zgrat | e84cad4f234445a47bf803591ac168031558e9215ba714c2197fe75b5188aa1c

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 19:08

Target

4de76ad34e9ccffc91bbec7a3c4e79e0_NeikiAnalytics.exe
Size

4.5MB
MD5

4de76ad34e9ccffc91bbec7a3c4e79e0
SHA1

ff1a420b36557b306df4e2c3e020c49abeb3620a
SHA256

e84cad4f234445a47bf803591ac168031558e9215ba714c2197fe75b5188aa1c
SHA512

ff317dd768d14ec10d1cfc5cf2111b08a2943be55f58066b450ecb27e4531ea54d68911faf7ad4990e1bcb6d56f67b6c2179749266634c1dbb7bcfc57ed27dbe
SSDEEP

49152:Fw+k41fhgCT4O3Qdx09EwApWjGUAN1ZtgX+cvfrmhC0w9O2XM+OBFpGMEMBF:FE2ScXywApWyZZWXLvjmo9iB

Score

10^/10

zgrat rat

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral1/memory/2172-1-0x0000000000E20000-0x000000000129A000-memory.dmp	family_zgrat_v1

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/memory/2172-1-0x0000000000E20000-0x000000000129A000-memory.dmp	net_reactor

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1396	2172	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 1396	2172	4de76ad34e9ccffc91bbec7a3c4e79e0_NeikiAnalytics.exe	28
PID 2172 wrote to memory of 1396	2172	4de76ad34e9ccffc91bbec7a3c4e79e0_NeikiAnalytics.exe	28
PID 2172 wrote to memory of 1396	2172	4de76ad34e9ccffc91bbec7a3c4e79e0_NeikiAnalytics.exe	28
PID 2172 wrote to memory of 1396	2172	4de76ad34e9ccffc91bbec7a3c4e79e0_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\4de76ad34e9ccffc91bbec7a3c4e79e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4de76ad34e9ccffc91bbec7a3c4e79e0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 560
  2⤵
  - Program crash
  PID:1396

memory/2172-0-0x0000000074A4E000-0x0000000074A4F000-memory.dmp

Filesize
4KB

Download
memory/2172-1-0x0000000000E20000-0x000000000129A000-memory.dmp

Filesize
4.5MB

Download
memory/2172-2-0x0000000074A4E000-0x0000000074A4F000-memory.dmp

Filesize
4KB

Download