zgrat | 415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf

General

Target

415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf.exe
Size

1.3MB
MD5

d18e6c991fa548d0cf39ea1586738d2f
SHA1

8a36bcb681c19ee4ebc63b61155d1a2a0c0e742d
SHA256

415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf
SHA512

6dc858956208ffe8a6164b559c315a9b4a967797ac4ec394fa3df61ab2aaf26ab4f366e0bfa4711f3bc2f26fe23602877f2df74927e76250119fb2e4a4e4e2e4
SSDEEP

6144:l5zE03idtBgfNM4NbtbKQ7aZV2+lfJzr27/stxtJvcsWy3as+CBbDMnjwVAgRjI0:6teRexrugPlsWlZ2cwpdlK6LocKZuBu

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 35 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2756-5-0x0000000006F20000-0x00000000071DA000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-6-0x0000000006F20000-0x00000000071D3000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-7-0x0000000006F20000-0x00000000071D3000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-9-0x0000000006F20000-0x00000000071D3000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-13-0x0000000006F20000-0x00000000071D3000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-11-0x0000000006F20000-0x00000000071D3000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-15-0x0000000006F20000-0x00000000071D3000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-17-0x0000000006F20000-0x00000000071D3000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-21-0x0000000006F20000-0x00000000071D3000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-19-0x0000000006F20000-0x00000000071D3000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-23-0x0000000006F20000-0x00000000071D3000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-25-0x0000000006F20000-0x00000000071D3000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-27-0x0000000006F20000-0x00000000071D3000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-29-0x0000000006F20000-0x00000000071D3000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-33-0x0000000006F20000-0x00000000071D3000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-31-0x0000000006F20000-0x00000000071D3000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-35-0x0000000006F20000-0x00000000071D3000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-37-0x0000000006F20000-0x00000000071D3000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-39-0x0000000006F20000-0x00000000071D3000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-41-0x0000000006F20000-0x00000000071D3000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-43-0x0000000006F20000-0x00000000071D3000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-45-0x0000000006F20000-0x00000000071D3000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-51-0x0000000006F20000-0x00000000071D3000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-49-0x0000000006F20000-0x00000000071D3000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-47-0x0000000006F20000-0x00000000071D3000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-61-0x0000000006F20000-0x00000000071D3000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-59-0x0000000006F20000-0x00000000071D3000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-69-0x0000000006F20000-0x00000000071D3000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-67-0x0000000006F20000-0x00000000071D3000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-65-0x0000000006F20000-0x00000000071D3000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-63-0x0000000006F20000-0x00000000071D3000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-57-0x0000000006F20000-0x00000000071D3000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-55-0x0000000006F20000-0x00000000071D3000-memory.dmp	family_zgrat_v1
behavioral1/memory/2756-53-0x0000000006F20000-0x00000000071D3000-memory.dmp	family_zgrat_v1
behavioral1/memory/1544-4911-0x0000000002150000-0x0000000002238000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Executes dropped EXE 1 IoCs

Processes:

Keywords.exe

pid process

2532 Keywords.exe

pid	process
2532	Keywords.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf.exe

description	pid	process	target process
PID 2756 set thread context of 1544	2756	415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf.exe	415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2960 powershell.exe

pid	process
2960	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf.exe415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2756	415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf.exe
Token: SeDebugPrivilege	2756	415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf.exe
Token: SeDebugPrivilege	1544	415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf.exe
Token: SeDebugPrivilege	2960	powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf.exetaskeng.exetaskeng.exe

description	pid	process	target process
PID 2756 wrote to memory of 1544	2756	415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf.exe	415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf.exe
PID 2756 wrote to memory of 1544	2756	415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf.exe	415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf.exe
PID 2756 wrote to memory of 1544	2756	415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf.exe	415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf.exe
PID 2756 wrote to memory of 1544	2756	415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf.exe	415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf.exe
PID 2756 wrote to memory of 1544	2756	415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf.exe	415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf.exe
PID 2756 wrote to memory of 1544	2756	415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf.exe	415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf.exe
PID 2756 wrote to memory of 1544	2756	415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf.exe	415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf.exe
PID 2756 wrote to memory of 1544	2756	415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf.exe	415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf.exe
PID 2756 wrote to memory of 1544	2756	415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf.exe	415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf.exe
PID 2636 wrote to memory of 2960	2636	taskeng.exe	powershell.exe
PID 2636 wrote to memory of 2960	2636	taskeng.exe	powershell.exe
PID 2636 wrote to memory of 2960	2636	taskeng.exe	powershell.exe
PID 1940 wrote to memory of 2532	1940	taskeng.exe	Keywords.exe
PID 1940 wrote to memory of 2532	1940	taskeng.exe	Keywords.exe
PID 1940 wrote to memory of 2532	1940	taskeng.exe	Keywords.exe
PID 1940 wrote to memory of 2532	1940	taskeng.exe	Keywords.exe

C:\Users\Admin\AppData\Local\Temp\415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf.exe
"C:\Users\Admin\AppData\Local\Temp\415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2756

C:\Users\Admin\AppData\Local\Temp\415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf.exe
"C:\Users\Admin\AppData\Local\Temp\415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1544

C:\Windows\system32\taskeng.exe
taskeng.exe {663BAF9A-C12C-4FE6-8AD2-B3F3C88FE750} S-1-5-21-1298544033-3225604241-2703760938-1000:IZKCKOTP\Admin:S4U:
1⤵
- Suspicious use of WriteProcessMemory
PID:2636

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAASwBlAHkAdwBvAHIAZABzAC4AZQB4AGUAOwA=
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2960

C:\Windows\system32\taskeng.exe
taskeng.exe {D17B2514-5418-4C0E-9177-F86F7C3280B7} S-1-5-21-1298544033-3225604241-2703760938-1000:IZKCKOTP\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1940

C:\Users\Admin\AppData\Local\Local\gcvynqf\Keywords.exe
C:\Users\Admin\AppData\Local\Local\gcvynqf\Keywords.exe
2⤵
- Executes dropped EXE
PID:2532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Local\gcvynqf\Keywords.exe
Filesize
1.3MB

MD5
d18e6c991fa548d0cf39ea1586738d2f

SHA1
8a36bcb681c19ee4ebc63b61155d1a2a0c0e742d

SHA256
415501cba527ef5e011fd0c180e45545b7602dc25d76a3d0752220f207861baf

SHA512
6dc858956208ffe8a6164b559c315a9b4a967797ac4ec394fa3df61ab2aaf26ab4f366e0bfa4711f3bc2f26fe23602877f2df74927e76250119fb2e4a4e4e2e4

Download Submit
memory/1544-4910-0x0000000074A90000-0x000000007517E000-memory.dmp

Filesize
6.9MB

Download
memory/1544-7140-0x0000000074A90000-0x000000007517E000-memory.dmp

Filesize
6.9MB

Download
memory/1544-7138-0x00000000008D0000-0x0000000000926000-memory.dmp

Filesize
344KB

Download
memory/1544-7137-0x0000000000650000-0x0000000000658000-memory.dmp

Filesize
32KB

Download
memory/1544-4912-0x0000000004BD0000-0x0000000004C10000-memory.dmp

Filesize
256KB

Download
memory/1544-4911-0x0000000002150000-0x0000000002238000-memory.dmp

Filesize
928KB

Download
memory/1544-4909-0x0000000000420000-0x00000000004CC000-memory.dmp

Filesize
688KB

Download
memory/2532-7156-0x0000000000CD0000-0x0000000000E1A000-memory.dmp

Filesize
1.3MB

Download
memory/2532-7155-0x0000000074B50000-0x000000007523E000-memory.dmp

Filesize
6.9MB

Download
memory/2756-23-0x0000000006F20000-0x00000000071D3000-memory.dmp

Filesize
2.7MB

Download
memory/2756-63-0x0000000006F20000-0x00000000071D3000-memory.dmp

Filesize
2.7MB

Download
memory/2756-17-0x0000000006F20000-0x00000000071D3000-memory.dmp

Filesize
2.7MB

Download
memory/2756-21-0x0000000006F20000-0x00000000071D3000-memory.dmp

Filesize
2.7MB

Download
memory/2756-19-0x0000000006F20000-0x00000000071D3000-memory.dmp

Filesize
2.7MB

Download
memory/2756-0-0x00000000002D0000-0x000000000041A000-memory.dmp

Filesize
1.3MB

Download
memory/2756-25-0x0000000006F20000-0x00000000071D3000-memory.dmp

Filesize
2.7MB

Download
memory/2756-27-0x0000000006F20000-0x00000000071D3000-memory.dmp

Filesize
2.7MB

Download
memory/2756-29-0x0000000006F20000-0x00000000071D3000-memory.dmp

Filesize
2.7MB

Download
memory/2756-33-0x0000000006F20000-0x00000000071D3000-memory.dmp

Filesize
2.7MB

Download
memory/2756-31-0x0000000006F20000-0x00000000071D3000-memory.dmp

Filesize
2.7MB

Download
memory/2756-35-0x0000000006F20000-0x00000000071D3000-memory.dmp

Filesize
2.7MB

Download
memory/2756-37-0x0000000006F20000-0x00000000071D3000-memory.dmp

Filesize
2.7MB

Download
memory/2756-39-0x0000000006F20000-0x00000000071D3000-memory.dmp

Filesize
2.7MB

Download
memory/2756-41-0x0000000006F20000-0x00000000071D3000-memory.dmp

Filesize
2.7MB

Download
memory/2756-43-0x0000000006F20000-0x00000000071D3000-memory.dmp

Filesize
2.7MB

Download
memory/2756-45-0x0000000006F20000-0x00000000071D3000-memory.dmp

Filesize
2.7MB

Download
memory/2756-51-0x0000000006F20000-0x00000000071D3000-memory.dmp

Filesize
2.7MB

Download
memory/2756-49-0x0000000006F20000-0x00000000071D3000-memory.dmp

Filesize
2.7MB

Download
memory/2756-47-0x0000000006F20000-0x00000000071D3000-memory.dmp

Filesize
2.7MB

Download
memory/2756-61-0x0000000006F20000-0x00000000071D3000-memory.dmp

Filesize
2.7MB

Download
memory/2756-59-0x0000000006F20000-0x00000000071D3000-memory.dmp

Filesize
2.7MB

Download
memory/2756-69-0x0000000006F20000-0x00000000071D3000-memory.dmp

Filesize
2.7MB

Download
memory/2756-67-0x0000000006F20000-0x00000000071D3000-memory.dmp

Filesize
2.7MB

Download
memory/2756-65-0x0000000006F20000-0x00000000071D3000-memory.dmp

Filesize
2.7MB

Download
memory/2756-15-0x0000000006F20000-0x00000000071D3000-memory.dmp

Filesize
2.7MB

Download
memory/2756-57-0x0000000006F20000-0x00000000071D3000-memory.dmp

Filesize
2.7MB

Download
memory/2756-55-0x0000000006F20000-0x00000000071D3000-memory.dmp

Filesize
2.7MB

Download
memory/2756-53-0x0000000006F20000-0x00000000071D3000-memory.dmp

Filesize
2.7MB

Download
memory/2756-4886-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download
memory/2756-4887-0x0000000005330000-0x0000000005424000-memory.dmp

Filesize
976KB

Download
memory/2756-4888-0x0000000004520000-0x000000000456C000-memory.dmp

Filesize
304KB

Download
memory/2756-4889-0x0000000004E00000-0x0000000004E54000-memory.dmp

Filesize
336KB

Download
memory/2756-4900-0x0000000074B10000-0x00000000751FE000-memory.dmp

Filesize
6.9MB

Download
memory/2756-11-0x0000000006F20000-0x00000000071D3000-memory.dmp

Filesize
2.7MB

Download
memory/2756-13-0x0000000006F20000-0x00000000071D3000-memory.dmp

Filesize
2.7MB

Download
memory/2756-9-0x0000000006F20000-0x00000000071D3000-memory.dmp

Filesize
2.7MB

Download
memory/2756-7-0x0000000006F20000-0x00000000071D3000-memory.dmp

Filesize
2.7MB

Download
memory/2756-6-0x0000000006F20000-0x00000000071D3000-memory.dmp

Filesize
2.7MB

Download
memory/2756-5-0x0000000006F20000-0x00000000071DA000-memory.dmp

Filesize
2.7MB

Download
memory/2756-4-0x0000000004F20000-0x0000000004F60000-memory.dmp

Filesize
256KB

Download
memory/2756-1-0x0000000074B10000-0x00000000751FE000-memory.dmp

Filesize
6.9MB

Download
memory/2756-2-0x0000000004F20000-0x0000000004F60000-memory.dmp

Filesize
256KB

Download
memory/2756-3-0x0000000074B10000-0x00000000751FE000-memory.dmp

Filesize
6.9MB

Download
memory/2960-7148-0x0000000001850000-0x00000000018D0000-memory.dmp

Filesize
512KB

Download
memory/2960-7149-0x000007FEF5D20000-0x000007FEF66BD000-memory.dmp

Filesize
9.6MB

Download
memory/2960-7150-0x0000000001850000-0x00000000018D0000-memory.dmp

Filesize
512KB

Download
memory/2960-7151-0x0000000001850000-0x00000000018D0000-memory.dmp

Filesize
512KB

Download
memory/2960-7152-0x000007FEF5D20000-0x000007FEF66BD000-memory.dmp

Filesize
9.6MB

Download
memory/2960-7147-0x000007FEF5D20000-0x000007FEF66BD000-memory.dmp

Filesize
9.6MB

Download
memory/2960-7146-0x0000000000DF0000-0x0000000000DF8000-memory.dmp

Filesize
32KB

Download
memory/2960-7145-0x000000001A1E0000-0x000000001A4C2000-memory.dmp

Filesize
2.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads