zgrat | 0218aa4e18dd2db185038c9dfb349e9eff5d4c49ee910590e815e88323a6f642 | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
13-05-2024 06:26

Sharing

Report Analysis Logs

General

Target

5db8857cca603a760cfb6955f5c309cf.exe
Size

3.5MB
MD5

5db8857cca603a760cfb6955f5c309cf
SHA1

6256f8199587182efb4f0941fb7668cb72e334cb
SHA256

0218aa4e18dd2db185038c9dfb349e9eff5d4c49ee910590e815e88323a6f642
SHA512

4e67e73d0e8742f660ebc6fe7eab143ab2154c774f9987ba950b24217bee13b009d44bde26e3e4bc37915d0f264b39965bec8c4c49534ef2a55888bc97a19665
SSDEEP

98304:Lny83Z5SrLFKEik8ntD0V0e0WAOfraPsqqE:LnyskIEi3ntD0Se0WAOfraP

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral1/memory/2288-1-0x0000000000E20000-0x000000000119E000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/memory/2288-1-0x0000000000E20000-0x000000000119E000-memory.dmp	net_reactor

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1256	2288	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 1256	2288	5db8857cca603a760cfb6955f5c309cf.exe	28
PID 2288 wrote to memory of 1256	2288	5db8857cca603a760cfb6955f5c309cf.exe	28
PID 2288 wrote to memory of 1256	2288	5db8857cca603a760cfb6955f5c309cf.exe	28
PID 2288 wrote to memory of 1256	2288	5db8857cca603a760cfb6955f5c309cf.exe	28

C:\Users\Admin\AppData\Local\Temp\5db8857cca603a760cfb6955f5c309cf.exe
"C:\Users\Admin\AppData\Local\Temp\5db8857cca603a760cfb6955f5c309cf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 556
  2⤵
  - Program crash
  PID:1256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2288-0-0x0000000074D4E000-0x0000000074D4F000-memory.dmp

Filesize
4KB

Download
memory/2288-1-0x0000000000E20000-0x000000000119E000-memory.dmp

Filesize
3.5MB

Download