Analysis
- max time kernel
142s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
15/01/2024, 18:10
General
- Target 5dbd6684e5601b2f8e748e02fa898558.exe
- Size 892KB
- Sample240115-wr28aacebq
- SHA256 3d92d6a34be40684493e0cee2f5c772ec4a1f731cf8b371cad1eb9c492d9f63d
Malware Config
Extracted
-
blustealer
-
Protocol
smtp
-
Host
bojtai.xyz
-
Port
587
-
Username
-
Password
(mr.GT^Eg#C6
Signatures
- BluStealer
A Modular information stealer written in Visual Basic.
- Detect ZGRat V1 8 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5dbd6684e5601b2f8e748e02fa898558.exe"C:\Users\Admin\AppData\Local\Temp\5dbd6684e5601b2f8e748e02fa898558.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\5dbd6684e5601b2f8e748e02fa898558.exeC:\Users\Admin\AppData\Local\Temp\5dbd6684e5601b2f8e748e02fa898558.exe2⤵
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_campuap0.zmm.ps1
memory/2508-2127-0x0000000000400000-0x0000000000476000-memory.dmp
memory/2508-2124-0x0000000000400000-0x0000000000476000-memory.dmp
memory/3384-82-0x00000000071C0000-0x0000000007270000-memory.dmp
memory/3384-80-0x00000000071C0000-0x0000000007270000-memory.dmp
memory/3384-5-0x0000000005200000-0x000000000520A000-memory.dmp
memory/3384-1-0x0000000074D20000-0x00000000754D0000-memory.dmp
memory/3384-2-0x0000000005750000-0x0000000005CF4000-memory.dmp
memory/3384-2123-0x0000000074D20000-0x00000000754D0000-memory.dmp
memory/3384-2117-0x00000000070D0000-0x00000000070EE000-memory.dmp
memory/3384-104-0x0000000007700000-0x000000000775C000-memory.dmp
memory/3384-102-0x0000000007700000-0x000000000775C000-memory.dmp
memory/3384-100-0x0000000007700000-0x000000000775C000-memory.dmp
memory/3384-3-0x0000000005240000-0x00000000052D2000-memory.dmp
memory/3384-98-0x0000000007700000-0x000000000775C000-memory.dmp
memory/3384-96-0x0000000007700000-0x000000000775C000-memory.dmp
memory/3384-93-0x0000000007700000-0x000000000775C000-memory.dmp
memory/3384-94-0x0000000007700000-0x000000000775C000-memory.dmp
memory/3384-92-0x0000000007700000-0x0000000007762000-memory.dmp
memory/3384-66-0x00000000071C0000-0x0000000007270000-memory.dmp
memory/3384-68-0x00000000071C0000-0x0000000007270000-memory.dmp
memory/3384-74-0x00000000071C0000-0x0000000007270000-memory.dmp
memory/3384-30-0x0000000074D20000-0x00000000754D0000-memory.dmp
memory/3384-32-0x0000000005230000-0x0000000005240000-memory.dmp
memory/3384-55-0x00000000071C0000-0x0000000007270000-memory.dmp
memory/3384-0-0x0000000000850000-0x0000000000936000-memory.dmp
memory/3384-35-0x00000000071C0000-0x0000000007276000-memory.dmp
memory/3384-36-0x00000000071C0000-0x0000000007270000-memory.dmp
memory/3384-41-0x00000000071C0000-0x0000000007270000-memory.dmp
memory/3384-39-0x00000000071C0000-0x0000000007270000-memory.dmp
memory/3384-37-0x00000000071C0000-0x0000000007270000-memory.dmp
memory/3384-43-0x00000000071C0000-0x0000000007270000-memory.dmp
memory/3384-47-0x00000000071C0000-0x0000000007270000-memory.dmp
memory/3384-45-0x00000000071C0000-0x0000000007270000-memory.dmp
memory/3384-49-0x00000000071C0000-0x0000000007270000-memory.dmp
memory/3384-4-0x0000000005230000-0x0000000005240000-memory.dmp
memory/3384-53-0x00000000071C0000-0x0000000007270000-memory.dmp
memory/3384-51-0x00000000071C0000-0x0000000007270000-memory.dmp
memory/3384-57-0x00000000071C0000-0x0000000007270000-memory.dmp
memory/3384-84-0x00000000071C0000-0x0000000007270000-memory.dmp
memory/3384-62-0x00000000071C0000-0x0000000007270000-memory.dmp
memory/3384-64-0x00000000071C0000-0x0000000007270000-memory.dmp
memory/3384-70-0x00000000071C0000-0x0000000007270000-memory.dmp
memory/3384-72-0x00000000071C0000-0x0000000007270000-memory.dmp
memory/3384-76-0x00000000071C0000-0x0000000007270000-memory.dmp
memory/3384-78-0x00000000071C0000-0x0000000007270000-memory.dmp
memory/3384-88-0x00000000071C0000-0x0000000007270000-memory.dmp
memory/3384-90-0x00000000071C0000-0x0000000007270000-memory.dmp
memory/3384-91-0x0000000007270000-0x00000000072E6000-memory.dmp
memory/3384-86-0x00000000071C0000-0x0000000007270000-memory.dmp
memory/5056-23-0x0000000004B20000-0x0000000004B3E000-memory.dmp
memory/5056-22-0x00000000057A0000-0x0000000005AF4000-memory.dmp
memory/5056-24-0x0000000005DE0000-0x0000000005E2C000-memory.dmp
memory/5056-31-0x0000000074D20000-0x00000000754D0000-memory.dmp
memory/5056-28-0x00000000081C0000-0x000000000883A000-memory.dmp
memory/5056-27-0x00000000062B0000-0x00000000062D2000-memory.dmp
memory/5056-26-0x0000000006260000-0x000000000627A000-memory.dmp
memory/5056-61-0x0000000074D20000-0x00000000754D0000-memory.dmp
memory/5056-34-0x0000000004930000-0x0000000004940000-memory.dmp
memory/5056-25-0x0000000006F40000-0x0000000006FD6000-memory.dmp
memory/5056-33-0x0000000004930000-0x0000000004940000-memory.dmp
memory/5056-12-0x0000000005730000-0x0000000005796000-memory.dmp
memory/5056-11-0x0000000005610000-0x0000000005676000-memory.dmp
memory/5056-10-0x0000000004D90000-0x0000000004DB2000-memory.dmp
memory/5056-9-0x0000000004F70000-0x0000000005598000-memory.dmp
memory/5056-8-0x0000000004930000-0x0000000004940000-memory.dmp
memory/5056-7-0x0000000074D20000-0x00000000754D0000-memory.dmp
memory/5056-6-0x0000000002440000-0x0000000002476000-memory.dmp