zgrat | 572e5e6295f7bc9877c82de35f32ed4039cc68c7d8f508be1c9302b795b09deb

Analysis

max time kernel
69s
max time network
46s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/04/2024, 09:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

pliploipli.exe
Size

209KB
MD5

c80d855e5cd40f34e27e3da00bd24b82
SHA1

afcfe5313e5ab286433e150bf22f8cd33cb7e0c8
SHA256

572e5e6295f7bc9877c82de35f32ed4039cc68c7d8f508be1c9302b795b09deb
SHA512

367ff5ba9ea1406bd5716f2c6d4e57bb0fe0175e2eae9b8718ae2ea51c1cb59d979d253e617fffe5ca7f4bdb4523cc55c7956a12097ec0b5343f32438a02b5a6
SSDEEP

3072:bDKt5H8wGbvWT5QaVna4xqRbSSXqdT4PO5iJSXQrx7af41+oyc:/Kt5H8wPt3aHRbSSX44G5iJprx7p+

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 34 IoCs

resource	yara_rule
behavioral1/memory/2904-4-0x0000000006D90000-0x0000000007054000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-5-0x0000000006D90000-0x000000000704E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-6-0x0000000006D90000-0x000000000704E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-8-0x0000000006D90000-0x000000000704E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-10-0x0000000006D90000-0x000000000704E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-12-0x0000000006D90000-0x000000000704E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-14-0x0000000006D90000-0x000000000704E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-16-0x0000000006D90000-0x000000000704E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-20-0x0000000006D90000-0x000000000704E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-18-0x0000000006D90000-0x000000000704E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-22-0x0000000006D90000-0x000000000704E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-24-0x0000000006D90000-0x000000000704E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-26-0x0000000006D90000-0x000000000704E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-28-0x0000000006D90000-0x000000000704E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-30-0x0000000006D90000-0x000000000704E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-32-0x0000000006D90000-0x000000000704E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-34-0x0000000006D90000-0x000000000704E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-36-0x0000000006D90000-0x000000000704E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-38-0x0000000006D90000-0x000000000704E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-40-0x0000000006D90000-0x000000000704E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-42-0x0000000006D90000-0x000000000704E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-44-0x0000000006D90000-0x000000000704E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-46-0x0000000006D90000-0x000000000704E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-48-0x0000000006D90000-0x000000000704E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-50-0x0000000006D90000-0x000000000704E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-52-0x0000000006D90000-0x000000000704E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-54-0x0000000006D90000-0x000000000704E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-56-0x0000000006D90000-0x000000000704E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-58-0x0000000006D90000-0x000000000704E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-60-0x0000000006D90000-0x000000000704E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-62-0x0000000006D90000-0x000000000704E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-64-0x0000000006D90000-0x000000000704E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-68-0x0000000006D90000-0x000000000704E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2904-66-0x0000000006D90000-0x000000000704E000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2904 set thread context of 2488	2904	pliploipli.exe	28

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2488	cvtres.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2904	pliploipli.exe
Token: SeDebugPrivilege	2904	pliploipli.exe
Token: SeDebugPrivilege	2488	cvtres.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2488	2904	pliploipli.exe	28
PID 2904 wrote to memory of 2488	2904	pliploipli.exe	28
PID 2904 wrote to memory of 2488	2904	pliploipli.exe	28
PID 2904 wrote to memory of 2488	2904	pliploipli.exe	28
PID 2904 wrote to memory of 2488	2904	pliploipli.exe	28
PID 2904 wrote to memory of 2488	2904	pliploipli.exe	28
PID 2904 wrote to memory of 2488	2904	pliploipli.exe	28
PID 2904 wrote to memory of 2488	2904	pliploipli.exe	28
PID 2904 wrote to memory of 2488	2904	pliploipli.exe	28

C:\Users\Admin\AppData\Local\Temp\pliploipli.exe
"C:\Users\Admin\AppData\Local\Temp\pliploipli.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  PID:2488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2488-4907-0x00000000749E0000-0x00000000750CE000-memory.dmp

Filesize
6.9MB

Download
memory/2488-4906-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2488-4908-0x0000000000E10000-0x0000000000ED6000-memory.dmp

Filesize
792KB

Download
memory/2488-4909-0x0000000000970000-0x00000000009B0000-memory.dmp

Filesize
256KB

Download
memory/2488-5758-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2488-5762-0x0000000000970000-0x00000000009B0000-memory.dmp

Filesize
256KB

Download
memory/2488-5761-0x00000000749E0000-0x00000000750CE000-memory.dmp

Filesize
6.9MB

Download
memory/2488-5760-0x0000000004870000-0x00000000048C6000-memory.dmp

Filesize
344KB

Download
memory/2488-5759-0x0000000000550000-0x0000000000558000-memory.dmp

Filesize
32KB

Download
memory/2904-36-0x0000000006D90000-0x000000000704E000-memory.dmp

Filesize
2.7MB

Download
memory/2904-48-0x0000000006D90000-0x000000000704E000-memory.dmp

Filesize
2.7MB

Download
memory/2904-6-0x0000000006D90000-0x000000000704E000-memory.dmp

Filesize
2.7MB

Download
memory/2904-8-0x0000000006D90000-0x000000000704E000-memory.dmp

Filesize
2.7MB

Download
memory/2904-10-0x0000000006D90000-0x000000000704E000-memory.dmp

Filesize
2.7MB

Download
memory/2904-12-0x0000000006D90000-0x000000000704E000-memory.dmp

Filesize
2.7MB

Download
memory/2904-14-0x0000000006D90000-0x000000000704E000-memory.dmp

Filesize
2.7MB

Download
memory/2904-16-0x0000000006D90000-0x000000000704E000-memory.dmp

Filesize
2.7MB

Download
memory/2904-20-0x0000000006D90000-0x000000000704E000-memory.dmp

Filesize
2.7MB

Download
memory/2904-18-0x0000000006D90000-0x000000000704E000-memory.dmp

Filesize
2.7MB

Download
memory/2904-22-0x0000000006D90000-0x000000000704E000-memory.dmp

Filesize
2.7MB

Download
memory/2904-24-0x0000000006D90000-0x000000000704E000-memory.dmp

Filesize
2.7MB

Download
memory/2904-26-0x0000000006D90000-0x000000000704E000-memory.dmp

Filesize
2.7MB

Download
memory/2904-28-0x0000000006D90000-0x000000000704E000-memory.dmp

Filesize
2.7MB

Download
memory/2904-30-0x0000000006D90000-0x000000000704E000-memory.dmp

Filesize
2.7MB

Download
memory/2904-32-0x0000000006D90000-0x000000000704E000-memory.dmp

Filesize
2.7MB

Download
memory/2904-34-0x0000000006D90000-0x000000000704E000-memory.dmp

Filesize
2.7MB

Download
memory/2904-4-0x0000000006D90000-0x0000000007054000-memory.dmp

Filesize
2.8MB

Download
memory/2904-38-0x0000000006D90000-0x000000000704E000-memory.dmp

Filesize
2.7MB

Download
memory/2904-40-0x0000000006D90000-0x000000000704E000-memory.dmp

Filesize
2.7MB

Download
memory/2904-42-0x0000000006D90000-0x000000000704E000-memory.dmp

Filesize
2.7MB

Download
memory/2904-44-0x0000000006D90000-0x000000000704E000-memory.dmp

Filesize
2.7MB

Download
memory/2904-46-0x0000000006D90000-0x000000000704E000-memory.dmp

Filesize
2.7MB

Download
memory/2904-5-0x0000000006D90000-0x000000000704E000-memory.dmp

Filesize
2.7MB

Download
memory/2904-50-0x0000000006D90000-0x000000000704E000-memory.dmp

Filesize
2.7MB

Download
memory/2904-52-0x0000000006D90000-0x000000000704E000-memory.dmp

Filesize
2.7MB

Download
memory/2904-54-0x0000000006D90000-0x000000000704E000-memory.dmp

Filesize
2.7MB

Download
memory/2904-56-0x0000000006D90000-0x000000000704E000-memory.dmp

Filesize
2.7MB

Download
memory/2904-58-0x0000000006D90000-0x000000000704E000-memory.dmp

Filesize
2.7MB

Download
memory/2904-60-0x0000000006D90000-0x000000000704E000-memory.dmp

Filesize
2.7MB

Download
memory/2904-62-0x0000000006D90000-0x000000000704E000-memory.dmp

Filesize
2.7MB

Download
memory/2904-64-0x0000000006D90000-0x000000000704E000-memory.dmp

Filesize
2.7MB

Download
memory/2904-68-0x0000000006D90000-0x000000000704E000-memory.dmp

Filesize
2.7MB

Download
memory/2904-66-0x0000000006D90000-0x000000000704E000-memory.dmp

Filesize
2.7MB

Download
memory/2904-4365-0x00000000749E0000-0x00000000750CE000-memory.dmp

Filesize
6.9MB

Download
memory/2904-4886-0x00000000047F0000-0x0000000004830000-memory.dmp

Filesize
256KB

Download
memory/2904-3-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/2904-2-0x00000000047F0000-0x0000000004830000-memory.dmp

Filesize
256KB

Download
memory/2904-1-0x00000000749E0000-0x00000000750CE000-memory.dmp

Filesize
6.9MB

Download
memory/2904-0-0x0000000000AF0000-0x0000000000B26000-memory.dmp

Filesize
216KB

Download
memory/2904-4887-0x0000000000420000-0x0000000000421000-memory.dmp

Filesize
4KB

Download
memory/2904-4888-0x0000000005D90000-0x0000000005E90000-memory.dmp

Filesize
1024KB

Download
memory/2904-4889-0x00000000052E0000-0x000000000532C000-memory.dmp

Filesize
304KB

Download
memory/2904-4890-0x00000000056F0000-0x0000000005744000-memory.dmp

Filesize
336KB

Download
memory/2904-4902-0x00000000749E0000-0x00000000750CE000-memory.dmp

Filesize
6.9MB

Download