zgrat | a7ec1127d3e54b259b1f2d506d5c95f778564dfac060c78351206f3dc433707d

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
06/05/2024, 02:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Material requirements.exe
Size

1.3MB
MD5

f79e94d065c88a840d376851c4e19937
SHA1

ca0ad59a5ab54d088190efb2497f65f2df413ce9
SHA256

24a3ea7a878ccdda1d5151f6e892a16bf0c52082c36350d451d348983b80fdf2
SHA512

4632eb61180da1d386fa5a815dd0a411db786f145cd43a5ca8851a119534c19b6a18992baa02335d8a00499ec33ba47c2c929fc2fb5a045275f4d0df4a63e6e7
SSDEEP

12288:tSWT2D98gwVfIud+KCWFtlJfgHajbX9wvspP+U4O8y2r0vIYC:tSHqfIud+KC0VpauPIvrrY

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral2/memory/2988-18-0x00000000007B0000-0x000000000084A000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Executes dropped EXE 1 IoCs

pid	Process
2988	RegAsm.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5068 set thread context of 2988	5068	Material requirements.exe	97

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
5068	Material requirements.exe
5068	Material requirements.exe
5068	Material requirements.exe
2360	powershell.exe
2360	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5068	Material requirements.exe
Token: SeDebugPrivilege	2360	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 2988	5068	Material requirements.exe	97
PID 5068 wrote to memory of 2988	5068	Material requirements.exe	97
PID 5068 wrote to memory of 2988	5068	Material requirements.exe	97
PID 5068 wrote to memory of 2988	5068	Material requirements.exe	97
PID 5068 wrote to memory of 2988	5068	Material requirements.exe	97
PID 5068 wrote to memory of 2988	5068	Material requirements.exe	97
PID 5068 wrote to memory of 2988	5068	Material requirements.exe	97
PID 5068 wrote to memory of 2988	5068	Material requirements.exe	97
PID 2988 wrote to memory of 3792	2988	RegAsm.exe	98
PID 2988 wrote to memory of 3792	2988	RegAsm.exe	98
PID 2988 wrote to memory of 3792	2988	RegAsm.exe	98
PID 3792 wrote to memory of 2360	3792	cmd.exe	100
PID 3792 wrote to memory of 2360	3792	cmd.exe	100
PID 3792 wrote to memory of 2360	3792	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\Material requirements.exe
"C:\Users\Admin\AppData\Local\Temp\Material requirements.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
  "C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\RegAsm.exe' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3792
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\RegAsm.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RegAsm.exe

Filesize
63KB

MD5
0d5df43af2916f47d00c1573797c1a13

SHA1
230ab5559e806574d26b4c20847c368ed55483b0

SHA256
c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc

SHA512
f96cf9e1890746b12daf839a6d0f16f062b72c1b8a40439f96583f242980f10f867720232a6fa0f7d4d7ac0a7a6143981a5a130d6417ea98b181447134c7cfe2

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5ockyh31.5bh.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2360-49-0x0000000005FB0000-0x0000000005FCA000-memory.dmp

Filesize
104KB

Download
memory/2360-51-0x00000000060A0000-0x00000000060C2000-memory.dmp

Filesize
136KB

Download
memory/2360-29-0x0000000000C90000-0x0000000000CC6000-memory.dmp

Filesize
216KB

Download
memory/2360-48-0x0000000007100000-0x000000000777A000-memory.dmp

Filesize
6.5MB

Download
memory/2360-47-0x0000000005B60000-0x0000000005BAC000-memory.dmp

Filesize
304KB

Download
memory/2360-46-0x0000000005AC0000-0x0000000005ADE000-memory.dmp

Filesize
120KB

Download
memory/2360-45-0x00000000055D0000-0x0000000005924000-memory.dmp

Filesize
3.3MB

Download
memory/2360-50-0x0000000006B20000-0x0000000006BB6000-memory.dmp

Filesize
600KB

Download
memory/2360-35-0x0000000005280000-0x00000000052E6000-memory.dmp

Filesize
408KB

Download
memory/2360-34-0x0000000004A90000-0x0000000004AB2000-memory.dmp

Filesize
136KB

Download
memory/2360-54-0x0000000074F40000-0x00000000756F0000-memory.dmp

Filesize
7.7MB

Download
memory/2360-31-0x0000000074F40000-0x00000000756F0000-memory.dmp

Filesize
7.7MB

Download
memory/2360-32-0x0000000004BE0000-0x0000000005208000-memory.dmp

Filesize
6.2MB

Download
memory/2360-33-0x0000000074F40000-0x00000000756F0000-memory.dmp

Filesize
7.7MB

Download
memory/2360-30-0x0000000074F40000-0x00000000756F0000-memory.dmp

Filesize
7.7MB

Download
memory/2988-23-0x0000000074F40000-0x00000000756F0000-memory.dmp

Filesize
7.7MB

Download
memory/2988-18-0x00000000007B0000-0x000000000084A000-memory.dmp

Filesize
616KB

Download
memory/2988-24-0x0000000004EE0000-0x0000000004F46000-memory.dmp

Filesize
408KB

Download
memory/2988-25-0x0000000074F40000-0x00000000756F0000-memory.dmp

Filesize
7.7MB

Download
memory/2988-26-0x0000000005870000-0x0000000005884000-memory.dmp

Filesize
80KB

Download
memory/2988-28-0x0000000074F40000-0x00000000756F0000-memory.dmp

Filesize
7.7MB

Download
memory/2988-22-0x0000000004E30000-0x0000000004E74000-memory.dmp

Filesize
272KB

Download
memory/2988-20-0x0000000004D90000-0x0000000004E2C000-memory.dmp

Filesize
624KB

Download
memory/2988-21-0x0000000074F40000-0x00000000756F0000-memory.dmp

Filesize
7.7MB

Download
memory/5068-12-0x0000000006A00000-0x0000000006A0A000-memory.dmp

Filesize
40KB

Download
memory/5068-19-0x0000000074F40000-0x00000000756F0000-memory.dmp

Filesize
7.7MB

Download
memory/5068-0-0x0000000074F4E000-0x0000000074F4F000-memory.dmp

Filesize
4KB

Download
memory/5068-10-0x0000000074F40000-0x00000000756F0000-memory.dmp

Filesize
7.7MB

Download
memory/5068-9-0x00000000054F0000-0x00000000054FA000-memory.dmp

Filesize
40KB

Download
memory/5068-8-0x0000000074F40000-0x00000000756F0000-memory.dmp

Filesize
7.7MB

Download
memory/5068-7-0x0000000074F4E000-0x0000000074F4F000-memory.dmp

Filesize
4KB

Download
memory/5068-6-0x0000000074F40000-0x00000000756F0000-memory.dmp

Filesize
7.7MB

Download
memory/5068-5-0x0000000004ED0000-0x0000000004F14000-memory.dmp

Filesize
272KB

Download
memory/5068-4-0x0000000004F70000-0x0000000005002000-memory.dmp

Filesize
584KB

Download
memory/5068-3-0x0000000005520000-0x0000000005AC4000-memory.dmp

Filesize
5.6MB

Download
memory/5068-2-0x00000000027F0000-0x000000000280E000-memory.dmp

Filesize
120KB

Download
memory/5068-1-0x00000000003F0000-0x0000000000536000-memory.dmp

Filesize
1.3MB

Download