zgrat | 289f6f9ac9be76afbc2095c074f9bc1df0f363a41a2c060e43bc4399b07be601

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 07:19

Target

4513a8a4d873ecdf897eb4a6e58b60aa_JaffaCakes118.exe
Size

17.0MB
MD5

4513a8a4d873ecdf897eb4a6e58b60aa
SHA1

7c5c250bff72daf1e78e01513cdefbc719b2c072
SHA256

289f6f9ac9be76afbc2095c074f9bc1df0f363a41a2c060e43bc4399b07be601
SHA512

22f162c4e32eb87f548c8cf33c85a9f278795ef8641b7a7683b567597636583af9fd7534268733e293c8765899fdc05bba4fecc5e121b828973c4474ac2de8d8
SSDEEP

98304:m+BWlGe5U59RGSfAbGUbH3JD0oVAzrbOJrdRynivn/fiKyANoJL00GWHkPiXSwr1:+Ge+cBzi1t9GWEPiXXrW8qPax

Score

10^/10

zgrat rat

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral1/memory/2256-1-0x0000000001320000-0x0000000002418000-memory.dmp	family_zgrat_v1

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2796	2256	4513a8a4d873ecdf897eb4a6e58b60aa_JaffaCakes118.exe	28
PID 2256 wrote to memory of 2796	2256	4513a8a4d873ecdf897eb4a6e58b60aa_JaffaCakes118.exe	28
PID 2256 wrote to memory of 2796	2256	4513a8a4d873ecdf897eb4a6e58b60aa_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\4513a8a4d873ecdf897eb4a6e58b60aa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4513a8a4d873ecdf897eb4a6e58b60aa_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2256 -s 532
  2⤵
  PID:2796

memory/2256-0-0x000007FEF5BD3000-0x000007FEF5BD4000-memory.dmp

Filesize
4KB

Download
memory/2256-1-0x0000000001320000-0x0000000002418000-memory.dmp

Filesize
17.0MB

Download
memory/2256-2-0x000007FEF5BD3000-0x000007FEF5BD4000-memory.dmp

Filesize
4KB

Download