zgrat | 6be34ab39be9bb7a8848a364ac569a52a1fc88f32b7b320914d088349503e04d

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-11-2024 21:01

Target

6be34ab39be9bb7a8848a364ac569a52a1fc88f32b7b320914d088349503e04d.exe
Size

2.9MB
MD5

4f3afa4ebcfb6d2858cb41e9a23fecef
SHA1

c657e3b256305a6d19732e2b03500b87edf4d197
SHA256

6be34ab39be9bb7a8848a364ac569a52a1fc88f32b7b320914d088349503e04d
SHA512

7dce3cfb3090804954b51512595a247a77bd8e0e2747ea5919dc4adbfb9bf24e1b3ac0cb791f9da5013ae4110e4c4d3826d042a41db2eafaf1d67edcbf9ee827
SSDEEP

49152:Zcz8/yyeht4leTJK0cKbohAulPaPu0ID:WFjJQKbohpa/

Score

10^/10

zgrat rat

Detect ZGRat V2 1 IoCs

resource	yara_rule
behavioral1/memory/2424-1-0x0000000000A80000-0x0000000000D78000-memory.dmp	family_zgrat_v2

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 2480	2424	6be34ab39be9bb7a8848a364ac569a52a1fc88f32b7b320914d088349503e04d.exe	30
PID 2424 wrote to memory of 2480	2424	6be34ab39be9bb7a8848a364ac569a52a1fc88f32b7b320914d088349503e04d.exe	30
PID 2424 wrote to memory of 2480	2424	6be34ab39be9bb7a8848a364ac569a52a1fc88f32b7b320914d088349503e04d.exe	30

C:\Users\Admin\AppData\Local\Temp\6be34ab39be9bb7a8848a364ac569a52a1fc88f32b7b320914d088349503e04d.exe
"C:\Users\Admin\AppData\Local\Temp\6be34ab39be9bb7a8848a364ac569a52a1fc88f32b7b320914d088349503e04d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2424 -s 492
  2⤵
  PID:2480

memory/2424-0-0x000007FEF5833000-0x000007FEF5834000-memory.dmp

Filesize
4KB

Download
memory/2424-1-0x0000000000A80000-0x0000000000D78000-memory.dmp

Filesize
3.0MB

Download