff58863949f8158b87d07cd6eac6485d99b3bf0d.exe

description	pid	process	target process
PID 3220 wrote to memory of 4668	3220	086bcb65380fa0e4d23c07fbff58863949f8158b87d07cd6eac6485d99b3bf0d.exe	MSBuild.exe
PID 3220 wrote to memory of 4668	3220	086bcb65380fa0e4d23c07fbff58863949f8158b87d07cd6eac6485d99b3bf0d.exe	MSBuild.exe
PID 3220 wrote to memory of 4668	3220	086bcb65380fa0e4d23c07fbff58863949f8158b87d07cd6eac6485d99b3bf0d.exe	MSBuild.exe
PID 3220 wrote to memory of 4668	3220	086bcb65380fa0e4d23c07fbff58863949f8158b87d07cd6eac6485d99b3bf0d.exe	MSBuild.exe
PID 3220 wrote to memory of 4668	3220	086bcb65380fa0e4d23c07fbff58863949f8158b87d07cd6eac6485d99b3bf0d.exe	MSBuild.exe
PID 3220 wrote to memory of 4668	3220	086bcb65380fa0e4d23c07fbff58863949f8158b87d07cd6eac6485d99b3bf0d.exe	MSBuild.exe
PID 3220 wrote to memory of 4668	3220	086bcb65380fa0e4d23c07fbff58863949f8158b87d07cd6eac6485d99b3bf0d.exe	MSBuild.exe
PID 3220 wrote to memory of 4668	3220	086bcb65380fa0e4d23c07fbff58863949f8158b87d07cd6eac6485d99b3bf0d.exe	MSBuild.exe
PID 3220 wrote to memory of 4668	3220	086bcb65380fa0e4d23c07fbff58863949f8158b87d07cd6eac6485d99b3bf0d.exe	MSBuild.exe
PID 3220 wrote to memory of 4668	3220	086bcb65380fa0e4d23c07fbff58863949f8158b87d07cd6eac6485d99b3bf0d.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\086bcb65380fa0e4d23c07fbff58863949f8158b87d07cd6eac6485d99b3bf0d.exe
"C:\Users\Admin\AppData\Local\Temp\086bcb65380fa0e4d23c07fbff58863949f8158b87d07cd6eac6485d99b3bf0d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3220

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
PID:4668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 400
3⤵
- Program crash
PID:1864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4668 -ip 4668
1⤵
PID:544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3220-1-0x00000000745D0000-0x0000000074D81000-memory.dmp

Filesize
7.7MB

Download
memory/3220-0-0x00000000002E0000-0x00000000005B4000-memory.dmp

Filesize
2.8MB

Download
memory/3220-2-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/3220-3-0x0000000004F70000-0x00000000051A4000-memory.dmp

Filesize
2.2MB

Download
memory/3220-4-0x0000000005750000-0x0000000005CF6000-memory.dmp

Filesize
5.6MB

Download
memory/3220-5-0x0000000005250000-0x00000000052E2000-memory.dmp

Filesize
584KB

Download
memory/3220-6-0x0000000004F70000-0x000000000519E000-memory.dmp

Filesize
2.2MB

Download
memory/3220-9-0x0000000004F70000-0x000000000519E000-memory.dmp

Filesize
2.2MB

Download
memory/3220-11-0x0000000004F70000-0x000000000519E000-memory.dmp

Filesize
2.2MB

Download
memory/3220-7-0x0000000004F70000-0x000000000519E000-memory.dmp

Filesize
2.2MB

Download
memory/3220-13-0x0000000004F70000-0x000000000519E000-memory.dmp

Filesize
2.2MB

Download
memory/3220-15-0x0000000004F70000-0x000000000519E000-memory.dmp

Filesize
2.2MB

Download
memory/3220-17-0x0000000004F70000-0x000000000519E000-memory.dmp

Filesize
2.2MB

Download
memory/3220-19-0x0000000004F70000-0x000000000519E000-memory.dmp

Filesize
2.2MB

Download
memory/3220-21-0x0000000004F70000-0x000000000519E000-memory.dmp

Filesize
2.2MB

Download
memory/3220-23-0x0000000004F70000-0x000000000519E000-memory.dmp

Filesize
2.2MB

Download
memory/3220-25-0x0000000004F70000-0x000000000519E000-memory.dmp

Filesize
2.2MB

Download
memory/3220-29-0x0000000004F70000-0x000000000519E000-memory.dmp

Filesize
2.2MB

Download
memory/3220-31-0x0000000004F70000-0x000000000519E000-memory.dmp

Filesize
2.2MB

Download
memory/3220-33-0x0000000004F70000-0x000000000519E000-memory.dmp

Filesize
2.2MB

Download
memory/3220-35-0x0000000004F70000-0x000000000519E000-memory.dmp

Filesize
2.2MB

Download
memory/3220-27-0x0000000004F70000-0x000000000519E000-memory.dmp

Filesize
2.2MB

Download
memory/3220-37-0x0000000004F70000-0x000000000519E000-memory.dmp

Filesize
2.2MB

Download
memory/3220-39-0x0000000004F70000-0x000000000519E000-memory.dmp

Filesize
2.2MB

Download
memory/3220-41-0x0000000004F70000-0x000000000519E000-memory.dmp

Filesize
2.2MB

Download
memory/3220-43-0x0000000004F70000-0x000000000519E000-memory.dmp

Filesize
2.2MB

Download
memory/3220-45-0x0000000004F70000-0x000000000519E000-memory.dmp

Filesize
2.2MB

Download
memory/3220-47-0x0000000004F70000-0x000000000519E000-memory.dmp

Filesize
2.2MB

Download
memory/3220-51-0x0000000004F70000-0x000000000519E000-memory.dmp

Filesize
2.2MB

Download
memory/3220-53-0x0000000004F70000-0x000000000519E000-memory.dmp

Filesize
2.2MB

Download
memory/3220-57-0x0000000004F70000-0x000000000519E000-memory.dmp

Filesize
2.2MB

Download
memory/3220-55-0x0000000004F70000-0x000000000519E000-memory.dmp

Filesize
2.2MB

Download
memory/3220-49-0x0000000004F70000-0x000000000519E000-memory.dmp

Filesize
2.2MB

Download
memory/3220-59-0x0000000004F70000-0x000000000519E000-memory.dmp

Filesize
2.2MB

Download
memory/3220-63-0x0000000004F70000-0x000000000519E000-memory.dmp

Filesize
2.2MB

Download
memory/3220-61-0x0000000004F70000-0x000000000519E000-memory.dmp

Filesize
2.2MB

Download
memory/3220-65-0x0000000004F70000-0x000000000519E000-memory.dmp

Filesize
2.2MB

Download
memory/3220-69-0x0000000004F70000-0x000000000519E000-memory.dmp

Filesize
2.2MB

Download
memory/3220-67-0x0000000004F70000-0x000000000519E000-memory.dmp

Filesize
2.2MB

Download
memory/3220-3141-0x00000000745D0000-0x0000000074D81000-memory.dmp

Filesize
7.7MB

Download
memory/3220-3502-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/3220-4888-0x0000000005220000-0x0000000005221000-memory.dmp

Filesize
4KB

Download
memory/3220-4889-0x0000000005E00000-0x0000000005E70000-memory.dmp

Filesize
448KB

Download
memory/3220-4890-0x0000000005E70000-0x0000000005EBC000-memory.dmp

Filesize
304KB

Download
memory/3220-4891-0x0000000005ED0000-0x0000000005F24000-memory.dmp

Filesize
336KB

Download
memory/3220-4897-0x00000000745D0000-0x0000000074D81000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads