Analysis
-
max time kernel
117s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
15-05-2024 11:31
General
-
Target
289f6f9ac9be76afbc2095c074f9bc1df0f363a41a2c060e43bc4399b07be601.exe
-
Size
17.0MB
-
MD5
4513a8a4d873ecdf897eb4a6e58b60aa
-
SHA1
7c5c250bff72daf1e78e01513cdefbc719b2c072
-
SHA256
289f6f9ac9be76afbc2095c074f9bc1df0f363a41a2c060e43bc4399b07be601
-
SHA512
22f162c4e32eb87f548c8cf33c85a9f278795ef8641b7a7683b567597636583af9fd7534268733e293c8765899fdc05bba4fecc5e121b828973c4474ac2de8d8
-
SSDEEP
98304:m+BWlGe5U59RGSfAbGUbH3JD0oVAzrbOJrdRynivn/fiKyANoJL00GWHkPiXSwr1:+Ge+cBzi1t9GWEPiXXrW8qPax
Score
10/10
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\289f6f9ac9be76afbc2095c074f9bc1df0f363a41a2c060e43bc4399b07be601.exe"C:\Users\Admin\AppData\Local\Temp\289f6f9ac9be76afbc2095c074f9bc1df0f363a41a2c060e43bc4399b07be601.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1732 -s 5402⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1732-0-0x000007FEF5D33000-0x000007FEF5D34000-memory.dmpFilesize
4KB
-
memory/1732-1-0x0000000000290000-0x0000000001388000-memory.dmpFilesize
17.0MB
-
memory/1732-2-0x000007FEF5D33000-0x000007FEF5D34000-memory.dmpFilesize
4KB