Analysis

  • max time kernel
    146s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/05/2024, 14:22

General

  • Target

    BaixaCnab.exe

  • Size

    167KB

  • MD5

    41607f695606d94bd05bbcad789169f6

  • SHA1

    ee3f31ea53af0b4c6ccbefce7a5a499a16ae8dc9

  • SHA256

    8c2f65255efe842f8e325accc6b506478c62c7269c3a1099c5e8ec3cb1df7b42

  • SHA512

    57d9fcaee548bc9d039c5621897a9e5d61e9d3d3937016fcb2cfadc104747398b6a6b429c2bf0376449aac9aa7d7ae089c0759ce38253ce1015fa93b30059a71

  • SSDEEP

    3072:QZuq+bkHPcgZ/7e0X0FrpEBSOGnMNd3H:bbkV/7e0kFrQSdM

Score
10/10

Malware Config

Signatures

  • Detect ZGRat V1 1 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

Processes

  • C:\Users\Admin\AppData\Local\Temp\BaixaCnab.exe
    "C:\Users\Admin\AppData\Local\Temp\BaixaCnab.exe"
    1⤵
      PID:2276

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2276-0-0x00007FFC5F793000-0x00007FFC5F795000-memory.dmp

      Filesize

      8KB

    • memory/2276-1-0x0000000000760000-0x0000000000790000-memory.dmp

      Filesize

      192KB

    • memory/2276-2-0x000000001BB40000-0x000000001C36C000-memory.dmp

      Filesize

      8.2MB

    • memory/2276-3-0x00007FFC5F790000-0x00007FFC60251000-memory.dmp

      Filesize

      10.8MB

    • memory/2276-4-0x000000001DE00000-0x000000001F88E000-memory.dmp

      Filesize

      26.6MB

    • memory/2276-5-0x0000000002890000-0x00000000028C2000-memory.dmp

      Filesize

      200KB

    • memory/2276-6-0x00007FFC5F790000-0x00007FFC60251000-memory.dmp

      Filesize

      10.8MB