zgrat | e4877fdceffd87cec166b266532a431e0d5e7644d950ce9566d2f14bc18be5e2

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 15:27

Target

e4877fdceffd87cec166b266532a431e0d5e7644d950ce9566d2f14bc18be5e2.exe
Size

3.0MB
MD5

097a014e9066d6a4dd30e057e18eb511
SHA1

2baa37cdc9b69e4083fdf468240cbacb1f2851ae
SHA256

e4877fdceffd87cec166b266532a431e0d5e7644d950ce9566d2f14bc18be5e2
SHA512

3409f75f0d073146410ebf31f487626e0c5fc01abb962f56b673256e72981f3e4f5c063e6690feeff1b2937bd14b453c38823242c9dee9e607fe63888d9ad627
SSDEEP

49152:HzcK4Uk57r6mnw8fqFEIawGt2jlobG+FVSA7tffhpZ4F/3:HzvMWmnZSVawGtjHFVS8ffDZ4J

Score

10^/10

zgrat rat

Detect ZGRat V1 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1888-1-0x00000000001C0000-0x00000000004C2000-memory.dmp	family_zgrat_v1

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
behavioral1/memory/1888-1-0x00000000001C0000-0x00000000004C2000-memory.dmp	net_reactor

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
2520	1888	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

e4877fdceffd87cec166b266532a431e0d5e7644d950ce9566d2f14bc18be5e2.exe

description	pid	Process	procid_target
PID 1888 wrote to memory of 2520	1888	e4877fdceffd87cec166b266532a431e0d5e7644d950ce9566d2f14bc18be5e2.exe	28
PID 1888 wrote to memory of 2520	1888	e4877fdceffd87cec166b266532a431e0d5e7644d950ce9566d2f14bc18be5e2.exe	28
PID 1888 wrote to memory of 2520	1888	e4877fdceffd87cec166b266532a431e0d5e7644d950ce9566d2f14bc18be5e2.exe	28
PID 1888 wrote to memory of 2520	1888	e4877fdceffd87cec166b266532a431e0d5e7644d950ce9566d2f14bc18be5e2.exe	28

C:\Users\Admin\AppData\Local\Temp\e4877fdceffd87cec166b266532a431e0d5e7644d950ce9566d2f14bc18be5e2.exe
"C:\Users\Admin\AppData\Local\Temp\e4877fdceffd87cec166b266532a431e0d5e7644d950ce9566d2f14bc18be5e2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 556
  2⤵
  - Program crash
  PID:2520

memory/1888-0-0x000000007459E000-0x000000007459F000-memory.dmp

Filesize
4KB

Download
memory/1888-1-0x00000000001C0000-0x00000000004C2000-memory.dmp

Filesize
3.0MB

Download
memory/1888-2-0x000000007459E000-0x000000007459F000-memory.dmp

Filesize
4KB

Download