zgrat | f5a8212add9f9bfbc85f6337d2194ca9aa66bd3c12830c8ebe7d7ff60934d5ad

Analysis

max time kernel
149s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
06-05-2024 17:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f5a8212add9f9bfbc85f6337d2194ca9aa66bd3c12830c8ebe7d7ff60934d5ad.exe
Size

551KB
MD5

a507ce96d65b8ded1a32998e65c65cc5
SHA1

db43868ad7aa5517998c7c486d4b564d3a683621
SHA256

f5a8212add9f9bfbc85f6337d2194ca9aa66bd3c12830c8ebe7d7ff60934d5ad
SHA512

15baaef10520d9898aed0e5ceed4bb98f4122c07da69585d4843105f0d79e77aa75c098fcc29db52a14cb80b5a17a5a927288676ab3fe9d1ffec815f36803976
SSDEEP

12288:tX0+hk6HUIzCjgY9xaYZRykP8/fK+F7U+yMC3anu:90WKGC/9xZkkxEmM5u

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral2/memory/4908-11-0x0000000006F10000-0x0000000006F80000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4908 set thread context of 336	4908	f5a8212add9f9bfbc85f6337d2194ca9aa66bd3c12830c8ebe7d7ff60934d5ad.exe	101

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4908	f5a8212add9f9bfbc85f6337d2194ca9aa66bd3c12830c8ebe7d7ff60934d5ad.exe
4908	f5a8212add9f9bfbc85f6337d2194ca9aa66bd3c12830c8ebe7d7ff60934d5ad.exe
336	f5a8212add9f9bfbc85f6337d2194ca9aa66bd3c12830c8ebe7d7ff60934d5ad.exe
336	f5a8212add9f9bfbc85f6337d2194ca9aa66bd3c12830c8ebe7d7ff60934d5ad.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4908	f5a8212add9f9bfbc85f6337d2194ca9aa66bd3c12830c8ebe7d7ff60934d5ad.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 1396	4908	f5a8212add9f9bfbc85f6337d2194ca9aa66bd3c12830c8ebe7d7ff60934d5ad.exe	100
PID 4908 wrote to memory of 1396	4908	f5a8212add9f9bfbc85f6337d2194ca9aa66bd3c12830c8ebe7d7ff60934d5ad.exe	100
PID 4908 wrote to memory of 1396	4908	f5a8212add9f9bfbc85f6337d2194ca9aa66bd3c12830c8ebe7d7ff60934d5ad.exe	100
PID 4908 wrote to memory of 336	4908	f5a8212add9f9bfbc85f6337d2194ca9aa66bd3c12830c8ebe7d7ff60934d5ad.exe	101
PID 4908 wrote to memory of 336	4908	f5a8212add9f9bfbc85f6337d2194ca9aa66bd3c12830c8ebe7d7ff60934d5ad.exe	101
PID 4908 wrote to memory of 336	4908	f5a8212add9f9bfbc85f6337d2194ca9aa66bd3c12830c8ebe7d7ff60934d5ad.exe	101
PID 4908 wrote to memory of 336	4908	f5a8212add9f9bfbc85f6337d2194ca9aa66bd3c12830c8ebe7d7ff60934d5ad.exe	101
PID 4908 wrote to memory of 336	4908	f5a8212add9f9bfbc85f6337d2194ca9aa66bd3c12830c8ebe7d7ff60934d5ad.exe	101
PID 4908 wrote to memory of 336	4908	f5a8212add9f9bfbc85f6337d2194ca9aa66bd3c12830c8ebe7d7ff60934d5ad.exe	101

C:\Users\Admin\AppData\Local\Temp\f5a8212add9f9bfbc85f6337d2194ca9aa66bd3c12830c8ebe7d7ff60934d5ad.exe
"C:\Users\Admin\AppData\Local\Temp\f5a8212add9f9bfbc85f6337d2194ca9aa66bd3c12830c8ebe7d7ff60934d5ad.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Users\Admin\AppData\Local\Temp\f5a8212add9f9bfbc85f6337d2194ca9aa66bd3c12830c8ebe7d7ff60934d5ad.exe
  "C:\Users\Admin\AppData\Local\Temp\f5a8212add9f9bfbc85f6337d2194ca9aa66bd3c12830c8ebe7d7ff60934d5ad.exe"
  2⤵
  PID:1396
- C:\Users\Admin\AppData\Local\Temp\f5a8212add9f9bfbc85f6337d2194ca9aa66bd3c12830c8ebe7d7ff60934d5ad.exe
  "C:\Users\Admin\AppData\Local\Temp\f5a8212add9f9bfbc85f6337d2194ca9aa66bd3c12830c8ebe7d7ff60934d5ad.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/336-14-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/336-18-0x00000000019C0000-0x0000000001D0A000-memory.dmp

Filesize
3.3MB

Download
memory/336-16-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4908-8-0x0000000074ADE000-0x0000000074ADF000-memory.dmp

Filesize
4KB

Download
memory/4908-10-0x0000000005BC0000-0x0000000005BCC000-memory.dmp

Filesize
48KB

Download
memory/4908-5-0x0000000074AD0000-0x0000000075280000-memory.dmp

Filesize
7.7MB

Download
memory/4908-6-0x0000000005980000-0x0000000005B26000-memory.dmp

Filesize
1.6MB

Download
memory/4908-7-0x0000000005B30000-0x0000000005B3C000-memory.dmp

Filesize
48KB

Download
memory/4908-0-0x0000000074ADE000-0x0000000074ADF000-memory.dmp

Filesize
4KB

Download
memory/4908-9-0x0000000074AD0000-0x0000000075280000-memory.dmp

Filesize
7.7MB

Download
memory/4908-4-0x00000000055D0000-0x00000000055DA000-memory.dmp

Filesize
40KB

Download
memory/4908-11-0x0000000006F10000-0x0000000006F80000-memory.dmp

Filesize
448KB

Download
memory/4908-12-0x0000000007040000-0x00000000070DC000-memory.dmp

Filesize
624KB

Download
memory/4908-13-0x0000000006EB0000-0x0000000006EE8000-memory.dmp

Filesize
224KB

Download
memory/4908-3-0x0000000005510000-0x00000000055A2000-memory.dmp

Filesize
584KB

Download
memory/4908-2-0x0000000005BD0000-0x0000000006174000-memory.dmp

Filesize
5.6MB

Download
memory/4908-17-0x0000000074AD0000-0x0000000075280000-memory.dmp

Filesize
7.7MB

Download
memory/4908-1-0x0000000000AC0000-0x0000000000B4E000-memory.dmp

Filesize
568KB

Download