zgrat | e4877fdceffd87cec166b266532a431e0d5e7644d950ce9566d2f14bc18be5e2

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 01:53

Target

e4877fdceffd87cec166b266532a431e0d5e7644d950ce9566d2f14bc18be5e2.exe
Size

3.0MB
MD5

097a014e9066d6a4dd30e057e18eb511
SHA1

2baa37cdc9b69e4083fdf468240cbacb1f2851ae
SHA256

e4877fdceffd87cec166b266532a431e0d5e7644d950ce9566d2f14bc18be5e2
SHA512

3409f75f0d073146410ebf31f487626e0c5fc01abb962f56b673256e72981f3e4f5c063e6690feeff1b2937bd14b453c38823242c9dee9e607fe63888d9ad627
SSDEEP

49152:HzcK4Uk57r6mnw8fqFEIawGt2jlobG+FVSA7tffhpZ4F/3:HzvMWmnZSVawGtjHFVS8ffDZ4J

Score

10^/10

zgrat rat

Detect ZGRat V1 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1516-1-0x00000000010A0000-0x00000000013A2000-memory.dmp	family_zgrat_v1

Detects executables packed with unregistered version of .NET Reactor 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1516-1-0x00000000010A0000-0x00000000013A2000-memory.dmp	INDICATOR_EXE_Packed_DotNetReactor

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
behavioral1/memory/1516-1-0x00000000010A0000-0x00000000013A2000-memory.dmp	net_reactor

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2572 1516 WerFault.exe e4877fdceffd87cec166b266532a431e0d5e7644d950ce9566d2f14bc18be5e2.exe

pid	pid_target	process	target process
2572	1516	WerFault.exe	e4877fdceffd87cec166b266532a431e0d5e7644d950ce9566d2f14bc18be5e2.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

e4877fdceffd87cec166b266532a431e0d5e7644d950ce9566d2f14bc18be5e2.exe

description	pid	process	target process
PID 1516 wrote to memory of 2572	1516	e4877fdceffd87cec166b266532a431e0d5e7644d950ce9566d2f14bc18be5e2.exe	WerFault.exe
PID 1516 wrote to memory of 2572	1516	e4877fdceffd87cec166b266532a431e0d5e7644d950ce9566d2f14bc18be5e2.exe	WerFault.exe
PID 1516 wrote to memory of 2572	1516	e4877fdceffd87cec166b266532a431e0d5e7644d950ce9566d2f14bc18be5e2.exe	WerFault.exe
PID 1516 wrote to memory of 2572	1516	e4877fdceffd87cec166b266532a431e0d5e7644d950ce9566d2f14bc18be5e2.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\e4877fdceffd87cec166b266532a431e0d5e7644d950ce9566d2f14bc18be5e2.exe
"C:\Users\Admin\AppData\Local\Temp\e4877fdceffd87cec166b266532a431e0d5e7644d950ce9566d2f14bc18be5e2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 556
  2⤵
  - Program crash
  PID:2572

memory/1516-0-0x00000000743EE000-0x00000000743EF000-memory.dmp

Filesize
4KB

Download
memory/1516-1-0x00000000010A0000-0x00000000013A2000-memory.dmp

Filesize
3.0MB

Download