Analysis
- max time kernel
128s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
19/01/2024, 20:19
General
- Target magic.poisontoolz.com/Buildcrypt.exe
- Size 86KB
- Sample240119-y3w7hsdee7
- SHA256 eaaefbc4c960dca1de30c44f0fccbbefdb9c3e0e243e7ff5579316b99206b8e0
Malware Config
Signatures
- Detect ZGRat V1 34 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 29 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\magic.poisontoolz.com\Buildcrypt.exe"C:\Users\Admin\AppData\Local\Temp\magic.poisontoolz.com\Buildcrypt.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\magic.poisontoolz.com\Buildcrypt.exeC:\Users\Admin\AppData\Local\Temp\magic.poisontoolz.com\Buildcrypt.exe2⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile4⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr All4⤵
-
-
C:\Windows\SysWOW64\chcp.comchcp 650014⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid3⤵
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid1⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650011⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Buildcrypt.exe.log
Bookmarks.txt
Startup.txt
Videos.txt
Apps.txt
Process.txt
ProductKey.txt
msgid.dat
memory/640-55-0x0000000006C00000-0x0000000006E04000-memory.dmp
memory/640-17-0x0000000006C00000-0x0000000006E04000-memory.dmp
memory/640-9-0x0000000006C00000-0x0000000006E04000-memory.dmp
memory/640-7-0x0000000006C00000-0x0000000006E04000-memory.dmp
memory/640-11-0x0000000006C00000-0x0000000006E04000-memory.dmp
memory/640-15-0x0000000006C00000-0x0000000006E04000-memory.dmp
memory/640-19-0x0000000006C00000-0x0000000006E04000-memory.dmp
memory/640-23-0x0000000006C00000-0x0000000006E04000-memory.dmp
memory/640-27-0x0000000006C00000-0x0000000006E04000-memory.dmp
memory/640-31-0x0000000006C00000-0x0000000006E04000-memory.dmp
memory/640-35-0x0000000006C00000-0x0000000006E04000-memory.dmp
memory/640-37-0x0000000006C00000-0x0000000006E04000-memory.dmp
memory/640-39-0x0000000006C00000-0x0000000006E04000-memory.dmp
memory/640-43-0x0000000006C00000-0x0000000006E04000-memory.dmp
memory/640-45-0x0000000006C00000-0x0000000006E04000-memory.dmp
memory/640-47-0x0000000006C00000-0x0000000006E04000-memory.dmp
memory/640-49-0x0000000006C00000-0x0000000006E04000-memory.dmp
memory/640-51-0x0000000006C00000-0x0000000006E04000-memory.dmp
memory/640-53-0x0000000006C00000-0x0000000006E04000-memory.dmp
memory/640-57-0x0000000006C00000-0x0000000006E04000-memory.dmp
memory/640-61-0x0000000006C00000-0x0000000006E04000-memory.dmp
memory/640-63-0x0000000006C00000-0x0000000006E04000-memory.dmp
memory/640-65-0x0000000006C00000-0x0000000006E04000-memory.dmp
memory/640-67-0x0000000006C00000-0x0000000006E04000-memory.dmp
memory/640-59-0x0000000006C00000-0x0000000006E04000-memory.dmp
memory/640-4-0x0000000006C00000-0x0000000006E04000-memory.dmp
memory/640-41-0x0000000006C00000-0x0000000006E04000-memory.dmp
memory/640-33-0x0000000006C00000-0x0000000006E04000-memory.dmp
memory/640-29-0x0000000006C00000-0x0000000006E04000-memory.dmp
memory/640-25-0x0000000006C00000-0x0000000006E04000-memory.dmp
memory/640-21-0x0000000006C00000-0x0000000006E04000-memory.dmp
memory/640-5-0x0000000006C00000-0x0000000006E04000-memory.dmp
memory/640-13-0x0000000006C00000-0x0000000006E04000-memory.dmp
memory/640-936-0x0000000002B70000-0x0000000002B71000-memory.dmp
memory/640-938-0x0000000006F80000-0x0000000006FCC000-memory.dmp
memory/640-937-0x0000000007110000-0x00000000072B2000-memory.dmp
memory/640-939-0x0000000007920000-0x0000000007EC4000-memory.dmp
memory/640-945-0x0000000074CA0000-0x0000000075450000-memory.dmp
memory/640-0-0x0000000074CA0000-0x0000000075450000-memory.dmp
memory/640-1-0x0000000000740000-0x000000000075C000-memory.dmp
memory/640-2-0x0000000005100000-0x0000000005110000-memory.dmp
memory/640-3-0x0000000006C00000-0x0000000006E0A000-memory.dmp
memory/4480-943-0x0000000000400000-0x0000000000592000-memory.dmp
memory/4480-952-0x0000000006000000-0x0000000006026000-memory.dmp
memory/4480-951-0x0000000005F70000-0x0000000006002000-memory.dmp
memory/4480-955-0x0000000006E60000-0x0000000006E68000-memory.dmp
memory/4480-956-0x0000000006E80000-0x0000000006E9E000-memory.dmp
memory/4480-954-0x0000000006E50000-0x0000000006E5A000-memory.dmp
memory/4480-1013-0x00000000077B0000-0x0000000007842000-memory.dmp
memory/4480-1113-0x00000000057C0000-0x00000000057D0000-memory.dmp
memory/4480-946-0x0000000005710000-0x0000000005776000-memory.dmp
memory/4480-947-0x00000000057C0000-0x00000000057D0000-memory.dmp
memory/4480-1221-0x00000000072A0000-0x0000000007352000-memory.dmp
memory/4480-1148-0x0000000006FE0000-0x000000000705A000-memory.dmp
memory/4480-953-0x0000000006030000-0x0000000006038000-memory.dmp
memory/4480-1223-0x0000000007100000-0x0000000007122000-memory.dmp
memory/4480-1224-0x00000000088B0000-0x0000000008C04000-memory.dmp
memory/4480-1225-0x0000000074CA0000-0x0000000075450000-memory.dmp
memory/4480-1226-0x00000000057C0000-0x00000000057D0000-memory.dmp
memory/4480-944-0x0000000074CA0000-0x0000000075450000-memory.dmp
memory/4480-1238-0x0000000007730000-0x000000000773A000-memory.dmp
memory/4480-1239-0x00000000057C0000-0x00000000057D0000-memory.dmp