zgrat | 128d2cc43031cf39f048f0121ec0e822b0428afbab703b0a9457cca9fc8325d3

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 00:23

Target

43c1fa37a457ffd874f0a9436454ebe0_JaffaCakes118.exe
Size

822KB
MD5

43c1fa37a457ffd874f0a9436454ebe0
SHA1

ad1fd83082b611467ddc7ecccb00c5166514f3e0
SHA256

128d2cc43031cf39f048f0121ec0e822b0428afbab703b0a9457cca9fc8325d3
SHA512

6be7fe107fe6130f88853ce5e95779f53c8d5741958e7b24dae3768d3c2132ef3be4c943b7a4fcbd8b45fee00b1f71920e047687b33802646d556b11d373e195
SSDEEP

6144:/vpIKl0eyoPbDIC/rMlXSWOUN0LwGodiCj1DSdj/4KngWIq6jRkoQ6o://QqnIMrO70LBeSKKngWIjLBo

Score

10^/10

zgrat rat

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral1/memory/1740-3-0x00000000005C0000-0x00000000005E0000-memory.dmp	family_zgrat_v1

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2832	1740	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1740	43c1fa37a457ffd874f0a9436454ebe0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2832	1740	43c1fa37a457ffd874f0a9436454ebe0_JaffaCakes118.exe	28
PID 1740 wrote to memory of 2832	1740	43c1fa37a457ffd874f0a9436454ebe0_JaffaCakes118.exe	28
PID 1740 wrote to memory of 2832	1740	43c1fa37a457ffd874f0a9436454ebe0_JaffaCakes118.exe	28
PID 1740 wrote to memory of 2832	1740	43c1fa37a457ffd874f0a9436454ebe0_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\43c1fa37a457ffd874f0a9436454ebe0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\43c1fa37a457ffd874f0a9436454ebe0_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 764
  2⤵
  - Program crash
  PID:2832

memory/1740-0-0x000000007450E000-0x000000007450F000-memory.dmp

Filesize
4KB

Download
memory/1740-1-0x0000000000E40000-0x0000000000F14000-memory.dmp

Filesize
848KB

Download
memory/1740-2-0x0000000074500000-0x0000000074BEE000-memory.dmp

Filesize
6.9MB

Download
memory/1740-3-0x00000000005C0000-0x00000000005E0000-memory.dmp

Filesize
128KB

Download
memory/1740-4-0x000000007450E000-0x000000007450F000-memory.dmp

Filesize
4KB

Download
memory/1740-5-0x0000000074500000-0x0000000074BEE000-memory.dmp

Filesize
6.9MB

Download