zgrat | 72314ab54f1d53464f1f5aadb50448dae3a241a6e40ca4bd1b5bfa32e2b75b4d

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 01:00

Target

a65dc9cbe71f0efde3fd50729cf5576bfb4c870329eed8f90dcd0fc1b9aa97ba.exe
Size

3.4MB
MD5

008d9913e8ce8bb934b93c559a2e32fa
SHA1

10e863115463502aaea5c18f71e02221c6cd02db
SHA256

a65dc9cbe71f0efde3fd50729cf5576bfb4c870329eed8f90dcd0fc1b9aa97ba
SHA512

bb2650f0d776cc479b71987b3a5ef6338eb74b70de04b3628bdf8a1d48199b33d8050b6378b46a75cfba744a8800aa374474197018052184631c5edba0066d55
SSDEEP

98304:h8P8hjuTg6NzRkqDGHiR27pb0WAOfraP1:hkoyTgAj6N1b0WAOfraP1

Score

10^/10

zgrat rat

Detect ZGRat V1 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2880-1-0x00000000008C0000-0x0000000000C30000-memory.dmp	family_zgrat_v1

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
behavioral1/memory/2880-1-0x00000000008C0000-0x0000000000C30000-memory.dmp	net_reactor

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2772 2880 WerFault.exe a65dc9cbe71f0efde3fd50729cf5576bfb4c870329eed8f90dcd0fc1b9aa97ba.exe

pid	pid_target	process	target process
2772	2880	WerFault.exe	a65dc9cbe71f0efde3fd50729cf5576bfb4c870329eed8f90dcd0fc1b9aa97ba.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

a65dc9cbe71f0efde3fd50729cf5576bfb4c870329eed8f90dcd0fc1b9aa97ba.exe

description	pid	process	target process
PID 2880 wrote to memory of 2772	2880	a65dc9cbe71f0efde3fd50729cf5576bfb4c870329eed8f90dcd0fc1b9aa97ba.exe	WerFault.exe
PID 2880 wrote to memory of 2772	2880	a65dc9cbe71f0efde3fd50729cf5576bfb4c870329eed8f90dcd0fc1b9aa97ba.exe	WerFault.exe
PID 2880 wrote to memory of 2772	2880	a65dc9cbe71f0efde3fd50729cf5576bfb4c870329eed8f90dcd0fc1b9aa97ba.exe	WerFault.exe
PID 2880 wrote to memory of 2772	2880	a65dc9cbe71f0efde3fd50729cf5576bfb4c870329eed8f90dcd0fc1b9aa97ba.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\a65dc9cbe71f0efde3fd50729cf5576bfb4c870329eed8f90dcd0fc1b9aa97ba.exe
"C:\Users\Admin\AppData\Local\Temp\a65dc9cbe71f0efde3fd50729cf5576bfb4c870329eed8f90dcd0fc1b9aa97ba.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 556
2⤵
- Program crash
PID:2772

memory/2880-0-0x0000000074B2E000-0x0000000074B2F000-memory.dmp

Filesize
4KB

Download
memory/2880-1-0x00000000008C0000-0x0000000000C30000-memory.dmp

Filesize
3.4MB

Download
memory/2880-2-0x0000000074B2E000-0x0000000074B2F000-memory.dmp

Filesize
4KB

Download