zgrat | c0d7231617470901a6047d790b9935ae087658d6805544c9ee4ce3f09efb055d

General

Target

c0d7231617470901a6047d790b9935ae087658d6805544c9ee4ce3f09efb055d.exe
Size

5.9MB
MD5

0bbb5d8950e6d3af916f204ea8f63dfb
SHA1

30fb5e207e1e9a01c0acc6f4a4a828bbd3cef2cd
SHA256

c0d7231617470901a6047d790b9935ae087658d6805544c9ee4ce3f09efb055d
SHA512

f6bebd9dc66fd98463f3f3ffed4d9fcdaa8f485e96980aef72c6fa2f009d5007c7d7a13926ec26c9cbf03ab4e2c8b7c440c7bbce0c6e5ea8c3240cc252f356d9
SSDEEP

98304:eMkulhD5woxAnrl8ApUn2qWfJ6E43pwyblno5:eXulhD5wznJ8A62qWx6h32ybm5

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2112-1-0x0000000000840000-0x0000000000E24000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Loads dropped DLL 1 IoCs

Processes:

c0d7231617470901a6047d790b9935ae087658d6805544c9ee4ce3f09efb055d.exe

pid process

2112 c0d7231617470901a6047d790b9935ae087658d6805544c9ee4ce3f09efb055d.exe

pid	process
2112	c0d7231617470901a6047d790b9935ae087658d6805544c9ee4ce3f09efb055d.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

c0d7231617470901a6047d790b9935ae087658d6805544c9ee4ce3f09efb055d.exe

description	pid	process	target process
PID 2112 set thread context of 2736	2112	c0d7231617470901a6047d790b9935ae087658d6805544c9ee4ce3f09efb055d.exe	MsBuild.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2464 2736 WerFault.exe MsBuild.exe

pid	pid_target	process	target process
2464	2736	WerFault.exe	MsBuild.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

c0d7231617470901a6047d790b9935ae087658d6805544c9ee4ce3f09efb055d.exeMsBuild.exe

description	pid	process	target process
PID 2112 wrote to memory of 2732	2112	c0d7231617470901a6047d790b9935ae087658d6805544c9ee4ce3f09efb055d.exe	MsBuild.exe
PID 2112 wrote to memory of 2732	2112	c0d7231617470901a6047d790b9935ae087658d6805544c9ee4ce3f09efb055d.exe	MsBuild.exe
PID 2112 wrote to memory of 2732	2112	c0d7231617470901a6047d790b9935ae087658d6805544c9ee4ce3f09efb055d.exe	MsBuild.exe
PID 2112 wrote to memory of 2732	2112	c0d7231617470901a6047d790b9935ae087658d6805544c9ee4ce3f09efb055d.exe	MsBuild.exe
PID 2112 wrote to memory of 2620	2112	c0d7231617470901a6047d790b9935ae087658d6805544c9ee4ce3f09efb055d.exe	MsBuild.exe
PID 2112 wrote to memory of 2620	2112	c0d7231617470901a6047d790b9935ae087658d6805544c9ee4ce3f09efb055d.exe	MsBuild.exe
PID 2112 wrote to memory of 2620	2112	c0d7231617470901a6047d790b9935ae087658d6805544c9ee4ce3f09efb055d.exe	MsBuild.exe
PID 2112 wrote to memory of 2620	2112	c0d7231617470901a6047d790b9935ae087658d6805544c9ee4ce3f09efb055d.exe	MsBuild.exe
PID 2112 wrote to memory of 2496	2112	c0d7231617470901a6047d790b9935ae087658d6805544c9ee4ce3f09efb055d.exe	MsBuild.exe
PID 2112 wrote to memory of 2496	2112	c0d7231617470901a6047d790b9935ae087658d6805544c9ee4ce3f09efb055d.exe	MsBuild.exe
PID 2112 wrote to memory of 2496	2112	c0d7231617470901a6047d790b9935ae087658d6805544c9ee4ce3f09efb055d.exe	MsBuild.exe
PID 2112 wrote to memory of 2496	2112	c0d7231617470901a6047d790b9935ae087658d6805544c9ee4ce3f09efb055d.exe	MsBuild.exe
PID 2112 wrote to memory of 2736	2112	c0d7231617470901a6047d790b9935ae087658d6805544c9ee4ce3f09efb055d.exe	MsBuild.exe
PID 2112 wrote to memory of 2736	2112	c0d7231617470901a6047d790b9935ae087658d6805544c9ee4ce3f09efb055d.exe	MsBuild.exe
PID 2112 wrote to memory of 2736	2112	c0d7231617470901a6047d790b9935ae087658d6805544c9ee4ce3f09efb055d.exe	MsBuild.exe
PID 2112 wrote to memory of 2736	2112	c0d7231617470901a6047d790b9935ae087658d6805544c9ee4ce3f09efb055d.exe	MsBuild.exe
PID 2112 wrote to memory of 2736	2112	c0d7231617470901a6047d790b9935ae087658d6805544c9ee4ce3f09efb055d.exe	MsBuild.exe
PID 2112 wrote to memory of 2736	2112	c0d7231617470901a6047d790b9935ae087658d6805544c9ee4ce3f09efb055d.exe	MsBuild.exe
PID 2112 wrote to memory of 2736	2112	c0d7231617470901a6047d790b9935ae087658d6805544c9ee4ce3f09efb055d.exe	MsBuild.exe
PID 2112 wrote to memory of 2736	2112	c0d7231617470901a6047d790b9935ae087658d6805544c9ee4ce3f09efb055d.exe	MsBuild.exe
PID 2112 wrote to memory of 2736	2112	c0d7231617470901a6047d790b9935ae087658d6805544c9ee4ce3f09efb055d.exe	MsBuild.exe
PID 2112 wrote to memory of 2736	2112	c0d7231617470901a6047d790b9935ae087658d6805544c9ee4ce3f09efb055d.exe	MsBuild.exe
PID 2736 wrote to memory of 2464	2736	MsBuild.exe	WerFault.exe
PID 2736 wrote to memory of 2464	2736	MsBuild.exe	WerFault.exe
PID 2736 wrote to memory of 2464	2736	MsBuild.exe	WerFault.exe
PID 2736 wrote to memory of 2464	2736	MsBuild.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\c0d7231617470901a6047d790b9935ae087658d6805544c9ee4ce3f09efb055d.exe
"C:\Users\Admin\AppData\Local\Temp\c0d7231617470901a6047d790b9935ae087658d6805544c9ee4ce3f09efb055d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  2⤵
  PID:2732
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  2⤵
  PID:2620
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  2⤵
  PID:2496
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 92
    3⤵
    - Program crash
    PID:2464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\Protect544cd51a.dll

Filesize
742KB

MD5
544cd51a596619b78e9b54b70088307d

SHA1
4769ddd2dbc1dc44b758964ed0bd231b85880b65

SHA256
dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd

SHA512
f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719

Download Submit
memory/2112-17-0x00000000004A0000-0x00000000004B0000-memory.dmp

Filesize
64KB

Download
memory/2112-3-0x00000000003E0000-0x00000000003E8000-memory.dmp

Filesize
32KB

Download
memory/2112-19-0x00000000027A0000-0x00000000027E0000-memory.dmp

Filesize
256KB

Download
memory/2112-2-0x0000000000330000-0x000000000034A000-memory.dmp

Filesize
104KB

Download
memory/2112-5-0x0000000074840000-0x0000000074F2E000-memory.dmp

Filesize
6.9MB

Download
memory/2112-6-0x00000000027A0000-0x00000000027E0000-memory.dmp

Filesize
256KB

Download
memory/2112-7-0x0000000005C20000-0x0000000005E54000-memory.dmp

Filesize
2.2MB

Download
memory/2112-8-0x0000000006E50000-0x0000000006FE2000-memory.dmp

Filesize
1.6MB

Download
memory/2112-1-0x0000000000840000-0x0000000000E24000-memory.dmp

Filesize
5.9MB

Download
memory/2112-13-0x00000000027A0000-0x00000000027E0000-memory.dmp

Filesize
256KB

Download
memory/2112-15-0x00000000027A0000-0x00000000027E0000-memory.dmp

Filesize
256KB

Download
memory/2112-14-0x00000000027A0000-0x00000000027E0000-memory.dmp

Filesize
256KB

Download
memory/2112-16-0x00000000027A0000-0x00000000027E0000-memory.dmp

Filesize
256KB

Download
memory/2112-0-0x0000000074840000-0x0000000074F2E000-memory.dmp

Filesize
6.9MB

Download
memory/2112-39-0x0000000074840000-0x0000000074F2E000-memory.dmp

Filesize
6.9MB

Download
memory/2112-4-0x00000000027A0000-0x00000000027E0000-memory.dmp

Filesize
256KB

Download
memory/2112-21-0x00000000027A0000-0x00000000027E0000-memory.dmp

Filesize
256KB

Download
memory/2112-20-0x00000000027A0000-0x00000000027E0000-memory.dmp

Filesize
256KB

Download
memory/2112-22-0x00000000027A0000-0x00000000027E0000-memory.dmp

Filesize
256KB

Download
memory/2112-18-0x00000000027A0000-0x00000000027E0000-memory.dmp

Filesize
256KB

Download
memory/2736-33-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2736-38-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/2736-37-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2736-31-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2736-36-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2736-30-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2736-27-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2736-25-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2736-23-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2736-34-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads