zgrat | c59d439740eaed321bc13f0bc71146cea479b589e8d10d44085898055dd9dcc6

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 07:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe
Size 529KB
Sample240510-jsq57abf21
SHA256 c59d439740eaed321bc13f0bc71146cea479b589e8d10d44085898055dd9dcc6
MD5 a7767274a4799d936b58d3946deed650
SHA1 244e7229c233fee50b4a1826c47be23aded480f6
SHA512 8bbcd8cdf2488cb2e52620dbb96ffa65d59f460db7dba6e8282fbb777faf10445317a27b87035949441001bea9294f2d9b95c12d6818d20080e088bc8c5ea544
SSDEEP 12288:uomtZneH0RFnR4bb+o8RNw0Axf0PRtzfUQRX+:knXFGiZZCf0ZtzMQ4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral1/memory/2988-1-0x0000000001000000-0x0000000001086000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2988 set thread context of 2520	2988	a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2500	2520	WerFault.exe	29

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2520	2988	a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe	29
PID 2988 wrote to memory of 2520	2988	a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe	29
PID 2988 wrote to memory of 2520	2988	a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe	29
PID 2988 wrote to memory of 2520	2988	a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe	29
PID 2988 wrote to memory of 2520	2988	a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe	29
PID 2988 wrote to memory of 2520	2988	a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe	29
PID 2988 wrote to memory of 2520	2988	a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe	29
PID 2988 wrote to memory of 2520	2988	a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe	29
PID 2988 wrote to memory of 2520	2988	a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe	29
PID 2988 wrote to memory of 2520	2988	a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe	29
PID 2988 wrote to memory of 2520	2988	a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe	29
PID 2988 wrote to memory of 2520	2988	a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe	29
PID 2988 wrote to memory of 2520	2988	a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe	29
PID 2520 wrote to memory of 2500	2520	RegAsm.exe	30
PID 2520 wrote to memory of 2500	2520	RegAsm.exe	30
PID 2520 wrote to memory of 2500	2520	RegAsm.exe	30
PID 2520 wrote to memory of 2500	2520	RegAsm.exe	30

C:\Users\Admin\AppData\Local\Temp\a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 256
    3⤵
    - Program crash
    PID:2500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2520-15-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/2520-19-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/2520-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2520-11-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/2520-9-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/2520-7-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/2520-6-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/2520-5-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/2988-1-0x0000000001000000-0x0000000001086000-memory.dmp

Download

memory/2988-2-0x0000000074B20000-0x000000007520E000-memory.dmp

Download

memory/2988-20-0x0000000074B20000-0x000000007520E000-memory.dmp

Download

memory/2988-17-0x0000000074B20000-0x000000007520E000-memory.dmp

Download

memory/2988-0-0x0000000074B2E000-0x0000000074B2F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads