zgrat | deaf3e009a0a9df61e84c2befdb5db10599f47c03fbdefbbdce83aac3a969cd1

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-05-2024 05:47

Target

deaf3e009a0a9df61e84c2befdb5db10599f47c03fbdefbbdce83aac3a969cd1.exe
Size

472KB
MD5

46c72d686c836f3c97ce18b81b0d9864
SHA1

fdadd2e3cd971cd9fffb3de0f4a69ed0f77ae4a5
SHA256

deaf3e009a0a9df61e84c2befdb5db10599f47c03fbdefbbdce83aac3a969cd1
SHA512

1ab8c8967155913c5dd0e2853d663bb096571062680de246fdda370947f7b6c3d2f44b85be97b821c630a4a42b3990d78601615737c3ced1418c9ccf18611208
SSDEEP

12288:ub3IzlSJCfjT1CDcLfSsYxolZ0B3HpCO00N4:ub3gMMT1iqSRxovg3HE+4

Score

10^/10

zgrat rat

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral1/memory/1440-1-0x0000000000190000-0x000000000020A000-memory.dmp	family_zgrat_v1

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1440 set thread context of 2352	1440	deaf3e009a0a9df61e84c2befdb5db10599f47c03fbdefbbdce83aac3a969cd1.exe	28

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 2352	1440	deaf3e009a0a9df61e84c2befdb5db10599f47c03fbdefbbdce83aac3a969cd1.exe	28
PID 1440 wrote to memory of 2352	1440	deaf3e009a0a9df61e84c2befdb5db10599f47c03fbdefbbdce83aac3a969cd1.exe	28
PID 1440 wrote to memory of 2352	1440	deaf3e009a0a9df61e84c2befdb5db10599f47c03fbdefbbdce83aac3a969cd1.exe	28
PID 1440 wrote to memory of 2352	1440	deaf3e009a0a9df61e84c2befdb5db10599f47c03fbdefbbdce83aac3a969cd1.exe	28
PID 1440 wrote to memory of 2352	1440	deaf3e009a0a9df61e84c2befdb5db10599f47c03fbdefbbdce83aac3a969cd1.exe	28
PID 1440 wrote to memory of 2352	1440	deaf3e009a0a9df61e84c2befdb5db10599f47c03fbdefbbdce83aac3a969cd1.exe	28
PID 1440 wrote to memory of 2352	1440	deaf3e009a0a9df61e84c2befdb5db10599f47c03fbdefbbdce83aac3a969cd1.exe	28
PID 1440 wrote to memory of 2352	1440	deaf3e009a0a9df61e84c2befdb5db10599f47c03fbdefbbdce83aac3a969cd1.exe	28
PID 1440 wrote to memory of 2352	1440	deaf3e009a0a9df61e84c2befdb5db10599f47c03fbdefbbdce83aac3a969cd1.exe	28
PID 1440 wrote to memory of 2352	1440	deaf3e009a0a9df61e84c2befdb5db10599f47c03fbdefbbdce83aac3a969cd1.exe	28
PID 1440 wrote to memory of 2352	1440	deaf3e009a0a9df61e84c2befdb5db10599f47c03fbdefbbdce83aac3a969cd1.exe	28
PID 1440 wrote to memory of 2352	1440	deaf3e009a0a9df61e84c2befdb5db10599f47c03fbdefbbdce83aac3a969cd1.exe	28
PID 1440 wrote to memory of 2352	1440	deaf3e009a0a9df61e84c2befdb5db10599f47c03fbdefbbdce83aac3a969cd1.exe	28

C:\Users\Admin\AppData\Local\Temp\deaf3e009a0a9df61e84c2befdb5db10599f47c03fbdefbbdce83aac3a969cd1.exe
"C:\Users\Admin\AppData\Local\Temp\deaf3e009a0a9df61e84c2befdb5db10599f47c03fbdefbbdce83aac3a969cd1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2352

memory/1440-5-0x0000000074050000-0x000000007473E000-memory.dmp

Filesize
6.9MB

Download
memory/1440-17-0x0000000074050000-0x000000007473E000-memory.dmp

Filesize
6.9MB

Download
memory/1440-0-0x000000007405E000-0x000000007405F000-memory.dmp

Filesize
4KB

Download
memory/1440-1-0x0000000000190000-0x000000000020A000-memory.dmp

Filesize
488KB

Download
memory/1440-2-0x0000000074050000-0x000000007473E000-memory.dmp

Filesize
6.9MB

Download
memory/2352-9-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2352-18-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2352-8-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2352-6-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2352-7-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2352-10-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2352-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2352-13-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2352-16-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download