zgrat | 7d11115576e864498bcd15f08c2c390b23613b4391c959a82694eafa84650ed2

Analysis

max time kernel
90s
max time network
96s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
05-05-2024 20:24

Target

ChineseTriad/Installer.exe
Size

472KB
MD5

fc032e9bac8d0a7dc77f1ce1d01fe91f
SHA1

614469892aa6b7e09e5e107fb6b791a85701dffc
SHA256

01f4fb08ec4c575c2148e9c86a6c7e850a33f48cdd632e8b75fed224dd01ae89
SHA512

de1f1457122b889de6bc10576d5ac4b0f577d9daebf30dd36c693dbb75c11ab27d6e2c4328384caa5aa1ff63b0195bd4257c4f8194f21017e69707f40f61f9b0
SSDEEP

12288:sb3B1kiKP156uhoDDoqi/Rh3O9hRLkCr3rCbAnFb:sb33kiKt5+oqwh3O9htkI7Jl

Score

10^/10

zgrat rat

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral2/memory/4488-1-0x0000000000DE0000-0x0000000000E5A000-memory.dmp	family_zgrat_v1

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4488 set thread context of 1392	4488	Installer.exe	81

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 1556	4488	Installer.exe	80
PID 4488 wrote to memory of 1556	4488	Installer.exe	80
PID 4488 wrote to memory of 1556	4488	Installer.exe	80
PID 4488 wrote to memory of 1392	4488	Installer.exe	81
PID 4488 wrote to memory of 1392	4488	Installer.exe	81
PID 4488 wrote to memory of 1392	4488	Installer.exe	81
PID 4488 wrote to memory of 1392	4488	Installer.exe	81
PID 4488 wrote to memory of 1392	4488	Installer.exe	81
PID 4488 wrote to memory of 1392	4488	Installer.exe	81
PID 4488 wrote to memory of 1392	4488	Installer.exe	81
PID 4488 wrote to memory of 1392	4488	Installer.exe	81
PID 4488 wrote to memory of 1392	4488	Installer.exe	81

C:\Users\Admin\AppData\Local\Temp\ChineseTriad\Installer.exe
"C:\Users\Admin\AppData\Local\Temp\ChineseTriad\Installer.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1556
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1392

memory/1392-8-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1392-5-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1392-12-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/4488-0-0x0000000074C1E000-0x0000000074C1F000-memory.dmp

Filesize
4KB

Download
memory/4488-1-0x0000000000DE0000-0x0000000000E5A000-memory.dmp

Filesize
488KB

Download
memory/4488-2-0x0000000074C10000-0x00000000753C1000-memory.dmp

Filesize
7.7MB

Download
memory/4488-10-0x0000000074C10000-0x00000000753C1000-memory.dmp

Filesize
7.7MB

Download
memory/4488-11-0x0000000074C10000-0x00000000753C1000-memory.dmp

Filesize
7.7MB

Download