zgrat | 2344272e4dab35c035fa4d8c20a52b3331999b265345680441cdb1c2ec88d22a

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04-06-2024 19:38

Target

2344272e4dab35c035fa4d8c20a52b3331999b265345680441cdb1c2ec88d22a.exe
Size

1.5MB
MD5

c40b32804d79dacc4e6418764858d598
SHA1

fd0601fdcd37d613dcde77597d0071796745e384
SHA256

2344272e4dab35c035fa4d8c20a52b3331999b265345680441cdb1c2ec88d22a
SHA512

fdb7e12f378bac286766e5248e6d5ac1bdf37e1e4a781a77ee19fb8d0b1332ad7529eead5ae634970c010ec38513de5e5c3999e9e147769f996195063956d608
SSDEEP

24576:TU7RLteKMYtgTJAnhDawBeruSSpuyIxv+SVYte:47htestgJyZayeGpTIxGte

Score

10^/10

zgrat rat

Detect ZGRat V2 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2984-1-0x0000000000F30000-0x00000000010BE000-memory.dmp	family_zgrat_v2
behavioral1/memory/2984-3-0x000000001AE40000-0x000000001AF1C000-memory.dmp	family_zgrat_v2

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2344272e4dab35c035fa4d8c20a52b3331999b265345680441cdb1c2ec88d22a.exe

description	pid	process	target process
PID 2984 wrote to memory of 2724	2984	2344272e4dab35c035fa4d8c20a52b3331999b265345680441cdb1c2ec88d22a.exe	WerFault.exe
PID 2984 wrote to memory of 2724	2984	2344272e4dab35c035fa4d8c20a52b3331999b265345680441cdb1c2ec88d22a.exe	WerFault.exe
PID 2984 wrote to memory of 2724	2984	2344272e4dab35c035fa4d8c20a52b3331999b265345680441cdb1c2ec88d22a.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2344272e4dab35c035fa4d8c20a52b3331999b265345680441cdb1c2ec88d22a.exe
"C:\Users\Admin\AppData\Local\Temp\2344272e4dab35c035fa4d8c20a52b3331999b265345680441cdb1c2ec88d22a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2984

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2984 -s 976
2⤵
PID:2724

memory/2984-0-0x000007FEF55D3000-0x000007FEF55D4000-memory.dmp

Filesize
4KB

Download
memory/2984-1-0x0000000000F30000-0x00000000010BE000-memory.dmp

Filesize
1.6MB

Download
memory/2984-2-0x000007FEF55D0000-0x000007FEF5FBC000-memory.dmp

Filesize
9.9MB

Download
memory/2984-3-0x000000001AE40000-0x000000001AF1C000-memory.dmp

Filesize
880KB

Download
memory/2984-4-0x0000000000170000-0x000000000019C000-memory.dmp

Filesize
176KB

Download
memory/2984-5-0x000007FEF55D3000-0x000007FEF55D4000-memory.dmp

Filesize
4KB

Download
memory/2984-6-0x000007FEF55D0000-0x000007FEF5FBC000-memory.dmp

Filesize
9.9MB

Download