zgrat | eb8d4be3f8cb5b348afd8a574eb38e8c419e6e8a6678d38f06c0369703dacffb

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 02:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d942f261cc748e9c2ab91a26a6b53d4_JaffaCakes118.exe
Size

340KB
MD5

3d942f261cc748e9c2ab91a26a6b53d4
SHA1

c5dc06b29bb38eb86fbe22b3b681a5f523f68293
SHA256

eb8d4be3f8cb5b348afd8a574eb38e8c419e6e8a6678d38f06c0369703dacffb
SHA512

ba32e2ae6067059c2c4895025d25fbb2837032e21e5af40bd8137642dd9f631e5477b853caa853054a0ebc51bce519ab9244f4ecb7bdf75bcf0641a435a65920
SSDEEP

3072:tNd6gEYAqvZvxN3p4pxKqcJ0GYNNSWv4bwEZypklN3yoXeIU/4HjBLPMQ/BN63hw:fEOv5xVp4pxhcCE04bB/LGDTU

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2364-1-0x0000000000B90000-0x0000000000BEA000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

Processes:

flow	ioc
4	pastebin.com
5	pastebin.com

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
2984	2364	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

3d942f261cc748e9c2ab91a26a6b53d4_JaffaCakes118.exe

description	pid	Process
Token: SeDebugPrivilege	2364	3d942f261cc748e9c2ab91a26a6b53d4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3d942f261cc748e9c2ab91a26a6b53d4_JaffaCakes118.exe

description	pid	Process	procid_target
PID 2364 wrote to memory of 2984	2364	3d942f261cc748e9c2ab91a26a6b53d4_JaffaCakes118.exe	28
PID 2364 wrote to memory of 2984	2364	3d942f261cc748e9c2ab91a26a6b53d4_JaffaCakes118.exe	28
PID 2364 wrote to memory of 2984	2364	3d942f261cc748e9c2ab91a26a6b53d4_JaffaCakes118.exe	28
PID 2364 wrote to memory of 2984	2364	3d942f261cc748e9c2ab91a26a6b53d4_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\3d942f261cc748e9c2ab91a26a6b53d4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3d942f261cc748e9c2ab91a26a6b53d4_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 1520
  2⤵
  - Program crash
  PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2364-0-0x000000007455E000-0x000000007455F000-memory.dmp

Filesize
4KB

Download
memory/2364-1-0x0000000000B90000-0x0000000000BEA000-memory.dmp

Filesize
360KB

Download
memory/2364-2-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download
memory/2364-3-0x000000007455E000-0x000000007455F000-memory.dmp

Filesize
4KB

Download
memory/2364-4-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download