Analysis

  • max time kernel
    142s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/05/2024, 12:45

General

  • Target

    eb508c21c59a7fff7924f7243e5949e8.exe

  • Size

    545KB

  • MD5

    eb508c21c59a7fff7924f7243e5949e8

  • SHA1

    8ff01f312f4c37aeb98e6a4afd61aa9dd0fec383

  • SHA256

    bc415aafd68de975f42d71ef25868a7de65ddf166a0bb03246243c6d1b0a0af1

  • SHA512

    3e5b19768160960710b3d7d198d5a8bc3d040a084ad6a47c1e7f1b03bf780df3886a0c7d8ff58c30f06afc4a136b91eb2841c895c01f0e8020f52b298a9de5e0

  • SSDEEP

    12288:/AyIUo5xsD8c/7Oyo8LR9zom3Q3WZaIVir52gPi:9IHLyogR5omUIAv

Score
10/10

Malware Config

Signatures

  • Detect ZGRat V1 2 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eb508c21c59a7fff7924f7243e5949e8.exe
    "C:\Users\Admin\AppData\Local\Temp\eb508c21c59a7fff7924f7243e5949e8.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4076
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
        PID:4784
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2992
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 304
        2⤵
        • Program crash
        PID:2340
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4076 -ip 4076
      1⤵
        PID:4796

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/2992-9-0x0000000008670000-0x000000000877A000-memory.dmp

              Filesize

              1.0MB

            • memory/2992-10-0x00000000085B0000-0x00000000085C2000-memory.dmp

              Filesize

              72KB

            • memory/2992-2-0x00000000742BE000-0x00000000742BF000-memory.dmp

              Filesize

              4KB

            • memory/2992-3-0x0000000005CA0000-0x0000000006244000-memory.dmp

              Filesize

              5.6MB

            • memory/2992-4-0x0000000005790000-0x0000000005822000-memory.dmp

              Filesize

              584KB

            • memory/2992-5-0x00000000742B0000-0x0000000074A60000-memory.dmp

              Filesize

              7.7MB

            • memory/2992-1-0x0000000000400000-0x000000000045C000-memory.dmp

              Filesize

              368KB

            • memory/2992-8-0x0000000008B40000-0x0000000009158000-memory.dmp

              Filesize

              6.1MB

            • memory/2992-14-0x00000000742B0000-0x0000000074A60000-memory.dmp

              Filesize

              7.7MB

            • memory/2992-13-0x00000000742BE000-0x00000000742BF000-memory.dmp

              Filesize

              4KB

            • memory/2992-7-0x0000000005840000-0x000000000584A000-memory.dmp

              Filesize

              40KB

            • memory/2992-11-0x0000000008610000-0x000000000864C000-memory.dmp

              Filesize

              240KB

            • memory/2992-12-0x0000000008780000-0x00000000087CC000-memory.dmp

              Filesize

              304KB

            • memory/4076-0-0x0000000000E36000-0x0000000000E37000-memory.dmp

              Filesize

              4KB

            • memory/4076-6-0x0000000000DB0000-0x0000000000E39953-memory.dmp

              Filesize

              550KB