zgrat | c59d439740eaed321bc13f0bc71146cea479b589e8d10d44085898055dd9dcc6

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 07:56

Target

a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe
Size

529KB
MD5

a7767274a4799d936b58d3946deed650
SHA1

244e7229c233fee50b4a1826c47be23aded480f6
SHA256

c59d439740eaed321bc13f0bc71146cea479b589e8d10d44085898055dd9dcc6
SHA512

8bbcd8cdf2488cb2e52620dbb96ffa65d59f460db7dba6e8282fbb777faf10445317a27b87035949441001bea9294f2d9b95c12d6818d20080e088bc8c5ea544
SSDEEP

12288:uomtZneH0RFnR4bb+o8RNw0Axf0PRtzfUQRX+:knXFGiZZCf0ZtzMQ4

Score

10^/10

zgrat rat

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral1/memory/2988-1-0x0000000001000000-0x0000000001086000-memory.dmp	family_zgrat_v1

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2988 set thread context of 2520	2988	a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2500	2520	WerFault.exe	29

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2520	2988	a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe	29
PID 2988 wrote to memory of 2520	2988	a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe	29
PID 2988 wrote to memory of 2520	2988	a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe	29
PID 2988 wrote to memory of 2520	2988	a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe	29
PID 2988 wrote to memory of 2520	2988	a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe	29
PID 2988 wrote to memory of 2520	2988	a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe	29
PID 2988 wrote to memory of 2520	2988	a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe	29
PID 2988 wrote to memory of 2520	2988	a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe	29
PID 2988 wrote to memory of 2520	2988	a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe	29
PID 2988 wrote to memory of 2520	2988	a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe	29
PID 2988 wrote to memory of 2520	2988	a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe	29
PID 2988 wrote to memory of 2520	2988	a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe	29
PID 2988 wrote to memory of 2520	2988	a7767274a4799d936b58d3946deed650_NeikiAnalytics.exe	29
PID 2520 wrote to memory of 2500	2520	RegAsm.exe	30
PID 2520 wrote to memory of 2500	2520	RegAsm.exe	30
PID 2520 wrote to memory of 2500	2520	RegAsm.exe	30
PID 2520 wrote to memory of 2500	2520	RegAsm.exe	30

memory/2520-15-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2520-19-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2520-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2520-11-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2520-9-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2520-7-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2520-6-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2520-5-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2988-1-0x0000000001000000-0x0000000001086000-memory.dmp

Filesize
536KB

Download
memory/2988-2-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download
memory/2988-20-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download
memory/2988-17-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download
memory/2988-0-0x0000000074B2E000-0x0000000074B2F000-memory.dmp

Filesize
4KB

Download