zgrat | 6d7226154b8ed4534ed8e0a97e3c2863d094cc85be6a4bd23be5975865a5085a

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 01:00

Target

e4877fdceffd87cec166b266532a431e0d5e7644d950ce9566d2f14bc18be5e2.exe
Size

3.0MB
MD5

097a014e9066d6a4dd30e057e18eb511
SHA1

2baa37cdc9b69e4083fdf468240cbacb1f2851ae
SHA256

e4877fdceffd87cec166b266532a431e0d5e7644d950ce9566d2f14bc18be5e2
SHA512

3409f75f0d073146410ebf31f487626e0c5fc01abb962f56b673256e72981f3e4f5c063e6690feeff1b2937bd14b453c38823242c9dee9e607fe63888d9ad627
SSDEEP

49152:HzcK4Uk57r6mnw8fqFEIawGt2jlobG+FVSA7tffhpZ4F/3:HzvMWmnZSVawGtjHFVS8ffDZ4J

Score

10^/10

Detect ZGRat V1 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/2872-1-0x00000000003A0000-0x00000000006A2000-memory.dmp family_zgrat_v1
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource yara_rule

behavioral1/memory/2872-1-0x00000000003A0000-0x00000000006A2000-memory.dmp net_reactor
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2368 2872 WerFault.exe e4877fdceffd87cec166b266532a431e0d5e7644d950ce9566d2f14bc18be5e2.exe

resource	yara_rule
behavioral1/memory/2872-1-0x00000000003A0000-0x00000000006A2000-memory.dmp	family_zgrat_v1

resource	yara_rule
behavioral1/memory/2872-1-0x00000000003A0000-0x00000000006A2000-memory.dmp	net_reactor

pid	pid_target	process	target process
2368	2872	WerFault.exe	e4877fdceffd87cec166b266532a431e0d5e7644d950ce9566d2f14bc18be5e2.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

e4877fdceffd87cec166b266532a431e0d5e7644d950ce9566d2f14bc18be5e2.exe

description	pid	process	target process
PID 2872 wrote to memory of 2368	2872	e4877fdceffd87cec166b266532a431e0d5e7644d950ce9566d2f14bc18be5e2.exe	WerFault.exe
PID 2872 wrote to memory of 2368	2872	e4877fdceffd87cec166b266532a431e0d5e7644d950ce9566d2f14bc18be5e2.exe	WerFault.exe
PID 2872 wrote to memory of 2368	2872	e4877fdceffd87cec166b266532a431e0d5e7644d950ce9566d2f14bc18be5e2.exe	WerFault.exe
PID 2872 wrote to memory of 2368	2872	e4877fdceffd87cec166b266532a431e0d5e7644d950ce9566d2f14bc18be5e2.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\e4877fdceffd87cec166b266532a431e0d5e7644d950ce9566d2f14bc18be5e2.exe
"C:\Users\Admin\AppData\Local\Temp\e4877fdceffd87cec166b266532a431e0d5e7644d950ce9566d2f14bc18be5e2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 556
2⤵
- Program crash
PID:2368

memory/2872-0-0x0000000074AAE000-0x0000000074AAF000-memory.dmp

Filesize
4KB

Download
memory/2872-1-0x00000000003A0000-0x00000000006A2000-memory.dmp

Filesize
3.0MB

Download
memory/2872-2-0x0000000074AAE000-0x0000000074AAF000-memory.dmp

Filesize
4KB

Download