zgrat | 3c21cb1b6a535cbdfc874821b7836516ebd20ab8afb94b3c18636780666ff9ba

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-05-2024 14:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AZURE PROXYLESS CHECKER-noAnti_Slayed.exe
Size

2.3MB
MD5

5122f846edafa2010c57c3e898b4a12a
SHA1

83132f608365e96021fe5d2466e3577d959415c7
SHA256

3c21cb1b6a535cbdfc874821b7836516ebd20ab8afb94b3c18636780666ff9ba
SHA512

f53a7469c2d00bd9e8949d6eb69ba7e8a3814d631ee1647fb6fc86c6fe6f9160eca68f9777bdc4721a201ec2dc4ad1234ebc6ddf280060edff52af7b6f1a668f
SSDEEP

49152:KfhNO/E5yqDpXtWqwK75F5745fzSjoZNQPajoNeOyJuhA:Kfh4s5zhpwKdH7gfzScZt0eOys

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral1/memory/1812-1-0x00000000008C0000-0x0000000000B20000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1812 set thread context of 2520	1812	AZURE PROXYLESS CHECKER-noAnti_Slayed.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2516	2520	WerFault.exe	29

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 3060	1812	AZURE PROXYLESS CHECKER-noAnti_Slayed.exe	28
PID 1812 wrote to memory of 3060	1812	AZURE PROXYLESS CHECKER-noAnti_Slayed.exe	28
PID 1812 wrote to memory of 3060	1812	AZURE PROXYLESS CHECKER-noAnti_Slayed.exe	28
PID 1812 wrote to memory of 3060	1812	AZURE PROXYLESS CHECKER-noAnti_Slayed.exe	28
PID 1812 wrote to memory of 3060	1812	AZURE PROXYLESS CHECKER-noAnti_Slayed.exe	28
PID 1812 wrote to memory of 3060	1812	AZURE PROXYLESS CHECKER-noAnti_Slayed.exe	28
PID 1812 wrote to memory of 3060	1812	AZURE PROXYLESS CHECKER-noAnti_Slayed.exe	28
PID 1812 wrote to memory of 2520	1812	AZURE PROXYLESS CHECKER-noAnti_Slayed.exe	29
PID 1812 wrote to memory of 2520	1812	AZURE PROXYLESS CHECKER-noAnti_Slayed.exe	29
PID 1812 wrote to memory of 2520	1812	AZURE PROXYLESS CHECKER-noAnti_Slayed.exe	29
PID 1812 wrote to memory of 2520	1812	AZURE PROXYLESS CHECKER-noAnti_Slayed.exe	29
PID 1812 wrote to memory of 2520	1812	AZURE PROXYLESS CHECKER-noAnti_Slayed.exe	29
PID 1812 wrote to memory of 2520	1812	AZURE PROXYLESS CHECKER-noAnti_Slayed.exe	29
PID 1812 wrote to memory of 2520	1812	AZURE PROXYLESS CHECKER-noAnti_Slayed.exe	29
PID 1812 wrote to memory of 2520	1812	AZURE PROXYLESS CHECKER-noAnti_Slayed.exe	29
PID 1812 wrote to memory of 2520	1812	AZURE PROXYLESS CHECKER-noAnti_Slayed.exe	29
PID 1812 wrote to memory of 2520	1812	AZURE PROXYLESS CHECKER-noAnti_Slayed.exe	29
PID 1812 wrote to memory of 2520	1812	AZURE PROXYLESS CHECKER-noAnti_Slayed.exe	29
PID 1812 wrote to memory of 2520	1812	AZURE PROXYLESS CHECKER-noAnti_Slayed.exe	29
PID 1812 wrote to memory of 2520	1812	AZURE PROXYLESS CHECKER-noAnti_Slayed.exe	29
PID 1812 wrote to memory of 2520	1812	AZURE PROXYLESS CHECKER-noAnti_Slayed.exe	29
PID 2520 wrote to memory of 2516	2520	RegAsm.exe	30
PID 2520 wrote to memory of 2516	2520	RegAsm.exe	30
PID 2520 wrote to memory of 2516	2520	RegAsm.exe	30
PID 2520 wrote to memory of 2516	2520	RegAsm.exe	30

C:\Users\Admin\AppData\Local\Temp\AZURE PROXYLESS CHECKER-noAnti_Slayed.exe
"C:\Users\Admin\AppData\Local\Temp\AZURE PROXYLESS CHECKER-noAnti_Slayed.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3060
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 252
    3⤵
    - Program crash
    PID:2516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1812-0-0x00000000744DE000-0x00000000744DF000-memory.dmp

Filesize
4KB

Download
memory/1812-1-0x00000000008C0000-0x0000000000B20000-memory.dmp

Filesize
2.4MB

Download
memory/1812-13-0x00000000744D0000-0x0000000074BBE000-memory.dmp

Filesize
6.9MB

Download
memory/1812-19-0x00000000744D0000-0x0000000074BBE000-memory.dmp

Filesize
6.9MB

Download
memory/2520-8-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/2520-9-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/2520-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2520-7-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/2520-6-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/2520-5-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/2520-4-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/2520-16-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/2520-18-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/2520-12-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads