zgrat | 3f352445c521895812735acebb5f944cd1e88024cade5b201c562166619ffc9f

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 13:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f352445c521895812735acebb5f944cd1e88024cade5b201c562166619ffc9f.exe
Size

594KB
MD5

f5fe6435df7702338b1320b55f96caa4
SHA1

fab2bbc6e43cc01217673b2753e223099c3c297f
SHA256

3f352445c521895812735acebb5f944cd1e88024cade5b201c562166619ffc9f
SHA512

4c355979435dc7519c4e4ee1a9ff6ad4be9cabcaa6b376473b039fcd785837689f16662e680b196f2b74ec689ff894175a2892206f1883e6e22ca89a292a6fab
SSDEEP

12288:Ta+kA8UkbVvyhzR8OQtgR64Hh4oPRSviJFwuHnOr387dPex:FFgkh21gR3JSviJFbnOz87dPe

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2820-2-0x0000000000DB0000-0x0000000000E98000-memory.dmp	family_zgrat_v1
behavioral1/memory/2820-4-0x0000000000DB0000-0x0000000000E92000-memory.dmp	family_zgrat_v1
behavioral1/memory/2820-5-0x0000000000DB0000-0x0000000000E92000-memory.dmp	family_zgrat_v1
behavioral1/memory/2820-7-0x0000000000DB0000-0x0000000000E92000-memory.dmp	family_zgrat_v1
behavioral1/memory/2820-17-0x0000000000DB0000-0x0000000000E92000-memory.dmp	family_zgrat_v1
behavioral1/memory/2820-23-0x0000000000DB0000-0x0000000000E92000-memory.dmp	family_zgrat_v1
behavioral1/memory/2820-19-0x0000000000DB0000-0x0000000000E92000-memory.dmp	family_zgrat_v1
behavioral1/memory/2820-37-0x0000000000DB0000-0x0000000000E92000-memory.dmp	family_zgrat_v1
behavioral1/memory/2820-35-0x0000000000DB0000-0x0000000000E92000-memory.dmp	family_zgrat_v1
behavioral1/memory/2820-33-0x0000000000DB0000-0x0000000000E92000-memory.dmp	family_zgrat_v1
behavioral1/memory/2820-43-0x0000000000DB0000-0x0000000000E92000-memory.dmp	family_zgrat_v1
behavioral1/memory/2820-45-0x0000000000DB0000-0x0000000000E92000-memory.dmp	family_zgrat_v1
behavioral1/memory/2820-57-0x0000000000DB0000-0x0000000000E92000-memory.dmp	family_zgrat_v1
behavioral1/memory/2820-65-0x0000000000DB0000-0x0000000000E92000-memory.dmp	family_zgrat_v1
behavioral1/memory/2820-59-0x0000000000DB0000-0x0000000000E92000-memory.dmp	family_zgrat_v1
behavioral1/memory/2820-67-0x0000000000DB0000-0x0000000000E92000-memory.dmp	family_zgrat_v1
behavioral1/memory/2820-63-0x0000000000DB0000-0x0000000000E92000-memory.dmp	family_zgrat_v1
behavioral1/memory/2820-61-0x0000000000DB0000-0x0000000000E92000-memory.dmp	family_zgrat_v1
behavioral1/memory/2820-55-0x0000000000DB0000-0x0000000000E92000-memory.dmp	family_zgrat_v1
behavioral1/memory/2820-53-0x0000000000DB0000-0x0000000000E92000-memory.dmp	family_zgrat_v1
behavioral1/memory/2820-51-0x0000000000DB0000-0x0000000000E92000-memory.dmp	family_zgrat_v1
behavioral1/memory/2820-49-0x0000000000DB0000-0x0000000000E92000-memory.dmp	family_zgrat_v1
behavioral1/memory/2820-47-0x0000000000DB0000-0x0000000000E92000-memory.dmp	family_zgrat_v1
behavioral1/memory/2820-41-0x0000000000DB0000-0x0000000000E92000-memory.dmp	family_zgrat_v1
behavioral1/memory/2820-39-0x0000000000DB0000-0x0000000000E92000-memory.dmp	family_zgrat_v1
behavioral1/memory/2820-31-0x0000000000DB0000-0x0000000000E92000-memory.dmp	family_zgrat_v1
behavioral1/memory/2820-29-0x0000000000DB0000-0x0000000000E92000-memory.dmp	family_zgrat_v1
behavioral1/memory/2820-27-0x0000000000DB0000-0x0000000000E92000-memory.dmp	family_zgrat_v1
behavioral1/memory/2820-26-0x0000000000DB0000-0x0000000000E92000-memory.dmp	family_zgrat_v1
behavioral1/memory/2820-21-0x0000000000DB0000-0x0000000000E92000-memory.dmp	family_zgrat_v1
behavioral1/memory/2820-15-0x0000000000DB0000-0x0000000000E92000-memory.dmp	family_zgrat_v1
behavioral1/memory/2820-13-0x0000000000DB0000-0x0000000000E92000-memory.dmp	family_zgrat_v1
behavioral1/memory/2820-11-0x0000000000DB0000-0x0000000000E92000-memory.dmp	family_zgrat_v1
behavioral1/memory/2820-9-0x0000000000DB0000-0x0000000000E92000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Executes dropped EXE 1 IoCs

Processes:

TypeId.exe

pid	Process
8076	TypeId.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

TypeId.exe

description	pid	Process	procid_target
PID 8076 set thread context of 7620	8076	TypeId.exe	31

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

TypeId.exe

pid	Process
8076	TypeId.exe
8076	TypeId.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

3f352445c521895812735acebb5f944cd1e88024cade5b201c562166619ffc9f.exeTypeId.exeMSBuild.exe

description	pid	Process
Token: SeDebugPrivilege	2820	3f352445c521895812735acebb5f944cd1e88024cade5b201c562166619ffc9f.exe
Token: SeDebugPrivilege	8076	TypeId.exe
Token: SeDebugPrivilege	7620	MSBuild.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

taskeng.exeTypeId.exe

description	pid	Process	procid_target
PID 8044 wrote to memory of 8076	8044	taskeng.exe	30
PID 8044 wrote to memory of 8076	8044	taskeng.exe	30
PID 8044 wrote to memory of 8076	8044	taskeng.exe	30
PID 8044 wrote to memory of 8076	8044	taskeng.exe	30
PID 8076 wrote to memory of 7620	8076	TypeId.exe	31
PID 8076 wrote to memory of 7620	8076	TypeId.exe	31
PID 8076 wrote to memory of 7620	8076	TypeId.exe	31
PID 8076 wrote to memory of 7620	8076	TypeId.exe	31
PID 8076 wrote to memory of 7620	8076	TypeId.exe	31
PID 8076 wrote to memory of 7620	8076	TypeId.exe	31
PID 8076 wrote to memory of 7620	8076	TypeId.exe	31
PID 8076 wrote to memory of 7620	8076	TypeId.exe	31
PID 8076 wrote to memory of 7620	8076	TypeId.exe	31

C:\Users\Admin\AppData\Local\Temp\3f352445c521895812735acebb5f944cd1e88024cade5b201c562166619ffc9f.exe
"C:\Users\Admin\AppData\Local\Temp\3f352445c521895812735acebb5f944cd1e88024cade5b201c562166619ffc9f.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2820

C:\Windows\system32\taskeng.exe
taskeng.exe {3AA6B461-58AD-43D5-9262-288A6298D323} S-1-5-21-2721934792-624042501-2768869379-1000:BISMIZHX\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:8044
- C:\Users\Admin\AppData\Local\FrameworkDisplayName\uupkgqhj\TypeId.exe
  C:\Users\Admin\AppData\Local\FrameworkDisplayName\uupkgqhj\TypeId.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:8076
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:7620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\FrameworkDisplayName\uupkgqhj\TypeId.exe

Filesize
594KB

MD5
f5fe6435df7702338b1320b55f96caa4

SHA1
fab2bbc6e43cc01217673b2753e223099c3c297f

SHA256
3f352445c521895812735acebb5f944cd1e88024cade5b201c562166619ffc9f

SHA512
4c355979435dc7519c4e4ee1a9ff6ad4be9cabcaa6b376473b039fcd785837689f16662e680b196f2b74ec689ff894175a2892206f1883e6e22ca89a292a6fab

Download Submit
memory/2820-53-0x0000000000DB0000-0x0000000000E92000-memory.dmp

Filesize
904KB

Download
memory/2820-11-0x0000000000DB0000-0x0000000000E92000-memory.dmp

Filesize
904KB

Download
memory/2820-3-0x00000000748A0000-0x0000000074F8E000-memory.dmp

Filesize
6.9MB

Download
memory/2820-51-0x0000000000DB0000-0x0000000000E92000-memory.dmp

Filesize
904KB

Download
memory/2820-5-0x0000000000DB0000-0x0000000000E92000-memory.dmp

Filesize
904KB

Download
memory/2820-7-0x0000000000DB0000-0x0000000000E92000-memory.dmp

Filesize
904KB

Download
memory/2820-17-0x0000000000DB0000-0x0000000000E92000-memory.dmp

Filesize
904KB

Download
memory/2820-23-0x0000000000DB0000-0x0000000000E92000-memory.dmp

Filesize
904KB

Download
memory/2820-19-0x0000000000DB0000-0x0000000000E92000-memory.dmp

Filesize
904KB

Download
memory/2820-37-0x0000000000DB0000-0x0000000000E92000-memory.dmp

Filesize
904KB

Download
memory/2820-35-0x0000000000DB0000-0x0000000000E92000-memory.dmp

Filesize
904KB

Download
memory/2820-33-0x0000000000DB0000-0x0000000000E92000-memory.dmp

Filesize
904KB

Download
memory/2820-43-0x0000000000DB0000-0x0000000000E92000-memory.dmp

Filesize
904KB

Download
memory/2820-45-0x0000000000DB0000-0x0000000000E92000-memory.dmp

Filesize
904KB

Download
memory/2820-57-0x0000000000DB0000-0x0000000000E92000-memory.dmp

Filesize
904KB

Download
memory/2820-65-0x0000000000DB0000-0x0000000000E92000-memory.dmp

Filesize
904KB

Download
memory/2820-59-0x0000000000DB0000-0x0000000000E92000-memory.dmp

Filesize
904KB

Download
memory/2820-47-0x0000000000DB0000-0x0000000000E92000-memory.dmp

Filesize
904KB

Download
memory/2820-63-0x0000000000DB0000-0x0000000000E92000-memory.dmp

Filesize
904KB

Download
memory/2820-61-0x0000000000DB0000-0x0000000000E92000-memory.dmp

Filesize
904KB

Download
memory/2820-55-0x0000000000DB0000-0x0000000000E92000-memory.dmp

Filesize
904KB

Download
memory/2820-0-0x00000000748AE000-0x00000000748AF000-memory.dmp

Filesize
4KB

Download
memory/2820-4-0x0000000000DB0000-0x0000000000E92000-memory.dmp

Filesize
904KB

Download
memory/2820-49-0x0000000000DB0000-0x0000000000E92000-memory.dmp

Filesize
904KB

Download
memory/2820-67-0x0000000000DB0000-0x0000000000E92000-memory.dmp

Filesize
904KB

Download
memory/2820-41-0x0000000000DB0000-0x0000000000E92000-memory.dmp

Filesize
904KB

Download
memory/2820-39-0x0000000000DB0000-0x0000000000E92000-memory.dmp

Filesize
904KB

Download
memory/2820-31-0x0000000000DB0000-0x0000000000E92000-memory.dmp

Filesize
904KB

Download
memory/2820-29-0x0000000000DB0000-0x0000000000E92000-memory.dmp

Filesize
904KB

Download
memory/2820-27-0x0000000000DB0000-0x0000000000E92000-memory.dmp

Filesize
904KB

Download
memory/2820-26-0x0000000000DB0000-0x0000000000E92000-memory.dmp

Filesize
904KB

Download
memory/2820-21-0x0000000000DB0000-0x0000000000E92000-memory.dmp

Filesize
904KB

Download
memory/2820-15-0x0000000000DB0000-0x0000000000E92000-memory.dmp

Filesize
904KB

Download
memory/2820-13-0x0000000000DB0000-0x0000000000E92000-memory.dmp

Filesize
904KB

Download
memory/2820-2-0x0000000000DB0000-0x0000000000E98000-memory.dmp

Filesize
928KB

Download
memory/2820-9-0x0000000000DB0000-0x0000000000E92000-memory.dmp

Filesize
904KB

Download
memory/2820-2232-0x0000000000A80000-0x0000000000AD6000-memory.dmp

Filesize
344KB

Download
memory/2820-2233-0x00000000009F0000-0x0000000000A3C000-memory.dmp

Filesize
304KB

Download
memory/2820-2234-0x0000000004690000-0x00000000046E4000-memory.dmp

Filesize
336KB

Download
memory/2820-2236-0x00000000748A0000-0x0000000074F8E000-memory.dmp

Filesize
6.9MB

Download
memory/2820-1-0x0000000000F20000-0x0000000000FBA000-memory.dmp

Filesize
616KB

Download
memory/7620-4482-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/8076-2239-0x0000000000A50000-0x0000000000AEA000-memory.dmp

Filesize
616KB

Download
memory/8076-2240-0x00000000747E0000-0x00000000748D5000-memory.dmp

Filesize
980KB

Download
memory/8076-4481-0x00000000747E0000-0x00000000748D5000-memory.dmp

Filesize
980KB

Download