zgrat | e9183318e44ed216bcec42257ecd6b684dd29d3329aef09ba5571f56d43f3e5c

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-01-2025 20:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e9183318e44ed216bcec42257ecd6b684dd29d3329aef09ba5571f56d43f3e5c.exe
Size

1.9MB
MD5

809f67d7c58057637326a47e5471c2be
SHA1

586ce6b893c5af03e05c4bcf58c1ca4847e49d0f
SHA256

e9183318e44ed216bcec42257ecd6b684dd29d3329aef09ba5571f56d43f3e5c
SHA512

39f2a995e8ed7098d796faebcab7da7b488f72bdff051401e4a4d54f64b66d97e28f3de6133006c4928d82a9791714408a176daf39df78f7e6e8ccd59ec093f7
SSDEEP

24576:5X92LnLUrHpRfZDx41Ft8RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRW:5XuwriD3nYVgr8pSQwXmyytoi3

Score

10^/10

zgrat discovery rat

Malware Config

Signatures

Detect ZGRat V2 2 IoCs

resource	yara_rule
behavioral1/memory/1992-1-0x0000000001300000-0x00000000014E8000-memory.dmp	family_zgrat_v2
behavioral1/memory/1992-3-0x0000000001150000-0x000000000122C000-memory.dmp	family_zgrat_v2

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Zgrat family
zgrat

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e9183318e44ed216bcec42257ecd6b684dd29d3329aef09ba5571f56d43f3e5c.exe

C:\Users\Admin\AppData\Local\Temp\e9183318e44ed216bcec42257ecd6b684dd29d3329aef09ba5571f56d43f3e5c.exe
"C:\Users\Admin\AppData\Local\Temp\e9183318e44ed216bcec42257ecd6b684dd29d3329aef09ba5571f56d43f3e5c.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1992-0-0x000000007466E000-0x000000007466F000-memory.dmp

Filesize
4KB

Download
memory/1992-1-0x0000000001300000-0x00000000014E8000-memory.dmp

Filesize
1.9MB

Download
memory/1992-2-0x0000000074660000-0x0000000074D4E000-memory.dmp

Filesize
6.9MB

Download
memory/1992-3-0x0000000001150000-0x000000000122C000-memory.dmp

Filesize
880KB

Download
memory/1992-4-0x00000000006C0000-0x00000000006EC000-memory.dmp

Filesize
176KB

Download
memory/1992-5-0x0000000074660000-0x0000000074D4E000-memory.dmp

Filesize
6.9MB

Download