Analysis
- max time kernel
143s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
29/04/2024, 06:52
General
- Target 281b678009032d26e0891fbe63c2bd67.exe
- Size 8.6MB
- Sample240429-hm4nnach62
- SHA256 eeb085f8d0dae4d56bb0d0548bef18007046a16e8a2045bef0878d1d07c0a9aa
Malware Config
Signatures
- Detect ZGRat V1 35 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\281b678009032d26e0891fbe63c2bd67.exe"C:\Users\Admin\AppData\Local\Temp\281b678009032d26e0891fbe63c2bd67.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2024-4896-0x0000000000400000-0x000000000041A000-memory.dmp
memory/2024-4898-0x0000000074E50000-0x0000000075600000-memory.dmp
memory/2024-4899-0x0000000004970000-0x0000000004980000-memory.dmp
memory/2024-4900-0x0000000074E50000-0x0000000075600000-memory.dmp
memory/2024-4901-0x0000000004970000-0x0000000004980000-memory.dmp
memory/4000-46-0x0000000009370000-0x000000000958E000-memory.dmp
memory/4000-66-0x0000000009370000-0x000000000958E000-memory.dmp
memory/4000-2-0x0000000005D90000-0x0000000005E22000-memory.dmp
memory/4000-3-0x0000000005EE0000-0x0000000005EF0000-memory.dmp
memory/4000-4-0x0000000008140000-0x00000000089BC000-memory.dmp
memory/4000-5-0x0000000009370000-0x0000000009594000-memory.dmp
memory/4000-6-0x0000000009B40000-0x000000000A0E4000-memory.dmp
memory/4000-12-0x0000000009370000-0x000000000958E000-memory.dmp
memory/4000-18-0x0000000009370000-0x000000000958E000-memory.dmp
memory/4000-44-0x0000000009370000-0x000000000958E000-memory.dmp
memory/4000-48-0x0000000009370000-0x000000000958E000-memory.dmp
memory/4000-68-0x0000000009370000-0x000000000958E000-memory.dmp
memory/4000-40-0x0000000009370000-0x000000000958E000-memory.dmp
memory/4000-64-0x0000000009370000-0x000000000958E000-memory.dmp
memory/4000-62-0x0000000009370000-0x000000000958E000-memory.dmp
memory/4000-60-0x0000000009370000-0x000000000958E000-memory.dmp
memory/4000-58-0x0000000009370000-0x000000000958E000-memory.dmp
memory/4000-56-0x0000000009370000-0x000000000958E000-memory.dmp
memory/4000-54-0x0000000009370000-0x000000000958E000-memory.dmp
memory/4000-52-0x0000000009370000-0x000000000958E000-memory.dmp
memory/4000-50-0x0000000009370000-0x000000000958E000-memory.dmp
memory/4000-0-0x0000000074E50000-0x0000000075600000-memory.dmp
memory/4000-1-0x0000000000B50000-0x00000000013E4000-memory.dmp
memory/4000-42-0x0000000009370000-0x000000000958E000-memory.dmp
memory/4000-24-0x0000000009370000-0x000000000958E000-memory.dmp
memory/4000-34-0x0000000009370000-0x000000000958E000-memory.dmp
memory/4000-32-0x0000000009370000-0x000000000958E000-memory.dmp
memory/4000-30-0x0000000009370000-0x000000000958E000-memory.dmp
memory/4000-28-0x0000000009370000-0x000000000958E000-memory.dmp
memory/4000-36-0x0000000009370000-0x000000000958E000-memory.dmp
memory/4000-26-0x0000000009370000-0x000000000958E000-memory.dmp
memory/4000-38-0x0000000009370000-0x000000000958E000-memory.dmp
memory/4000-22-0x0000000009370000-0x000000000958E000-memory.dmp
memory/4000-21-0x0000000009370000-0x000000000958E000-memory.dmp
memory/4000-16-0x0000000009370000-0x000000000958E000-memory.dmp
memory/4000-14-0x0000000009370000-0x000000000958E000-memory.dmp
memory/4000-10-0x0000000009370000-0x000000000958E000-memory.dmp
memory/4000-9-0x0000000009370000-0x000000000958E000-memory.dmp
memory/4000-7-0x0000000009370000-0x000000000958E000-memory.dmp
memory/4000-70-0x0000000009370000-0x000000000958E000-memory.dmp
memory/4000-4887-0x0000000008AC0000-0x0000000008AC1000-memory.dmp
memory/4000-4888-0x0000000009720000-0x0000000009780000-memory.dmp
memory/4000-4889-0x0000000008AF0000-0x0000000008B3C000-memory.dmp
memory/4000-4890-0x0000000074E50000-0x0000000075600000-memory.dmp
memory/4000-4891-0x0000000005EE0000-0x0000000005EF0000-memory.dmp
memory/4000-4892-0x0000000008D00000-0x0000000008D54000-memory.dmp
memory/4000-4897-0x0000000074E50000-0x0000000075600000-memory.dmp