zgrat | 3f352445c521895812735acebb5f944cd1e88024cade5b201c562166619ffc9f

Analysis

max time kernel
93s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2024 13:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f352445c521895812735acebb5f944cd1e88024cade5b201c562166619ffc9f.exe
Size

594KB
MD5

f5fe6435df7702338b1320b55f96caa4
SHA1

fab2bbc6e43cc01217673b2753e223099c3c297f
SHA256

3f352445c521895812735acebb5f944cd1e88024cade5b201c562166619ffc9f
SHA512

4c355979435dc7519c4e4ee1a9ff6ad4be9cabcaa6b376473b039fcd785837689f16662e680b196f2b74ec689ff894175a2892206f1883e6e22ca89a292a6fab
SSDEEP

12288:Ta+kA8UkbVvyhzR8OQtgR64Hh4oPRSviJFwuHnOr387dPex:FFgkh21gR3JSviJFbnOz87dPe

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5036-2-0x0000000004B50000-0x0000000004C38000-memory.dmp	family_zgrat_v1
behavioral2/memory/5036-41-0x0000000004B50000-0x0000000004C32000-memory.dmp	family_zgrat_v1
behavioral2/memory/5036-4-0x0000000004B50000-0x0000000004C32000-memory.dmp	family_zgrat_v1
behavioral2/memory/5036-29-0x0000000004B50000-0x0000000004C32000-memory.dmp	family_zgrat_v1
behavioral2/memory/5036-25-0x0000000004B50000-0x0000000004C32000-memory.dmp	family_zgrat_v1
behavioral2/memory/5036-23-0x0000000004B50000-0x0000000004C32000-memory.dmp	family_zgrat_v1
behavioral2/memory/5036-21-0x0000000004B50000-0x0000000004C32000-memory.dmp	family_zgrat_v1
behavioral2/memory/5036-15-0x0000000004B50000-0x0000000004C32000-memory.dmp	family_zgrat_v1
behavioral2/memory/5036-11-0x0000000004B50000-0x0000000004C32000-memory.dmp	family_zgrat_v1
behavioral2/memory/5036-9-0x0000000004B50000-0x0000000004C32000-memory.dmp	family_zgrat_v1
behavioral2/memory/5036-43-0x0000000004B50000-0x0000000004C32000-memory.dmp	family_zgrat_v1
behavioral2/memory/5036-68-0x0000000004B50000-0x0000000004C32000-memory.dmp	family_zgrat_v1
behavioral2/memory/5036-65-0x0000000004B50000-0x0000000004C32000-memory.dmp	family_zgrat_v1
behavioral2/memory/5036-63-0x0000000004B50000-0x0000000004C32000-memory.dmp	family_zgrat_v1
behavioral2/memory/5036-61-0x0000000004B50000-0x0000000004C32000-memory.dmp	family_zgrat_v1
behavioral2/memory/5036-59-0x0000000004B50000-0x0000000004C32000-memory.dmp	family_zgrat_v1
behavioral2/memory/5036-57-0x0000000004B50000-0x0000000004C32000-memory.dmp	family_zgrat_v1
behavioral2/memory/5036-53-0x0000000004B50000-0x0000000004C32000-memory.dmp	family_zgrat_v1
behavioral2/memory/5036-51-0x0000000004B50000-0x0000000004C32000-memory.dmp	family_zgrat_v1
behavioral2/memory/5036-49-0x0000000004B50000-0x0000000004C32000-memory.dmp	family_zgrat_v1
behavioral2/memory/5036-47-0x0000000004B50000-0x0000000004C32000-memory.dmp	family_zgrat_v1
behavioral2/memory/5036-45-0x0000000004B50000-0x0000000004C32000-memory.dmp	family_zgrat_v1
behavioral2/memory/5036-39-0x0000000004B50000-0x0000000004C32000-memory.dmp	family_zgrat_v1
behavioral2/memory/5036-37-0x0000000004B50000-0x0000000004C32000-memory.dmp	family_zgrat_v1
behavioral2/memory/5036-35-0x0000000004B50000-0x0000000004C32000-memory.dmp	family_zgrat_v1
behavioral2/memory/5036-33-0x0000000004B50000-0x0000000004C32000-memory.dmp	family_zgrat_v1
behavioral2/memory/5036-31-0x0000000004B50000-0x0000000004C32000-memory.dmp	family_zgrat_v1
behavioral2/memory/5036-27-0x0000000004B50000-0x0000000004C32000-memory.dmp	family_zgrat_v1
behavioral2/memory/5036-19-0x0000000004B50000-0x0000000004C32000-memory.dmp	family_zgrat_v1
behavioral2/memory/5036-17-0x0000000004B50000-0x0000000004C32000-memory.dmp	family_zgrat_v1
behavioral2/memory/5036-13-0x0000000004B50000-0x0000000004C32000-memory.dmp	family_zgrat_v1
behavioral2/memory/5036-7-0x0000000004B50000-0x0000000004C32000-memory.dmp	family_zgrat_v1
behavioral2/memory/5036-55-0x0000000004B50000-0x0000000004C32000-memory.dmp	family_zgrat_v1
behavioral2/memory/5036-5-0x0000000004B50000-0x0000000004C32000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Executes dropped EXE 1 IoCs

Processes:

TypeId.exe

pid process

1296 TypeId.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

TypeId.exe

description pid process target process

PID 1296 set thread context of 3312 1296 TypeId.exe MSBuild.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

TypeId.exe

pid process

1296 TypeId.exe
1296 TypeId.exe

pid	process
1296	TypeId.exe

description	pid	process	target process
PID 1296 set thread context of 3312	1296	TypeId.exe	MSBuild.exe

pid	process
1296	TypeId.exe
1296	TypeId.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

3f352445c521895812735acebb5f944cd1e88024cade5b201c562166619ffc9f.exeTypeId.exeMSBuild.exe

description	pid	process
Token: SeDebugPrivilege	5036	3f352445c521895812735acebb5f944cd1e88024cade5b201c562166619ffc9f.exe
Token: SeDebugPrivilege	1296	TypeId.exe
Token: SeDebugPrivilege	3312	MSBuild.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

TypeId.exe

description	pid	process	target process
PID 1296 wrote to memory of 3312	1296	TypeId.exe	MSBuild.exe
PID 1296 wrote to memory of 3312	1296	TypeId.exe	MSBuild.exe
PID 1296 wrote to memory of 3312	1296	TypeId.exe	MSBuild.exe
PID 1296 wrote to memory of 3312	1296	TypeId.exe	MSBuild.exe
PID 1296 wrote to memory of 3312	1296	TypeId.exe	MSBuild.exe
PID 1296 wrote to memory of 3312	1296	TypeId.exe	MSBuild.exe
PID 1296 wrote to memory of 3312	1296	TypeId.exe	MSBuild.exe
PID 1296 wrote to memory of 3312	1296	TypeId.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\3f352445c521895812735acebb5f944cd1e88024cade5b201c562166619ffc9f.exe
"C:\Users\Admin\AppData\Local\Temp\3f352445c521895812735acebb5f944cd1e88024cade5b201c562166619ffc9f.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5036

C:\Users\Admin\AppData\Local\FrameworkDisplayName\refoadu\TypeId.exe
C:\Users\Admin\AppData\Local\FrameworkDisplayName\refoadu\TypeId.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\FrameworkDisplayName\refoadu\TypeId.exe

Filesize
594KB

MD5
f5fe6435df7702338b1320b55f96caa4

SHA1
fab2bbc6e43cc01217673b2753e223099c3c297f

SHA256
3f352445c521895812735acebb5f944cd1e88024cade5b201c562166619ffc9f

SHA512
4c355979435dc7519c4e4ee1a9ff6ad4be9cabcaa6b376473b039fcd785837689f16662e680b196f2b74ec689ff894175a2892206f1883e6e22ca89a292a6fab

Download Submit
memory/1296-4474-0x0000000074770000-0x0000000074F20000-memory.dmp

Filesize
7.7MB

Download
memory/1296-2241-0x0000000074770000-0x0000000074F20000-memory.dmp

Filesize
7.7MB

Download
memory/3312-6703-0x0000000074770000-0x0000000074F20000-memory.dmp

Filesize
7.7MB

Download
memory/3312-4472-0x0000000074770000-0x0000000074F20000-memory.dmp

Filesize
7.7MB

Download
memory/3312-4471-0x0000000074770000-0x0000000074F20000-memory.dmp

Filesize
7.7MB

Download
memory/5036-45-0x0000000004B50000-0x0000000004C32000-memory.dmp

Filesize
904KB

Download
memory/5036-35-0x0000000004B50000-0x0000000004C32000-memory.dmp

Filesize
904KB

Download
memory/5036-23-0x0000000004B50000-0x0000000004C32000-memory.dmp

Filesize
904KB

Download
memory/5036-21-0x0000000004B50000-0x0000000004C32000-memory.dmp

Filesize
904KB

Download
memory/5036-15-0x0000000004B50000-0x0000000004C32000-memory.dmp

Filesize
904KB

Download
memory/5036-11-0x0000000004B50000-0x0000000004C32000-memory.dmp

Filesize
904KB

Download
memory/5036-9-0x0000000004B50000-0x0000000004C32000-memory.dmp

Filesize
904KB

Download
memory/5036-43-0x0000000004B50000-0x0000000004C32000-memory.dmp

Filesize
904KB

Download
memory/5036-68-0x0000000004B50000-0x0000000004C32000-memory.dmp

Filesize
904KB

Download
memory/5036-65-0x0000000004B50000-0x0000000004C32000-memory.dmp

Filesize
904KB

Download
memory/5036-63-0x0000000004B50000-0x0000000004C32000-memory.dmp

Filesize
904KB

Download
memory/5036-61-0x0000000004B50000-0x0000000004C32000-memory.dmp

Filesize
904KB

Download
memory/5036-59-0x0000000004B50000-0x0000000004C32000-memory.dmp

Filesize
904KB

Download
memory/5036-57-0x0000000004B50000-0x0000000004C32000-memory.dmp

Filesize
904KB

Download
memory/5036-53-0x0000000004B50000-0x0000000004C32000-memory.dmp

Filesize
904KB

Download
memory/5036-51-0x0000000004B50000-0x0000000004C32000-memory.dmp

Filesize
904KB

Download
memory/5036-49-0x0000000004B50000-0x0000000004C32000-memory.dmp

Filesize
904KB

Download
memory/5036-47-0x0000000004B50000-0x0000000004C32000-memory.dmp

Filesize
904KB

Download
memory/5036-0-0x000000007477E000-0x000000007477F000-memory.dmp

Filesize
4KB

Download
memory/5036-39-0x0000000004B50000-0x0000000004C32000-memory.dmp

Filesize
904KB

Download
memory/5036-37-0x0000000004B50000-0x0000000004C32000-memory.dmp

Filesize
904KB

Download
memory/5036-25-0x0000000004B50000-0x0000000004C32000-memory.dmp

Filesize
904KB

Download
memory/5036-33-0x0000000004B50000-0x0000000004C32000-memory.dmp

Filesize
904KB

Download
memory/5036-31-0x0000000004B50000-0x0000000004C32000-memory.dmp

Filesize
904KB

Download
memory/5036-27-0x0000000004B50000-0x0000000004C32000-memory.dmp

Filesize
904KB

Download
memory/5036-19-0x0000000004B50000-0x0000000004C32000-memory.dmp

Filesize
904KB

Download
memory/5036-17-0x0000000004B50000-0x0000000004C32000-memory.dmp

Filesize
904KB

Download
memory/5036-13-0x0000000004B50000-0x0000000004C32000-memory.dmp

Filesize
904KB

Download
memory/5036-7-0x0000000004B50000-0x0000000004C32000-memory.dmp

Filesize
904KB

Download
memory/5036-55-0x0000000004B50000-0x0000000004C32000-memory.dmp

Filesize
904KB

Download
memory/5036-5-0x0000000004B50000-0x0000000004C32000-memory.dmp

Filesize
904KB

Download
memory/5036-2232-0x0000000004C40000-0x0000000004C96000-memory.dmp

Filesize
344KB

Download
memory/5036-2233-0x0000000004CA0000-0x0000000004CEC000-memory.dmp

Filesize
304KB

Download
memory/5036-2234-0x0000000004E70000-0x0000000004ED6000-memory.dmp

Filesize
408KB

Download
memory/5036-2235-0x0000000005290000-0x00000000052E4000-memory.dmp

Filesize
336KB

Download
memory/5036-2238-0x0000000074770000-0x0000000074F20000-memory.dmp

Filesize
7.7MB

Download
memory/5036-29-0x0000000004B50000-0x0000000004C32000-memory.dmp

Filesize
904KB

Download
memory/5036-4-0x0000000004B50000-0x0000000004C32000-memory.dmp

Filesize
904KB

Download
memory/5036-41-0x0000000004B50000-0x0000000004C32000-memory.dmp

Filesize
904KB

Download
memory/5036-3-0x0000000074770000-0x0000000074F20000-memory.dmp

Filesize
7.7MB

Download
memory/5036-2-0x0000000004B50000-0x0000000004C38000-memory.dmp

Filesize
928KB

Download
memory/5036-1-0x0000000000080000-0x000000000011A000-memory.dmp

Filesize
616KB

Download