zgrat | 0a115cf0821cd01199c474d8b3a5211b06ee8adb894309d8110dad577e6e9117

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 17:45

Target

031f0b4bce3ba22d9e46cbeec1b73360_NeikiAnalytics.exe
Size

3.3MB
MD5

031f0b4bce3ba22d9e46cbeec1b73360
SHA1

4d6899fff97cff74a188c772aacfee3ea73731e6
SHA256

0a115cf0821cd01199c474d8b3a5211b06ee8adb894309d8110dad577e6e9117
SHA512

f1bd60f3989d56f7775956347f03e8b69f36f4424ecf6bdbb818c9cc4ac4f4ac16e32a21ff3a096acc1ea69f9b98126d42b582e9556ecec2503042b12217279f
SSDEEP

49152:B6Ee3j3piO4kHpKW4l4Gkdnx6KUnUa7ufJcbHpmqn8W42LQEKJWAOfraP:B6x3vZ4mGkz6KUr7ufJFiy60WAOfraP

Score

10^/10

zgrat rat

Detect ZGRat V1 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2036-1-0x0000000000830000-0x0000000000B76000-memory.dmp	family_zgrat_v1

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
behavioral1/memory/2036-1-0x0000000000830000-0x0000000000B76000-memory.dmp	net_reactor

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1704 2036 WerFault.exe 031f0b4bce3ba22d9e46cbeec1b73360_NeikiAnalytics.exe

pid	pid_target	process	target process
1704	2036	WerFault.exe	031f0b4bce3ba22d9e46cbeec1b73360_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

031f0b4bce3ba22d9e46cbeec1b73360_NeikiAnalytics.exe

description	pid	process	target process
PID 2036 wrote to memory of 1704	2036	031f0b4bce3ba22d9e46cbeec1b73360_NeikiAnalytics.exe	WerFault.exe
PID 2036 wrote to memory of 1704	2036	031f0b4bce3ba22d9e46cbeec1b73360_NeikiAnalytics.exe	WerFault.exe
PID 2036 wrote to memory of 1704	2036	031f0b4bce3ba22d9e46cbeec1b73360_NeikiAnalytics.exe	WerFault.exe
PID 2036 wrote to memory of 1704	2036	031f0b4bce3ba22d9e46cbeec1b73360_NeikiAnalytics.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\031f0b4bce3ba22d9e46cbeec1b73360_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\031f0b4bce3ba22d9e46cbeec1b73360_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 564
2⤵
- Program crash
PID:1704

memory/2036-0-0x000000007488E000-0x000000007488F000-memory.dmp

Filesize
4KB

Download
memory/2036-1-0x0000000000830000-0x0000000000B76000-memory.dmp

Filesize
3.3MB

Download