zgrat | 086bcb65380fa0e4d23c07fbff58863949f8158b87d07cd6eac6485d99b3bf0d

General

Target

SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exe
Size

2.8MB
MD5

7f1e688e77760ad29c560404a2fb9d2f
SHA1

7c06e05c8e13d01df26653cbe12695af139c5854
SHA256

086bcb65380fa0e4d23c07fbff58863949f8158b87d07cd6eac6485d99b3bf0d
SHA512

e841524c36ec9f550bbd299fbd33bbf15587dde922c747ae719bea03c387e62bbb9a73fdee0188dfb1586cca5b9dc81745144e633ed3dcb661434ab1c87e393e
SSDEEP

49152:lAfXmQ/GT5+pDEuOwHLHE83/G9+SbSyCfHtl8/ioefjKxAd2jVAeIXT:2+4GT0OSL04Dl8/gcAsJAeIj

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2460-3-0x0000000004E70000-0x00000000050A4000-memory.dmp	family_zgrat_v1
behavioral1/memory/2460-4-0x0000000004E70000-0x000000000509E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2460-5-0x0000000004E70000-0x000000000509E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2460-7-0x0000000004E70000-0x000000000509E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2460-9-0x0000000004E70000-0x000000000509E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2460-11-0x0000000004E70000-0x000000000509E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2460-13-0x0000000004E70000-0x000000000509E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2460-15-0x0000000004E70000-0x000000000509E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2460-17-0x0000000004E70000-0x000000000509E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2460-19-0x0000000004E70000-0x000000000509E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2460-21-0x0000000004E70000-0x000000000509E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2460-23-0x0000000004E70000-0x000000000509E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2460-25-0x0000000004E70000-0x000000000509E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2460-27-0x0000000004E70000-0x000000000509E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2460-29-0x0000000004E70000-0x000000000509E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2460-31-0x0000000004E70000-0x000000000509E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2460-33-0x0000000004E70000-0x000000000509E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2460-35-0x0000000004E70000-0x000000000509E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2460-37-0x0000000004E70000-0x000000000509E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2460-39-0x0000000004E70000-0x000000000509E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2460-41-0x0000000004E70000-0x000000000509E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2460-43-0x0000000004E70000-0x000000000509E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2460-45-0x0000000004E70000-0x000000000509E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2460-47-0x0000000004E70000-0x000000000509E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2460-49-0x0000000004E70000-0x000000000509E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2460-51-0x0000000004E70000-0x000000000509E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2460-53-0x0000000004E70000-0x000000000509E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2460-55-0x0000000004E70000-0x000000000509E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2460-57-0x0000000004E70000-0x000000000509E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2460-59-0x0000000004E70000-0x000000000509E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2460-61-0x0000000004E70000-0x000000000509E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2460-63-0x0000000004E70000-0x000000000509E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2460-65-0x0000000004E70000-0x000000000509E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2460-67-0x0000000004E70000-0x000000000509E000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exe

description pid process target process

PID 2460 set thread context of 2544 2460 SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exe MSBuild.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2116 2544 WerFault.exe MSBuild.exe

description	pid	process	target process
PID 2460 set thread context of 2544	2460	SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exe	MSBuild.exe

pid	pid_target	process	target process
2116	2544	WerFault.exe	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exe

description	pid	process
Token: SeDebugPrivilege	2460	SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exe
Token: SeDebugPrivilege	2460	SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exeMSBuild.exe

description	pid	process	target process
PID 2460 wrote to memory of 2544	2460	SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exe	MSBuild.exe
PID 2460 wrote to memory of 2544	2460	SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exe	MSBuild.exe
PID 2460 wrote to memory of 2544	2460	SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exe	MSBuild.exe
PID 2460 wrote to memory of 2544	2460	SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exe	MSBuild.exe
PID 2460 wrote to memory of 2544	2460	SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exe	MSBuild.exe
PID 2460 wrote to memory of 2544	2460	SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exe	MSBuild.exe
PID 2460 wrote to memory of 2544	2460	SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exe	MSBuild.exe
PID 2460 wrote to memory of 2544	2460	SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exe	MSBuild.exe
PID 2460 wrote to memory of 2544	2460	SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exe	MSBuild.exe
PID 2460 wrote to memory of 2544	2460	SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exe	MSBuild.exe
PID 2460 wrote to memory of 2544	2460	SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exe	MSBuild.exe
PID 2544 wrote to memory of 2116	2544	MSBuild.exe	WerFault.exe
PID 2544 wrote to memory of 2116	2544	MSBuild.exe	WerFault.exe
PID 2544 wrote to memory of 2116	2544	MSBuild.exe	WerFault.exe
PID 2544 wrote to memory of 2116	2544	MSBuild.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2460

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 1392
3⤵
- Program crash
PID:2116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
3a9dea44a6cf50cf35ec46c9ac3fdfcd

SHA1
98e242c9dff340393406ea612d5b4741fbbcd84b

SHA256
9bd95f902e962997b108513be90554ac4b03065bd42d2ea31da3292c4c458dcb

SHA512
92242e0efbce58c91e54a42d5ea37a45965ac769f6500b29508c1c64c81cca287b79c927212b8cebd9b5d387d4a9eb740616a6e83631f61534d81fde7e18a713

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCD74.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
memory/2460-39-0x0000000004E70000-0x000000000509E000-memory.dmp

Filesize
2.2MB

Download
memory/2460-7-0x0000000004E70000-0x000000000509E000-memory.dmp

Filesize
2.2MB

Download
memory/2460-5-0x0000000004E70000-0x000000000509E000-memory.dmp

Filesize
2.2MB

Download
memory/2460-43-0x0000000004E70000-0x000000000509E000-memory.dmp

Filesize
2.2MB

Download
memory/2460-9-0x0000000004E70000-0x000000000509E000-memory.dmp

Filesize
2.2MB

Download
memory/2460-11-0x0000000004E70000-0x000000000509E000-memory.dmp

Filesize
2.2MB

Download
memory/2460-13-0x0000000004E70000-0x000000000509E000-memory.dmp

Filesize
2.2MB

Download
memory/2460-15-0x0000000004E70000-0x000000000509E000-memory.dmp

Filesize
2.2MB

Download
memory/2460-17-0x0000000004E70000-0x000000000509E000-memory.dmp

Filesize
2.2MB

Download
memory/2460-19-0x0000000004E70000-0x000000000509E000-memory.dmp

Filesize
2.2MB

Download
memory/2460-41-0x0000000004E70000-0x000000000509E000-memory.dmp

Filesize
2.2MB

Download
memory/2460-23-0x0000000004E70000-0x000000000509E000-memory.dmp

Filesize
2.2MB

Download
memory/2460-45-0x0000000004E70000-0x000000000509E000-memory.dmp

Filesize
2.2MB

Download
memory/2460-27-0x0000000004E70000-0x000000000509E000-memory.dmp

Filesize
2.2MB

Download
memory/2460-29-0x0000000004E70000-0x000000000509E000-memory.dmp

Filesize
2.2MB

Download
memory/2460-31-0x0000000004E70000-0x000000000509E000-memory.dmp

Filesize
2.2MB

Download
memory/2460-33-0x0000000004E70000-0x000000000509E000-memory.dmp

Filesize
2.2MB

Download
memory/2460-35-0x0000000004E70000-0x000000000509E000-memory.dmp

Filesize
2.2MB

Download
memory/2460-37-0x0000000004E70000-0x000000000509E000-memory.dmp

Filesize
2.2MB

Download
memory/2460-0-0x00000000012F0000-0x00000000015C4000-memory.dmp

Filesize
2.8MB

Download
memory/2460-21-0x0000000004E70000-0x000000000509E000-memory.dmp

Filesize
2.2MB

Download
memory/2460-4-0x0000000004E70000-0x000000000509E000-memory.dmp

Filesize
2.2MB

Download
memory/2460-25-0x0000000004E70000-0x000000000509E000-memory.dmp

Filesize
2.2MB

Download
memory/2460-47-0x0000000004E70000-0x000000000509E000-memory.dmp

Filesize
2.2MB

Download
memory/2460-49-0x0000000004E70000-0x000000000509E000-memory.dmp

Filesize
2.2MB

Download
memory/2460-51-0x0000000004E70000-0x000000000509E000-memory.dmp

Filesize
2.2MB

Download
memory/2460-53-0x0000000004E70000-0x000000000509E000-memory.dmp

Filesize
2.2MB

Download
memory/2460-55-0x0000000004E70000-0x000000000509E000-memory.dmp

Filesize
2.2MB

Download
memory/2460-57-0x0000000004E70000-0x000000000509E000-memory.dmp

Filesize
2.2MB

Download
memory/2460-59-0x0000000004E70000-0x000000000509E000-memory.dmp

Filesize
2.2MB

Download
memory/2460-61-0x0000000004E70000-0x000000000509E000-memory.dmp

Filesize
2.2MB

Download
memory/2460-63-0x0000000004E70000-0x000000000509E000-memory.dmp

Filesize
2.2MB

Download
memory/2460-65-0x0000000004E70000-0x000000000509E000-memory.dmp

Filesize
2.2MB

Download
memory/2460-67-0x0000000004E70000-0x000000000509E000-memory.dmp

Filesize
2.2MB

Download
memory/2460-4884-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Filesize
4KB

Download
memory/2460-4886-0x00000000049D0000-0x0000000004A1C000-memory.dmp

Filesize
304KB

Download
memory/2460-4885-0x00000000011F0000-0x0000000001260000-memory.dmp

Filesize
448KB

Download
memory/2460-4887-0x0000000074960000-0x000000007504E000-memory.dmp

Filesize
6.9MB

Download
memory/2460-4888-0x0000000000DC0000-0x0000000000E00000-memory.dmp

Filesize
256KB

Download
memory/2460-4889-0x0000000004A20000-0x0000000004A74000-memory.dmp

Filesize
336KB

Download
memory/2460-4902-0x0000000074960000-0x000000007504E000-memory.dmp

Filesize
6.9MB

Download
memory/2460-3-0x0000000004E70000-0x00000000050A4000-memory.dmp

Filesize
2.2MB

Download
memory/2460-2-0x0000000000DC0000-0x0000000000E00000-memory.dmp

Filesize
256KB

Download
memory/2460-1-0x0000000074960000-0x000000007504E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads