zgrat | 5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191

General

Target

5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe
Size

209KB
MD5

37b1b265010213a6b399f256f0f30612
SHA1

efb26dc10127cb575729fd19d308dad01e4d2484
SHA256

5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191
SHA512

46ad0cd7651230e4b5aba1117f1aa0f215389188d112a783b37818db7b66ac0783634300e2d943c802e9028459e775492d844ed9f87b3aa45405c9d0e567e7f8
SSDEEP

3072:riBtuH8wrbjHTKXr9i0XqRwtWRB4uLalQrm06fG4R+ZIc:mBtuH8wrWRiZRkWYuLLrJ67+

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2268-4-0x0000000006ED0000-0x00000000071C4000-memory.dmp	family_zgrat_v1
behavioral1/memory/2268-5-0x0000000006ED0000-0x00000000071BF000-memory.dmp	family_zgrat_v1
behavioral1/memory/2268-6-0x0000000006ED0000-0x00000000071BF000-memory.dmp	family_zgrat_v1
behavioral1/memory/2268-10-0x0000000006ED0000-0x00000000071BF000-memory.dmp	family_zgrat_v1
behavioral1/memory/2268-12-0x0000000006ED0000-0x00000000071BF000-memory.dmp	family_zgrat_v1
behavioral1/memory/2268-16-0x0000000006ED0000-0x00000000071BF000-memory.dmp	family_zgrat_v1
behavioral1/memory/2268-14-0x0000000006ED0000-0x00000000071BF000-memory.dmp	family_zgrat_v1
behavioral1/memory/2268-20-0x0000000006ED0000-0x00000000071BF000-memory.dmp	family_zgrat_v1
behavioral1/memory/2268-22-0x0000000006ED0000-0x00000000071BF000-memory.dmp	family_zgrat_v1
behavioral1/memory/2268-18-0x0000000006ED0000-0x00000000071BF000-memory.dmp	family_zgrat_v1
behavioral1/memory/2268-24-0x0000000006ED0000-0x00000000071BF000-memory.dmp	family_zgrat_v1
behavioral1/memory/2268-26-0x0000000006ED0000-0x00000000071BF000-memory.dmp	family_zgrat_v1
behavioral1/memory/2268-28-0x0000000006ED0000-0x00000000071BF000-memory.dmp	family_zgrat_v1
behavioral1/memory/2268-8-0x0000000006ED0000-0x00000000071BF000-memory.dmp	family_zgrat_v1
behavioral1/memory/2268-30-0x0000000006ED0000-0x00000000071BF000-memory.dmp	family_zgrat_v1
behavioral1/memory/2268-32-0x0000000006ED0000-0x00000000071BF000-memory.dmp	family_zgrat_v1
behavioral1/memory/2268-36-0x0000000006ED0000-0x00000000071BF000-memory.dmp	family_zgrat_v1
behavioral1/memory/2268-38-0x0000000006ED0000-0x00000000071BF000-memory.dmp	family_zgrat_v1
behavioral1/memory/2268-40-0x0000000006ED0000-0x00000000071BF000-memory.dmp	family_zgrat_v1
behavioral1/memory/2268-42-0x0000000006ED0000-0x00000000071BF000-memory.dmp	family_zgrat_v1
behavioral1/memory/2268-34-0x0000000006ED0000-0x00000000071BF000-memory.dmp	family_zgrat_v1
behavioral1/memory/2268-44-0x0000000006ED0000-0x00000000071BF000-memory.dmp	family_zgrat_v1
behavioral1/memory/2268-46-0x0000000006ED0000-0x00000000071BF000-memory.dmp	family_zgrat_v1
behavioral1/memory/2268-48-0x0000000006ED0000-0x00000000071BF000-memory.dmp	family_zgrat_v1
behavioral1/memory/2268-50-0x0000000006ED0000-0x00000000071BF000-memory.dmp	family_zgrat_v1
behavioral1/memory/2268-52-0x0000000006ED0000-0x00000000071BF000-memory.dmp	family_zgrat_v1
behavioral1/memory/2268-54-0x0000000006ED0000-0x00000000071BF000-memory.dmp	family_zgrat_v1
behavioral1/memory/2268-56-0x0000000006ED0000-0x00000000071BF000-memory.dmp	family_zgrat_v1
behavioral1/memory/2268-58-0x0000000006ED0000-0x00000000071BF000-memory.dmp	family_zgrat_v1
behavioral1/memory/2268-60-0x0000000006ED0000-0x00000000071BF000-memory.dmp	family_zgrat_v1
behavioral1/memory/2268-62-0x0000000006ED0000-0x00000000071BF000-memory.dmp	family_zgrat_v1
behavioral1/memory/2268-64-0x0000000006ED0000-0x00000000071BF000-memory.dmp	family_zgrat_v1
behavioral1/memory/2268-66-0x0000000006ED0000-0x00000000071BF000-memory.dmp	family_zgrat_v1
behavioral1/memory/2268-68-0x0000000006ED0000-0x00000000071BF000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe

description	pid	process	target process
PID 2268 set thread context of 1160	2268	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe

description	pid	process
Token: SeDebugPrivilege	2268	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe
Token: SeDebugPrivilege	2268	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe
Token: SeDebugPrivilege	1160	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe

description	pid	process	target process
PID 2268 wrote to memory of 1160	2268	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe
PID 2268 wrote to memory of 1160	2268	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe
PID 2268 wrote to memory of 1160	2268	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe
PID 2268 wrote to memory of 1160	2268	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe
PID 2268 wrote to memory of 1160	2268	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe
PID 2268 wrote to memory of 1160	2268	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe
PID 2268 wrote to memory of 1160	2268	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe
PID 2268 wrote to memory of 1160	2268	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe
PID 2268 wrote to memory of 1160	2268	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe
PID 2268 wrote to memory of 1160	2268	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe
PID 2268 wrote to memory of 1160	2268	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe
PID 2268 wrote to memory of 1160	2268	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe	5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe

C:\Users\Admin\AppData\Local\Temp\5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe
"C:\Users\Admin\AppData\Local\Temp\5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2268

C:\Users\Admin\AppData\Local\Temp\5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe
"C:\Users\Admin\AppData\Local\Temp\5a3ef9e8a2ea282253a57ab68f75caa9144c606725e57a37b8cfe83cc63db191.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1160-4907-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/1160-4909-0x0000000004960000-0x0000000004A76000-memory.dmp

Filesize
1.1MB

Download
memory/1160-4908-0x00000000745F0000-0x0000000074CDE000-memory.dmp

Filesize
6.9MB

Download
memory/1160-4910-0x0000000002460000-0x00000000024A0000-memory.dmp

Filesize
256KB

Download
memory/1160-7215-0x00000000005D0000-0x00000000005D8000-memory.dmp

Filesize
32KB

Download
memory/1160-7218-0x0000000002460000-0x00000000024A0000-memory.dmp

Filesize
256KB

Download
memory/1160-7217-0x00000000745F0000-0x0000000074CDE000-memory.dmp

Filesize
6.9MB

Download
memory/1160-7216-0x0000000002370000-0x000000000240E000-memory.dmp

Filesize
632KB

Download
memory/2268-38-0x0000000006ED0000-0x00000000071BF000-memory.dmp

Filesize
2.9MB

Download
memory/2268-46-0x0000000006ED0000-0x00000000071BF000-memory.dmp

Filesize
2.9MB

Download
memory/2268-5-0x0000000006ED0000-0x00000000071BF000-memory.dmp

Filesize
2.9MB

Download
memory/2268-6-0x0000000006ED0000-0x00000000071BF000-memory.dmp

Filesize
2.9MB

Download
memory/2268-10-0x0000000006ED0000-0x00000000071BF000-memory.dmp

Filesize
2.9MB

Download
memory/2268-12-0x0000000006ED0000-0x00000000071BF000-memory.dmp

Filesize
2.9MB

Download
memory/2268-16-0x0000000006ED0000-0x00000000071BF000-memory.dmp

Filesize
2.9MB

Download
memory/2268-14-0x0000000006ED0000-0x00000000071BF000-memory.dmp

Filesize
2.9MB

Download
memory/2268-20-0x0000000006ED0000-0x00000000071BF000-memory.dmp

Filesize
2.9MB

Download
memory/2268-22-0x0000000006ED0000-0x00000000071BF000-memory.dmp

Filesize
2.9MB

Download
memory/2268-18-0x0000000006ED0000-0x00000000071BF000-memory.dmp

Filesize
2.9MB

Download
memory/2268-24-0x0000000006ED0000-0x00000000071BF000-memory.dmp

Filesize
2.9MB

Download
memory/2268-26-0x0000000006ED0000-0x00000000071BF000-memory.dmp

Filesize
2.9MB

Download
memory/2268-28-0x0000000006ED0000-0x00000000071BF000-memory.dmp

Filesize
2.9MB

Download
memory/2268-8-0x0000000006ED0000-0x00000000071BF000-memory.dmp

Filesize
2.9MB

Download
memory/2268-30-0x0000000006ED0000-0x00000000071BF000-memory.dmp

Filesize
2.9MB

Download
memory/2268-32-0x0000000006ED0000-0x00000000071BF000-memory.dmp

Filesize
2.9MB

Download
memory/2268-36-0x0000000006ED0000-0x00000000071BF000-memory.dmp

Filesize
2.9MB

Download
memory/2268-3-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2268-40-0x0000000006ED0000-0x00000000071BF000-memory.dmp

Filesize
2.9MB

Download
memory/2268-42-0x0000000006ED0000-0x00000000071BF000-memory.dmp

Filesize
2.9MB

Download
memory/2268-34-0x0000000006ED0000-0x00000000071BF000-memory.dmp

Filesize
2.9MB

Download
memory/2268-44-0x0000000006ED0000-0x00000000071BF000-memory.dmp

Filesize
2.9MB

Download
memory/2268-4-0x0000000006ED0000-0x00000000071C4000-memory.dmp

Filesize
3.0MB

Download
memory/2268-48-0x0000000006ED0000-0x00000000071BF000-memory.dmp

Filesize
2.9MB

Download
memory/2268-50-0x0000000006ED0000-0x00000000071BF000-memory.dmp

Filesize
2.9MB

Download
memory/2268-52-0x0000000006ED0000-0x00000000071BF000-memory.dmp

Filesize
2.9MB

Download
memory/2268-54-0x0000000006ED0000-0x00000000071BF000-memory.dmp

Filesize
2.9MB

Download
memory/2268-56-0x0000000006ED0000-0x00000000071BF000-memory.dmp

Filesize
2.9MB

Download
memory/2268-58-0x0000000006ED0000-0x00000000071BF000-memory.dmp

Filesize
2.9MB

Download
memory/2268-60-0x0000000006ED0000-0x00000000071BF000-memory.dmp

Filesize
2.9MB

Download
memory/2268-62-0x0000000006ED0000-0x00000000071BF000-memory.dmp

Filesize
2.9MB

Download
memory/2268-64-0x0000000006ED0000-0x00000000071BF000-memory.dmp

Filesize
2.9MB

Download
memory/2268-66-0x0000000006ED0000-0x00000000071BF000-memory.dmp

Filesize
2.9MB

Download
memory/2268-68-0x0000000006ED0000-0x00000000071BF000-memory.dmp

Filesize
2.9MB

Download
memory/2268-1523-0x0000000074670000-0x0000000074D5E000-memory.dmp

Filesize
6.9MB

Download
memory/2268-2124-0x00000000049F0000-0x0000000004A30000-memory.dmp

Filesize
256KB

Download
memory/2268-2-0x00000000049F0000-0x0000000004A30000-memory.dmp

Filesize
256KB

Download
memory/2268-0-0x0000000000C10000-0x0000000000C46000-memory.dmp

Filesize
216KB

Download
memory/2268-1-0x0000000074670000-0x0000000074D5E000-memory.dmp

Filesize
6.9MB

Download
memory/2268-4887-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download
memory/2268-4888-0x0000000005F90000-0x00000000060C0000-memory.dmp

Filesize
1.2MB

Download
memory/2268-4889-0x0000000004680000-0x00000000046CC000-memory.dmp

Filesize
304KB

Download
memory/2268-4890-0x0000000004860000-0x00000000048B4000-memory.dmp

Filesize
336KB

Download
memory/2268-4903-0x0000000074670000-0x0000000074D5E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads