zgrat | ce5f772f0350f2d6865071c10b5fd832b76f4fa3a63d8aa6ffa494c302335ecc

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-05-2024 23:23

Target

34f10ff655b73c34bb13f79f7f7e4220_NeikiAnalytics.exe
Size

3.8MB
MD5

34f10ff655b73c34bb13f79f7f7e4220
SHA1

56fb9f28c0fdf5abd9cfbe598dd38e06ac346afa
SHA256

ce5f772f0350f2d6865071c10b5fd832b76f4fa3a63d8aa6ffa494c302335ecc
SHA512

1f6cad1af1ad5e9a637383f62af7dd427020017ba7b86f7c77c676947c74e579e2eee574ea6ebfe5fd7168179c73771c0c665f840a8cdc0c0e71c9c09ba37228
SSDEEP

49152:qQiJrlduJpoX7mzpzOd3BI9tpqTVgG4MZ3PnPzl2/NLHRibD01BTQJuePj3x2Q7b:IJrl4pjzOBogB/nbqZHRi3eKJ/PTMQ7

Score

10^/10

zgrat rat

Detect ZGRat V1 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2900-1-0x0000000000EC0000-0x000000000128A000-memory.dmp	family_zgrat_v1

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
behavioral1/memory/2900-1-0x0000000000EC0000-0x000000000128A000-memory.dmp	net_reactor

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
2464	2900	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

34f10ff655b73c34bb13f79f7f7e4220_NeikiAnalytics.exe

description	pid	Process	procid_target
PID 2900 wrote to memory of 2464	2900	34f10ff655b73c34bb13f79f7f7e4220_NeikiAnalytics.exe	28
PID 2900 wrote to memory of 2464	2900	34f10ff655b73c34bb13f79f7f7e4220_NeikiAnalytics.exe	28
PID 2900 wrote to memory of 2464	2900	34f10ff655b73c34bb13f79f7f7e4220_NeikiAnalytics.exe	28
PID 2900 wrote to memory of 2464	2900	34f10ff655b73c34bb13f79f7f7e4220_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\34f10ff655b73c34bb13f79f7f7e4220_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\34f10ff655b73c34bb13f79f7f7e4220_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 556
  2⤵
  - Program crash
  PID:2464

memory/2900-0-0x000000007433E000-0x000000007433F000-memory.dmp

Filesize
4KB

Download
memory/2900-1-0x0000000000EC0000-0x000000000128A000-memory.dmp

Filesize
3.8MB

Download
memory/2900-2-0x000000007433E000-0x000000007433F000-memory.dmp

Filesize
4KB

Download