zgrat | b31b8c325cb1e7f17c8c9a3a6e4819c8a648f96f3321d3be8a34338bb1cfb003

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
16-07-2024 03:36

Target

b31b8c325cb1e7f17c8c9a3a6e4819c8a648f96f3321d3be8a34338bb1cfb003.exe
Size

1.7MB
MD5

eadf8053419b068360582c3664c43ca0
SHA1

6040f88934a798772ff94ae36a0d14eba165f671
SHA256

b31b8c325cb1e7f17c8c9a3a6e4819c8a648f96f3321d3be8a34338bb1cfb003
SHA512

b97e2f5db2562282e9407ecf159c21c385e0ad090691fff0aacb4de490ccd749e8a157d0ceaf14680b58fd3410adb4ba8e6761a4be5bdbc0dee249f47ddd2c7a
SSDEEP

24576:6HaL2LnLUrHpRfZDx41Ft8RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRw:6jGheyJZmQOkoWx

Score

10^/10

zgrat rat

Detect ZGRat V2 2 IoCs

resource	yara_rule
behavioral1/memory/1964-1-0x0000000000180000-0x0000000000346000-memory.dmp	family_zgrat_v2
behavioral1/memory/1964-3-0x000000001B220000-0x000000001B2FC000-memory.dmp	family_zgrat_v2

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2756	1964	b31b8c325cb1e7f17c8c9a3a6e4819c8a648f96f3321d3be8a34338bb1cfb003.exe	31
PID 1964 wrote to memory of 2756	1964	b31b8c325cb1e7f17c8c9a3a6e4819c8a648f96f3321d3be8a34338bb1cfb003.exe	31
PID 1964 wrote to memory of 2756	1964	b31b8c325cb1e7f17c8c9a3a6e4819c8a648f96f3321d3be8a34338bb1cfb003.exe	31

C:\Users\Admin\AppData\Local\Temp\b31b8c325cb1e7f17c8c9a3a6e4819c8a648f96f3321d3be8a34338bb1cfb003.exe
"C:\Users\Admin\AppData\Local\Temp\b31b8c325cb1e7f17c8c9a3a6e4819c8a648f96f3321d3be8a34338bb1cfb003.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1964 -s 984
  2⤵
  PID:2756

memory/1964-0-0x000007FEF5793000-0x000007FEF5794000-memory.dmp

Filesize
4KB

Download
memory/1964-1-0x0000000000180000-0x0000000000346000-memory.dmp

Filesize
1.8MB

Download
memory/1964-2-0x000007FEF5790000-0x000007FEF617C000-memory.dmp

Filesize
9.9MB

Download
memory/1964-3-0x000000001B220000-0x000000001B2FC000-memory.dmp

Filesize
880KB

Download
memory/1964-4-0x0000000000600000-0x000000000062C000-memory.dmp

Filesize
176KB

Download
memory/1964-5-0x000007FEF5793000-0x000007FEF5794000-memory.dmp

Filesize
4KB

Download
memory/1964-6-0x000007FEF5790000-0x000007FEF617C000-memory.dmp

Filesize
9.9MB

Download