zgrat | cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169

Analysis

max time kernel
146s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
14-05-2024 23:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe
Size

4.5MB
MD5

133fda00a490e613f3a6c511c1c660eb
SHA1

e34f9f1c622a7e6d3cb34217b0935ebdaab8ebe9
SHA256

cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169
SHA512

f4dd02b04326e37a3368d9c385b363689f877ae43c16de103efada642f41fe85580939db84a030597e3032d6da407d073af2b64160feec6fe38f37f1b473fffd
SSDEEP

24576:ypPiRcjGOOiX3Sl9L7MupXdagdle6whTeo5A4T9W+xjaCsyfwUmvHX+ODvz8JQDm:

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2040-2-0x0000000006740000-0x0000000006980000-memory.dmp	family_zgrat_v1
behavioral2/memory/2040-12-0x0000000006740000-0x000000000697A000-memory.dmp	family_zgrat_v1
behavioral2/memory/2040-16-0x0000000006740000-0x000000000697A000-memory.dmp	family_zgrat_v1
behavioral2/memory/2040-18-0x0000000006740000-0x000000000697A000-memory.dmp	family_zgrat_v1
behavioral2/memory/2040-14-0x0000000006740000-0x000000000697A000-memory.dmp	family_zgrat_v1
behavioral2/memory/2040-34-0x0000000006740000-0x000000000697A000-memory.dmp	family_zgrat_v1
behavioral2/memory/2040-36-0x0000000006740000-0x000000000697A000-memory.dmp	family_zgrat_v1
behavioral2/memory/2040-44-0x0000000006740000-0x000000000697A000-memory.dmp	family_zgrat_v1
behavioral2/memory/2040-60-0x0000000006740000-0x000000000697A000-memory.dmp	family_zgrat_v1
behavioral2/memory/2040-69-0x0000000006740000-0x000000000697A000-memory.dmp	family_zgrat_v1
behavioral2/memory/2040-66-0x0000000006740000-0x000000000697A000-memory.dmp	family_zgrat_v1
behavioral2/memory/2040-64-0x0000000006740000-0x000000000697A000-memory.dmp	family_zgrat_v1
behavioral2/memory/2040-62-0x0000000006740000-0x000000000697A000-memory.dmp	family_zgrat_v1
behavioral2/memory/2040-58-0x0000000006740000-0x000000000697A000-memory.dmp	family_zgrat_v1
behavioral2/memory/2040-56-0x0000000006740000-0x000000000697A000-memory.dmp	family_zgrat_v1
behavioral2/memory/2040-54-0x0000000006740000-0x000000000697A000-memory.dmp	family_zgrat_v1
behavioral2/memory/2040-52-0x0000000006740000-0x000000000697A000-memory.dmp	family_zgrat_v1
behavioral2/memory/2040-50-0x0000000006740000-0x000000000697A000-memory.dmp	family_zgrat_v1
behavioral2/memory/2040-48-0x0000000006740000-0x000000000697A000-memory.dmp	family_zgrat_v1
behavioral2/memory/2040-46-0x0000000006740000-0x000000000697A000-memory.dmp	family_zgrat_v1
behavioral2/memory/2040-43-0x0000000006740000-0x000000000697A000-memory.dmp	family_zgrat_v1
behavioral2/memory/2040-30-0x0000000006740000-0x000000000697A000-memory.dmp	family_zgrat_v1
behavioral2/memory/2040-26-0x0000000006740000-0x000000000697A000-memory.dmp	family_zgrat_v1
behavioral2/memory/2040-24-0x0000000006740000-0x000000000697A000-memory.dmp	family_zgrat_v1
behavioral2/memory/2040-39-0x0000000006740000-0x000000000697A000-memory.dmp	family_zgrat_v1
behavioral2/memory/2040-40-0x0000000006740000-0x000000000697A000-memory.dmp	family_zgrat_v1
behavioral2/memory/2040-32-0x0000000006740000-0x000000000697A000-memory.dmp	family_zgrat_v1
behavioral2/memory/2040-28-0x0000000006740000-0x000000000697A000-memory.dmp	family_zgrat_v1
behavioral2/memory/2040-10-0x0000000006740000-0x000000000697A000-memory.dmp	family_zgrat_v1
behavioral2/memory/2040-8-0x0000000006740000-0x000000000697A000-memory.dmp	family_zgrat_v1
behavioral2/memory/2040-22-0x0000000006740000-0x000000000697A000-memory.dmp	family_zgrat_v1
behavioral2/memory/2040-20-0x0000000006740000-0x000000000697A000-memory.dmp	family_zgrat_v1
behavioral2/memory/2040-6-0x0000000006740000-0x000000000697A000-memory.dmp	family_zgrat_v1
behavioral2/memory/2040-5-0x0000000006740000-0x000000000697A000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Drops startup file 1 IoCs

Processes:

cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77Kaxhwswfup.vbs cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe
Executes dropped EXE 2 IoCs

Processes:

$77c10728$7769aea2

pid process

2212 $77c10728
1636 $7769aea2

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77Kaxhwswfup.vbs	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe

pid	process
2212	$77c10728
1636	$7769aea2

Suspicious use of SetThreadContext 2 IoCs

Processes:

cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe

description	pid	process	target process
PID 2040 set thread context of 2212	2040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe	$77c10728
PID 2040 set thread context of 1636	2040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe	$7769aea2

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1280 2212 WerFault.exe $77c10728
2296 1636 WerFault.exe $7769aea2
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe

pid process

2040 cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe

pid	pid_target	process	target process
1280	2212	WerFault.exe	$77c10728
2296	1636	WerFault.exe	$7769aea2

pid	process
2040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe

description	pid	process
Token: SeDebugPrivilege	2040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe
Token: SeDebugPrivilege	2040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe

description	pid	process	target process
PID 2040 wrote to memory of 2212	2040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe	$77c10728
PID 2040 wrote to memory of 2212	2040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe	$77c10728
PID 2040 wrote to memory of 2212	2040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe	$77c10728
PID 2040 wrote to memory of 2212	2040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe	$77c10728
PID 2040 wrote to memory of 2212	2040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe	$77c10728
PID 2040 wrote to memory of 2212	2040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe	$77c10728
PID 2040 wrote to memory of 2212	2040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe	$77c10728
PID 2040 wrote to memory of 2212	2040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe	$77c10728
PID 2040 wrote to memory of 2212	2040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe	$77c10728
PID 2040 wrote to memory of 1636	2040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe	$7769aea2
PID 2040 wrote to memory of 1636	2040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe	$7769aea2
PID 2040 wrote to memory of 1636	2040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe	$7769aea2
PID 2040 wrote to memory of 1636	2040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe	$7769aea2
PID 2040 wrote to memory of 1636	2040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe	$7769aea2
PID 2040 wrote to memory of 1636	2040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe	$7769aea2
PID 2040 wrote to memory of 1636	2040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe	$7769aea2
PID 2040 wrote to memory of 1636	2040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe	$7769aea2
PID 2040 wrote to memory of 1636	2040	cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe	$7769aea2

C:\Users\Admin\AppData\Local\Temp\cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe
"C:\Users\Admin\AppData\Local\Temp\cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2040

C:\Users\Admin\AppData\Local\Temp\$77c10728
"C:\Users\Admin\AppData\Local\Temp\$77c10728"
2⤵
- Executes dropped EXE
PID:2212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 432
3⤵
- Program crash
PID:1280

C:\Users\Admin\AppData\Local\Temp\$7769aea2
"C:\Users\Admin\AppData\Local\Temp\$7769aea2"
2⤵
- Executes dropped EXE
PID:1636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 272
3⤵
- Program crash
PID:2296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 2212 -ip 2212
1⤵
PID:1776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1636 -ip 1636
1⤵
PID:2128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\$77c10728
Filesize
4.5MB

MD5
133fda00a490e613f3a6c511c1c660eb

SHA1
e34f9f1c622a7e6d3cb34217b0935ebdaab8ebe9

SHA256
cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169

SHA512
f4dd02b04326e37a3368d9c385b363689f877ae43c16de103efada642f41fe85580939db84a030597e3032d6da407d073af2b64160feec6fe38f37f1b473fffd

Download Submit
memory/2040-48-0x0000000006740000-0x000000000697A000-memory.dmp

Filesize
2.2MB

Download
memory/2040-4904-0x0000000006EB0000-0x0000000006F04000-memory.dmp

Filesize
336KB

Download
memory/2040-3-0x0000000006F30000-0x00000000074D6000-memory.dmp

Filesize
5.6MB

Download
memory/2040-4-0x0000000006A20000-0x0000000006AB2000-memory.dmp

Filesize
584KB

Download
memory/2040-12-0x0000000006740000-0x000000000697A000-memory.dmp

Filesize
2.2MB

Download
memory/2040-16-0x0000000006740000-0x000000000697A000-memory.dmp

Filesize
2.2MB

Download
memory/2040-18-0x0000000006740000-0x000000000697A000-memory.dmp

Filesize
2.2MB

Download
memory/2040-14-0x0000000006740000-0x000000000697A000-memory.dmp

Filesize
2.2MB

Download
memory/2040-34-0x0000000006740000-0x000000000697A000-memory.dmp

Filesize
2.2MB

Download
memory/2040-36-0x0000000006740000-0x000000000697A000-memory.dmp

Filesize
2.2MB

Download
memory/2040-44-0x0000000006740000-0x000000000697A000-memory.dmp

Filesize
2.2MB

Download
memory/2040-60-0x0000000006740000-0x000000000697A000-memory.dmp

Filesize
2.2MB

Download
memory/2040-69-0x0000000006740000-0x000000000697A000-memory.dmp

Filesize
2.2MB

Download
memory/2040-66-0x0000000006740000-0x000000000697A000-memory.dmp

Filesize
2.2MB

Download
memory/2040-64-0x0000000006740000-0x000000000697A000-memory.dmp

Filesize
2.2MB

Download
memory/2040-62-0x0000000006740000-0x000000000697A000-memory.dmp

Filesize
2.2MB

Download
memory/2040-46-0x0000000006740000-0x000000000697A000-memory.dmp

Filesize
2.2MB

Download
memory/2040-56-0x0000000006740000-0x000000000697A000-memory.dmp

Filesize
2.2MB

Download
memory/2040-54-0x0000000006740000-0x000000000697A000-memory.dmp

Filesize
2.2MB

Download
memory/2040-52-0x0000000006740000-0x000000000697A000-memory.dmp

Filesize
2.2MB

Download
memory/2040-50-0x0000000006740000-0x000000000697A000-memory.dmp

Filesize
2.2MB

Download
memory/2040-0-0x000000007436E000-0x000000007436F000-memory.dmp

Filesize
4KB

Download
memory/2040-30-0x0000000006740000-0x000000000697A000-memory.dmp

Filesize
2.2MB

Download
memory/2040-2-0x0000000006740000-0x0000000006980000-memory.dmp

Filesize
2.2MB

Download
memory/2040-58-0x0000000006740000-0x000000000697A000-memory.dmp

Filesize
2.2MB

Download
memory/2040-26-0x0000000006740000-0x000000000697A000-memory.dmp

Filesize
2.2MB

Download
memory/2040-24-0x0000000006740000-0x000000000697A000-memory.dmp

Filesize
2.2MB

Download
memory/2040-39-0x0000000006740000-0x000000000697A000-memory.dmp

Filesize
2.2MB

Download
memory/2040-40-0x0000000006740000-0x000000000697A000-memory.dmp

Filesize
2.2MB

Download
memory/2040-32-0x0000000006740000-0x000000000697A000-memory.dmp

Filesize
2.2MB

Download
memory/2040-28-0x0000000006740000-0x000000000697A000-memory.dmp

Filesize
2.2MB

Download
memory/2040-10-0x0000000006740000-0x000000000697A000-memory.dmp

Filesize
2.2MB

Download
memory/2040-8-0x0000000006740000-0x000000000697A000-memory.dmp

Filesize
2.2MB

Download
memory/2040-22-0x0000000006740000-0x000000000697A000-memory.dmp

Filesize
2.2MB

Download
memory/2040-20-0x0000000006740000-0x000000000697A000-memory.dmp

Filesize
2.2MB

Download
memory/2040-6-0x0000000006740000-0x000000000697A000-memory.dmp

Filesize
2.2MB

Download
memory/2040-5-0x0000000006740000-0x000000000697A000-memory.dmp

Filesize
2.2MB

Download
memory/2040-4885-0x0000000074360000-0x0000000074B11000-memory.dmp

Filesize
7.7MB

Download
memory/2040-4887-0x00000000069A0000-0x00000000069EC000-memory.dmp

Filesize
304KB

Download
memory/2040-4886-0x0000000005560000-0x00000000055DE000-memory.dmp

Filesize
504KB

Download
memory/2040-4888-0x0000000074360000-0x0000000074B11000-memory.dmp

Filesize
7.7MB

Download
memory/2040-4889-0x000000007436E000-0x000000007436F000-memory.dmp

Filesize
4KB

Download
memory/2040-4890-0x0000000074360000-0x0000000074B11000-memory.dmp

Filesize
7.7MB

Download
memory/2040-1-0x0000000000560000-0x00000000009E6000-memory.dmp

Filesize
4.5MB

Download
memory/2040-43-0x0000000006740000-0x000000000697A000-memory.dmp

Filesize
2.2MB

Download
memory/2040-4919-0x0000000074360000-0x0000000074B11000-memory.dmp

Filesize
7.7MB

Download