zgrat | 76e5152fac663c8b62216087394df3516eb574686df01c77c85e27c7b9b531b4

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 13:11

Target

2f458c33db76f5a0cedacef12448de7a_JaffaCakes118.exe
Size

1.8MB
MD5

2f458c33db76f5a0cedacef12448de7a
SHA1

255009db52b3f7c248b531ccaaa92d06e87f0835
SHA256

76e5152fac663c8b62216087394df3516eb574686df01c77c85e27c7b9b531b4
SHA512

b815a34aad7e100aa493a4b4d05cb1379f28b0c4bd112675986945724aa4e47b434fc2de9a3efa0c0351559a6b7092463e59f97991f1e24e85f74187497a38a0
SSDEEP

24576:DZj28ewfikbzlKf8Y67OQGPrp0oB2PdEvNOSz3gPwB:FM3yJKsRcTB7vNHzV

Score

10^/10

zgrat rat

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral1/memory/3000-3-0x0000000000330000-0x0000000000350000-memory.dmp	family_zgrat_v1

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2628	3000	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3000	2f458c33db76f5a0cedacef12448de7a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2628	3000	2f458c33db76f5a0cedacef12448de7a_JaffaCakes118.exe	30
PID 3000 wrote to memory of 2628	3000	2f458c33db76f5a0cedacef12448de7a_JaffaCakes118.exe	30
PID 3000 wrote to memory of 2628	3000	2f458c33db76f5a0cedacef12448de7a_JaffaCakes118.exe	30
PID 3000 wrote to memory of 2628	3000	2f458c33db76f5a0cedacef12448de7a_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\2f458c33db76f5a0cedacef12448de7a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2f458c33db76f5a0cedacef12448de7a_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 780
  2⤵
  - Program crash
  PID:2628

memory/3000-0-0x000000007416E000-0x000000007416F000-memory.dmp

Filesize
4KB

Download
memory/3000-1-0x0000000000D10000-0x0000000000EDC000-memory.dmp

Filesize
1.8MB

Download
memory/3000-2-0x0000000074160000-0x000000007484E000-memory.dmp

Filesize
6.9MB

Download
memory/3000-3-0x0000000000330000-0x0000000000350000-memory.dmp

Filesize
128KB

Download
memory/3000-4-0x000000007416E000-0x000000007416F000-memory.dmp

Filesize
4KB

Download
memory/3000-5-0x0000000074160000-0x000000007484E000-memory.dmp

Filesize
6.9MB

Download