zgrat | e84cad4f234445a47bf803591ac168031558e9215ba714c2197fe75b5188aa1c

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 01:59

Target

e84cad4f234445a47bf803591ac168031558e9215ba714c2197fe75b5188aa1c.exe
Size

4.5MB
MD5

4de76ad34e9ccffc91bbec7a3c4e79e0
SHA1

ff1a420b36557b306df4e2c3e020c49abeb3620a
SHA256

e84cad4f234445a47bf803591ac168031558e9215ba714c2197fe75b5188aa1c
SHA512

ff317dd768d14ec10d1cfc5cf2111b08a2943be55f58066b450ecb27e4531ea54d68911faf7ad4990e1bcb6d56f67b6c2179749266634c1dbb7bcfc57ed27dbe
SSDEEP

49152:Fw+k41fhgCT4O3Qdx09EwApWjGUAN1ZtgX+cvfrmhC0w9O2XM+OBFpGMEMBF:FE2ScXywApWyZZWXLvjmo9iB

Score

10^/10

zgrat rat

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral1/memory/2884-1-0x0000000000170000-0x00000000005EA000-memory.dmp	family_zgrat_v1

Detects executables packed with unregistered version of .NET Reactor 1 IoCs

resource	yara_rule
behavioral1/memory/2884-1-0x0000000000170000-0x00000000005EA000-memory.dmp	INDICATOR_EXE_Packed_DotNetReactor

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/memory/2884-1-0x0000000000170000-0x00000000005EA000-memory.dmp	net_reactor

Program crash 1 IoCs

pid	pid_target	Process	procid_target
940	2884	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 940	2884	e84cad4f234445a47bf803591ac168031558e9215ba714c2197fe75b5188aa1c.exe	28
PID 2884 wrote to memory of 940	2884	e84cad4f234445a47bf803591ac168031558e9215ba714c2197fe75b5188aa1c.exe	28
PID 2884 wrote to memory of 940	2884	e84cad4f234445a47bf803591ac168031558e9215ba714c2197fe75b5188aa1c.exe	28
PID 2884 wrote to memory of 940	2884	e84cad4f234445a47bf803591ac168031558e9215ba714c2197fe75b5188aa1c.exe	28

C:\Users\Admin\AppData\Local\Temp\e84cad4f234445a47bf803591ac168031558e9215ba714c2197fe75b5188aa1c.exe
"C:\Users\Admin\AppData\Local\Temp\e84cad4f234445a47bf803591ac168031558e9215ba714c2197fe75b5188aa1c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 560
  2⤵
  - Program crash
  PID:940

memory/2884-0-0x000000007447E000-0x000000007447F000-memory.dmp

Filesize
4KB

Download
memory/2884-1-0x0000000000170000-0x00000000005EA000-memory.dmp

Filesize
4.5MB

Download
memory/2884-2-0x000000007447E000-0x000000007447F000-memory.dmp

Filesize
4KB

Download