Analysis

  • max time kernel
    16s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-01-2024 20:19

General

  • Target

    magic.poisontoolz.com/building.exe

  • Size

    56KB

  • MD5

    5a51a3f11d523aaad894e4e8381f169a

  • SHA1

    1f6800f862e2238e36b50c2b4b900d9e3cdaecd3

  • SHA256

    cae11157e682ada9c356e2fb622357d687b41e1e3c3f4300a54a70be0165e4ce

  • SHA512

    655ad8134408970703bfdf65e82ebe8b3c8d2e0f90e6189962fe03755f1b365832d34673717803c4a5f5598170120dc776de83a7e291090b75b41e6b7b59eda0

  • SSDEEP

    1536:UrkoiEd1v3nxQ3DRI07olrgt+mtfTQZPpQh82:UZiEd1v3nKlI07MYTtf8ZPpQ+2

Score
10/10

Malware Config

Signatures

  • Detect ZGRat V1 34 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\magic.poisontoolz.com\building.exe
    "C:\Users\Admin\AppData\Local\Temp\magic.poisontoolz.com\building.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4824
    • C:\Users\Admin\AppData\Local\Temp\magic.poisontoolz.com\building.exe
      C:\Users\Admin\AppData\Local\Temp\magic.poisontoolz.com\building.exe
      2⤵
        PID:1540
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
          3⤵
            PID:3824
            • C:\Windows\SysWOW64\chcp.com
              chcp 65001
              4⤵
                PID:5112
              • C:\Windows\SysWOW64\findstr.exe
                findstr All
                4⤵
                  PID:1056
                • C:\Windows\SysWOW64\netsh.exe
                  netsh wlan show profile
                  4⤵
                    PID:1964
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
                  3⤵
                    PID:4208
              • C:\Windows\system32\msiexec.exe
                C:\Windows\system32\msiexec.exe /V
                1⤵
                  PID:2156
                • C:\Windows\SysWOW64\netsh.exe
                  netsh wlan show networks mode=bssid
                  1⤵
                    PID:4776
                  • C:\Windows\SysWOW64\chcp.com
                    chcp 65001
                    1⤵
                      PID:4796

                    Network

                    MITRE ATT&CK Matrix

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\71d7319007f790734acd1eb67caa82ba\Admin@FMAEQIOU_en-US\Browsers\Firefox\Bookmarks.txt

                      Filesize

                      105B

                      MD5

                      2e9d094dda5cdc3ce6519f75943a4ff4

                      SHA1

                      5d989b4ac8b699781681fe75ed9ef98191a5096c

                      SHA256

                      c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

                      SHA512

                      d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

                    • C:\Users\Admin\AppData\Local\71d7319007f790734acd1eb67caa82ba\Admin@FMAEQIOU_en-US\Directories\OneDrive.txt

                      Filesize

                      25B

                      MD5

                      966247eb3ee749e21597d73c4176bd52

                      SHA1

                      1e9e63c2872cef8f015d4b888eb9f81b00a35c79

                      SHA256

                      8ddfc481b1b6ae30815ecce8a73755862f24b3bb7fdebdbf099e037d53eb082e

                      SHA512

                      bd30aec68c070e86e3dec787ed26dd3d6b7d33d83e43cb2d50f9e2cff779fee4c96afbbe170443bd62874073a844beb29a69b10c72c54d7d444a8d86cfd7b5aa

                    • C:\Users\Admin\AppData\Local\71d7319007f790734acd1eb67caa82ba\Admin@FMAEQIOU_en-US\Directories\Startup.txt

                      Filesize

                      24B

                      MD5

                      68c93da4981d591704cea7b71cebfb97

                      SHA1

                      fd0f8d97463cd33892cc828b4ad04e03fc014fa6

                      SHA256

                      889ed51f9c16a4b989bda57957d3e132b1a9c117ee84e208207f2fa208a59483

                      SHA512

                      63455c726b55f2d4de87147a75ff04f2daa35278183969ccf185d23707840dd84363bec20d4e8c56252196ce555001ca0e61b3f4887d27577081fdef9e946402

                    • C:\Users\Admin\AppData\Local\71d7319007f790734acd1eb67caa82ba\Admin@FMAEQIOU_en-US\Directories\Videos.txt

                      Filesize

                      23B

                      MD5

                      1fddbf1169b6c75898b86e7e24bc7c1f

                      SHA1

                      d2091060cb5191ff70eb99c0088c182e80c20f8c

                      SHA256

                      a67aa329b7d878de61671e18cd2f4b011d11cbac67ea779818c6dafad2d70733

                      SHA512

                      20bfeafde7fec1753fef59de467bd4a3dd7fe627e8c44e95fe62b065a5768c4508e886ec5d898e911a28cf6365f455c9ab1ebe2386d17a76f53037f99061fd4d

                    • C:\Users\Admin\AppData\Local\71d7319007f790734acd1eb67caa82ba\Admin@FMAEQIOU_en-US\System\Apps.txt

                      Filesize

                      2KB

                      MD5

                      906c700315ca80c7952b464f3f93723f

                      SHA1

                      a736b7cdea92db2e686737c4567b86c22ef66e3f

                      SHA256

                      c55a28b0b4773dad67a0ea894c080d2398a0e686f1c355cedb7f7291637476e5

                      SHA512

                      af133b667e92cdab4e352b4c86ea7e8986ea9de5e25e61da92a61abe59adb11435d1e44d7e54974c2969c046db1fe1b411186b1578c147829cbb2d5693ffe35c

                    • C:\Users\Admin\AppData\Local\71d7319007f790734acd1eb67caa82ba\Admin@FMAEQIOU_en-US\System\Apps.txt

                      Filesize

                      2KB

                      MD5

                      027a2c6780dfc5777707fc9fe796f5d6

                      SHA1

                      3add6e59894483c20d09b4dd8623fa42a252495e

                      SHA256

                      a19c1057e41ab8a3bc591f4d3ca2fb0a58f9fd34a300084580e14aa214fb3dc1

                      SHA512

                      fcede40cc3f6181b0c59849e966cf03324f305d6b38c05c21c8dacd5ac73a96178654871d39b903f0ffed6ae88ed5a9097a87e8d42544c621609c8767db245c4

                    • C:\Users\Admin\AppData\Local\71d7319007f790734acd1eb67caa82ba\Admin@FMAEQIOU_en-US\System\Apps.txt

                      Filesize

                      5KB

                      MD5

                      b1d58554f33c991f9454f81bf1f6a7a6

                      SHA1

                      1a9c0748fbb4c4974315f6a3188ffb5078372de1

                      SHA256

                      2809730601ec3cd803e75dded9788afc2683f6562378a497e7300fd83137838c

                      SHA512

                      ef961a73b2b8844155d1684a6d5e0319ad5d0c8cb2c60e4ed16b03cca69e04bf9872f2bff8fdf24d3bf284366f2b2f0d36f1e4c1cd5d007732c3ad0af562d5c6

                    • C:\Users\Admin\AppData\Local\71d7319007f790734acd1eb67caa82ba\Admin@FMAEQIOU_en-US\System\Debug.txt

                      MD5

                      d41d8cd98f00b204e9800998ecf8427e

                      SHA1

                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                      SHA256

                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                      SHA512

                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    • C:\Users\Admin\AppData\Local\71d7319007f790734acd1eb67caa82ba\Admin@FMAEQIOU_en-US\System\Process.txt

                      Filesize

                      4KB

                      MD5

                      bf20b12d771f890a397436385c1bece5

                      SHA1

                      a4591d040c4a3cabf4d6273179cf498db097a3fd

                      SHA256

                      837fd30d574b109158bcba06387dbfad22c330f7742bb29c8f5c2e19d8f76e53

                      SHA512

                      0e490228e2982e1e61384288a98d8c66535374b40601400e8e5a9c0c26421d2bf61de7e432b838be032cbb04b478fce39270275bdff7c48a9e2fc4a64871f9b8

                    • C:\Users\Admin\AppData\Local\71d7319007f790734acd1eb67caa82ba\Admin@FMAEQIOU_en-US\System\ProductKey.txt

                      Filesize

                      29B

                      MD5

                      71eb5479298c7afc6d126fa04d2a9bde

                      SHA1

                      a9b3d5505cf9f84bb6c2be2acece53cb40075113

                      SHA256

                      f6cadfd4e4c25ff3b8cffe54a2af24a757a349abbf4e1142ec4c9789347fe8b3

                      SHA512

                      7c6687e21d31ec1d6d2eff04b07b465f875fd80df26677f1506b14158444cf55044eb6674880bd5bd44f04ff73023b26cb19b8837427a1d6655c96df52f140bd

                    • C:\Users\Admin\AppData\Local\71d7319007f790734acd1eb67caa82ba\msgid.dat

                      Filesize

                      19B

                      MD5

                      13272090fc49070d4c79f78670b7839b

                      SHA1

                      4ea6e614dd113ed7bb5e291537ceed50154f5042

                      SHA256

                      bc91f49e63aa1e5f230c79de3f60aeae2b561531e263e0799efe03b3bb407c84

                      SHA512

                      27ffb2c8e2a1af82b4ca472eb1a17221ef73f957a79403cf575c749f82aadc57766191076f2da4eee02d4db5785f0d9180294fc3c32a4f98d5fa91549c1e5d4a

                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\building.exe.log

                      Filesize

                      1KB

                      MD5

                      c3941d9fa38f1717d5cecd7a2ca71667

                      SHA1

                      33b5362675383b58b4166ed9f9a61e5aa6768d2e

                      SHA256

                      f1ed6ff1cd3df219061e32df1c75d6f48de6484cf50e5ea7d86cd8bcfcb93256

                      SHA512

                      98f103ef97d32bf8c0566a6f6da5cf8d58d18f698c1b3e5bd0be0ea8462f5fe54c2e5e6b5188f2b7d8f70082ffd6745b1f7f6cab95af474e2b7eaed50a9d9c45

                    • memory/1540-1222-0x00000000071D0000-0x00000000071F2000-memory.dmp

                      Filesize

                      136KB

                    • memory/1540-1239-0x00000000057C0000-0x00000000057D0000-memory.dmp

                      Filesize

                      64KB

                    • memory/1540-1223-0x0000000008930000-0x0000000008C84000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/1540-1225-0x0000000074FF0000-0x00000000757A0000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/1540-1226-0x00000000057C0000-0x00000000057D0000-memory.dmp

                      Filesize

                      64KB

                    • memory/1540-1237-0x0000000007AF0000-0x0000000007AFA000-memory.dmp

                      Filesize

                      40KB

                    • memory/1540-1147-0x0000000007080000-0x00000000070FA000-memory.dmp

                      Filesize

                      488KB

                    • memory/1540-1111-0x00000000057C0000-0x00000000057D0000-memory.dmp

                      Filesize

                      64KB

                    • memory/1540-1113-0x00000000057C0000-0x00000000057D0000-memory.dmp

                      Filesize

                      64KB

                    • memory/1540-1238-0x00000000057C0000-0x00000000057D0000-memory.dmp

                      Filesize

                      64KB

                    • memory/1540-1012-0x0000000006F30000-0x0000000006FC2000-memory.dmp

                      Filesize

                      584KB

                    • memory/1540-1220-0x0000000007240000-0x00000000072F2000-memory.dmp

                      Filesize

                      712KB

                    • memory/1540-954-0x0000000006E20000-0x0000000006E2A000-memory.dmp

                      Filesize

                      40KB

                    • memory/1540-956-0x0000000006E50000-0x0000000006E6E000-memory.dmp

                      Filesize

                      120KB

                    • memory/1540-955-0x0000000006E30000-0x0000000006E38000-memory.dmp

                      Filesize

                      32KB

                    • memory/1540-951-0x0000000005F40000-0x0000000005FD2000-memory.dmp

                      Filesize

                      584KB

                    • memory/1540-952-0x0000000005FD0000-0x0000000005FF6000-memory.dmp

                      Filesize

                      152KB

                    • memory/1540-953-0x0000000006000000-0x0000000006008000-memory.dmp

                      Filesize

                      32KB

                    • memory/1540-948-0x00000000057C0000-0x00000000057D0000-memory.dmp

                      Filesize

                      64KB

                    • memory/1540-944-0x0000000000400000-0x0000000000592000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/1540-945-0x0000000074FF0000-0x00000000757A0000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/1540-946-0x00000000056D0000-0x0000000005736000-memory.dmp

                      Filesize

                      408KB

                    • memory/4824-34-0x0000000006E90000-0x0000000007095000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/4824-36-0x0000000006E90000-0x0000000007095000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/4824-66-0x0000000006E90000-0x0000000007095000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/4824-12-0x0000000006E90000-0x0000000007095000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/4824-937-0x0000000002DE0000-0x0000000002DE1000-memory.dmp

                      Filesize

                      4KB

                    • memory/4824-939-0x0000000007320000-0x000000000736C000-memory.dmp

                      Filesize

                      304KB

                    • memory/4824-938-0x0000000007430000-0x00000000075D2000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/4824-940-0x0000000007C00000-0x00000000081A4000-memory.dmp

                      Filesize

                      5.6MB

                    • memory/4824-48-0x0000000006E90000-0x0000000007095000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/4824-947-0x0000000074FF0000-0x00000000757A0000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/4824-64-0x0000000006E90000-0x0000000007095000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/4824-62-0x0000000006E90000-0x0000000007095000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/4824-60-0x0000000006E90000-0x0000000007095000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/4824-58-0x0000000006E90000-0x0000000007095000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/4824-54-0x0000000006E90000-0x0000000007095000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/4824-56-0x0000000006E90000-0x0000000007095000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/4824-52-0x0000000006E90000-0x0000000007095000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/4824-50-0x0000000006E90000-0x0000000007095000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/4824-46-0x0000000006E90000-0x0000000007095000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/4824-44-0x0000000006E90000-0x0000000007095000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/4824-42-0x0000000006E90000-0x0000000007095000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/4824-68-0x0000000006E90000-0x0000000007095000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/4824-40-0x0000000006E90000-0x0000000007095000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/4824-38-0x0000000006E90000-0x0000000007095000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/4824-0-0x00000000009D0000-0x00000000009E4000-memory.dmp

                      Filesize

                      80KB

                    • memory/4824-32-0x0000000006E90000-0x0000000007095000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/4824-22-0x0000000006E90000-0x0000000007095000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/4824-30-0x0000000006E90000-0x0000000007095000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/4824-28-0x0000000006E90000-0x0000000007095000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/4824-26-0x0000000006E90000-0x0000000007095000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/4824-24-0x0000000006E90000-0x0000000007095000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/4824-20-0x0000000006E90000-0x0000000007095000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/4824-18-0x0000000006E90000-0x0000000007095000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/4824-16-0x0000000006E90000-0x0000000007095000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/4824-14-0x0000000006E90000-0x0000000007095000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/4824-6-0x0000000006E90000-0x0000000007095000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/4824-10-0x0000000006E90000-0x0000000007095000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/4824-8-0x0000000006E90000-0x0000000007095000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/4824-5-0x0000000006E90000-0x0000000007095000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/4824-4-0x0000000006E90000-0x000000000709A000-memory.dmp

                      Filesize

                      2.0MB

                    • memory/4824-3-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

                      Filesize

                      24KB

                    • memory/4824-2-0x0000000005550000-0x0000000005560000-memory.dmp

                      Filesize

                      64KB

                    • memory/4824-1-0x0000000074FF0000-0x00000000757A0000-memory.dmp

                      Filesize

                      7.7MB