Analysis

  • max time kernel
    128s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-01-2024 20:19

General

  • Target

    magic.poisontoolz.com/Buildcrypt.exe

  • Size

    86KB

  • MD5

    380888258d0c8d18da63e80591a4e0f3

  • SHA1

    70ef5767c29304806ccc4cd136d9c5bfd8dcf403

  • SHA256

    eaaefbc4c960dca1de30c44f0fccbbefdb9c3e0e243e7ff5579316b99206b8e0

  • SHA512

    63104e4e2e6b260522c26a28287684bb8dab433d4b03396e30b478288980d15d4d259d873f1f59eda364ec777bcdc79f481b11890178a012f2bc483497c4e3b3

  • SSDEEP

    1536:2jXsxSiEgiXHZLUQqC0BvUncdRHREWT2fPT3YORK59kx+:KXtiSghvU/86T3YUK5CE

Malware Config

Signatures

  • Detect ZGRat V1 34 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\magic.poisontoolz.com\Buildcrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\magic.poisontoolz.com\Buildcrypt.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:640
    • C:\Users\Admin\AppData\Local\Temp\magic.poisontoolz.com\Buildcrypt.exe
      C:\Users\Admin\AppData\Local\Temp\magic.poisontoolz.com\Buildcrypt.exe
      2⤵
      • Accesses Microsoft Outlook profiles
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:4480
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2240
        • C:\Windows\SysWOW64\netsh.exe
          netsh wlan show profile
          4⤵
            PID:4360
          • C:\Windows\SysWOW64\findstr.exe
            findstr All
            4⤵
              PID:4632
            • C:\Windows\SysWOW64\chcp.com
              chcp 65001
              4⤵
                PID:3248
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2268
        • C:\Windows\system32\msiexec.exe
          C:\Windows\system32\msiexec.exe /V
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4004
        • C:\Windows\SysWOW64\netsh.exe
          netsh wlan show networks mode=bssid
          1⤵
            PID:4240
          • C:\Windows\SysWOW64\chcp.com
            chcp 65001
            1⤵
              PID:3088

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Buildcrypt.exe.log

              Filesize

              1KB

              MD5

              c3941d9fa38f1717d5cecd7a2ca71667

              SHA1

              33b5362675383b58b4166ed9f9a61e5aa6768d2e

              SHA256

              f1ed6ff1cd3df219061e32df1c75d6f48de6484cf50e5ea7d86cd8bcfcb93256

              SHA512

              98f103ef97d32bf8c0566a6f6da5cf8d58d18f698c1b3e5bd0be0ea8462f5fe54c2e5e6b5188f2b7d8f70082ffd6745b1f7f6cab95af474e2b7eaed50a9d9c45

            • C:\Users\Admin\AppData\Local\e2bed16f33a1d21c74bd6ea14529f635\Admin@IMXSDNYJ_en-US\Browsers\Firefox\Bookmarks.txt

              Filesize

              105B

              MD5

              2e9d094dda5cdc3ce6519f75943a4ff4

              SHA1

              5d989b4ac8b699781681fe75ed9ef98191a5096c

              SHA256

              c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

              SHA512

              d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

            • C:\Users\Admin\AppData\Local\e2bed16f33a1d21c74bd6ea14529f635\Admin@IMXSDNYJ_en-US\Directories\Startup.txt

              Filesize

              24B

              MD5

              68c93da4981d591704cea7b71cebfb97

              SHA1

              fd0f8d97463cd33892cc828b4ad04e03fc014fa6

              SHA256

              889ed51f9c16a4b989bda57957d3e132b1a9c117ee84e208207f2fa208a59483

              SHA512

              63455c726b55f2d4de87147a75ff04f2daa35278183969ccf185d23707840dd84363bec20d4e8c56252196ce555001ca0e61b3f4887d27577081fdef9e946402

            • C:\Users\Admin\AppData\Local\e2bed16f33a1d21c74bd6ea14529f635\Admin@IMXSDNYJ_en-US\Directories\Videos.txt

              Filesize

              23B

              MD5

              1fddbf1169b6c75898b86e7e24bc7c1f

              SHA1

              d2091060cb5191ff70eb99c0088c182e80c20f8c

              SHA256

              a67aa329b7d878de61671e18cd2f4b011d11cbac67ea779818c6dafad2d70733

              SHA512

              20bfeafde7fec1753fef59de467bd4a3dd7fe627e8c44e95fe62b065a5768c4508e886ec5d898e911a28cf6365f455c9ab1ebe2386d17a76f53037f99061fd4d

            • C:\Users\Admin\AppData\Local\e2bed16f33a1d21c74bd6ea14529f635\Admin@IMXSDNYJ_en-US\System\Apps.txt

              MD5

              d41d8cd98f00b204e9800998ecf8427e

              SHA1

              da39a3ee5e6b4b0d3255bfef95601890afd80709

              SHA256

              e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

              SHA512

              cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

            • C:\Users\Admin\AppData\Local\e2bed16f33a1d21c74bd6ea14529f635\Admin@IMXSDNYJ_en-US\System\Apps.txt

              Filesize

              5KB

              MD5

              b1d58554f33c991f9454f81bf1f6a7a6

              SHA1

              1a9c0748fbb4c4974315f6a3188ffb5078372de1

              SHA256

              2809730601ec3cd803e75dded9788afc2683f6562378a497e7300fd83137838c

              SHA512

              ef961a73b2b8844155d1684a6d5e0319ad5d0c8cb2c60e4ed16b03cca69e04bf9872f2bff8fdf24d3bf284366f2b2f0d36f1e4c1cd5d007732c3ad0af562d5c6

            • C:\Users\Admin\AppData\Local\e2bed16f33a1d21c74bd6ea14529f635\Admin@IMXSDNYJ_en-US\System\Process.txt

              Filesize

              4KB

              MD5

              1ee536f8825f6e2687ef66d381d8f207

              SHA1

              226510773d4cce296c65a148113cc8748dcd2eb5

              SHA256

              17f9cee741ac5c44270e2e06cffe0733c0048eeff575a722552ab3faa60c22e4

              SHA512

              0e7be43674727276b6a1ca1b1b96cca435f9dc1feefce7a150632f171313b365ee59bc842244c6dfaf53b951bff3f9cad781ea70795cfed163db767f50a55e7f

            • C:\Users\Admin\AppData\Local\e2bed16f33a1d21c74bd6ea14529f635\Admin@IMXSDNYJ_en-US\System\ProductKey.txt

              Filesize

              29B

              MD5

              71eb5479298c7afc6d126fa04d2a9bde

              SHA1

              a9b3d5505cf9f84bb6c2be2acece53cb40075113

              SHA256

              f6cadfd4e4c25ff3b8cffe54a2af24a757a349abbf4e1142ec4c9789347fe8b3

              SHA512

              7c6687e21d31ec1d6d2eff04b07b465f875fd80df26677f1506b14158444cf55044eb6674880bd5bd44f04ff73023b26cb19b8837427a1d6655c96df52f140bd

            • C:\Users\Admin\AppData\Local\e2bed16f33a1d21c74bd6ea14529f635\msgid.dat

              Filesize

              19B

              MD5

              9d694ab3d634fb05b97a4b4e72a69c3d

              SHA1

              c71f80418ae48b90d4128ab03ac26e4c8c8f8c41

              SHA256

              b61a8732dc7f3679fa4e0cf02bdbc1d61a813adaafa9df7a0aba53d9127902f9

              SHA512

              a7eb902af143b7aeae5fb063c303ff90023dce6d16c40e09f1fa7847c453f0e3864f7623daefe9a4d1f71a8c75f27b55ed9bfd0c137e8d607b1fbbd4c5b26327

            • memory/640-55-0x0000000006C00000-0x0000000006E04000-memory.dmp

              Filesize

              2.0MB

            • memory/640-17-0x0000000006C00000-0x0000000006E04000-memory.dmp

              Filesize

              2.0MB

            • memory/640-9-0x0000000006C00000-0x0000000006E04000-memory.dmp

              Filesize

              2.0MB

            • memory/640-7-0x0000000006C00000-0x0000000006E04000-memory.dmp

              Filesize

              2.0MB

            • memory/640-11-0x0000000006C00000-0x0000000006E04000-memory.dmp

              Filesize

              2.0MB

            • memory/640-15-0x0000000006C00000-0x0000000006E04000-memory.dmp

              Filesize

              2.0MB

            • memory/640-19-0x0000000006C00000-0x0000000006E04000-memory.dmp

              Filesize

              2.0MB

            • memory/640-23-0x0000000006C00000-0x0000000006E04000-memory.dmp

              Filesize

              2.0MB

            • memory/640-27-0x0000000006C00000-0x0000000006E04000-memory.dmp

              Filesize

              2.0MB

            • memory/640-31-0x0000000006C00000-0x0000000006E04000-memory.dmp

              Filesize

              2.0MB

            • memory/640-35-0x0000000006C00000-0x0000000006E04000-memory.dmp

              Filesize

              2.0MB

            • memory/640-37-0x0000000006C00000-0x0000000006E04000-memory.dmp

              Filesize

              2.0MB

            • memory/640-39-0x0000000006C00000-0x0000000006E04000-memory.dmp

              Filesize

              2.0MB

            • memory/640-43-0x0000000006C00000-0x0000000006E04000-memory.dmp

              Filesize

              2.0MB

            • memory/640-45-0x0000000006C00000-0x0000000006E04000-memory.dmp

              Filesize

              2.0MB

            • memory/640-47-0x0000000006C00000-0x0000000006E04000-memory.dmp

              Filesize

              2.0MB

            • memory/640-49-0x0000000006C00000-0x0000000006E04000-memory.dmp

              Filesize

              2.0MB

            • memory/640-51-0x0000000006C00000-0x0000000006E04000-memory.dmp

              Filesize

              2.0MB

            • memory/640-53-0x0000000006C00000-0x0000000006E04000-memory.dmp

              Filesize

              2.0MB

            • memory/640-57-0x0000000006C00000-0x0000000006E04000-memory.dmp

              Filesize

              2.0MB

            • memory/640-61-0x0000000006C00000-0x0000000006E04000-memory.dmp

              Filesize

              2.0MB

            • memory/640-63-0x0000000006C00000-0x0000000006E04000-memory.dmp

              Filesize

              2.0MB

            • memory/640-65-0x0000000006C00000-0x0000000006E04000-memory.dmp

              Filesize

              2.0MB

            • memory/640-67-0x0000000006C00000-0x0000000006E04000-memory.dmp

              Filesize

              2.0MB

            • memory/640-59-0x0000000006C00000-0x0000000006E04000-memory.dmp

              Filesize

              2.0MB

            • memory/640-4-0x0000000006C00000-0x0000000006E04000-memory.dmp

              Filesize

              2.0MB

            • memory/640-41-0x0000000006C00000-0x0000000006E04000-memory.dmp

              Filesize

              2.0MB

            • memory/640-33-0x0000000006C00000-0x0000000006E04000-memory.dmp

              Filesize

              2.0MB

            • memory/640-29-0x0000000006C00000-0x0000000006E04000-memory.dmp

              Filesize

              2.0MB

            • memory/640-25-0x0000000006C00000-0x0000000006E04000-memory.dmp

              Filesize

              2.0MB

            • memory/640-21-0x0000000006C00000-0x0000000006E04000-memory.dmp

              Filesize

              2.0MB

            • memory/640-5-0x0000000006C00000-0x0000000006E04000-memory.dmp

              Filesize

              2.0MB

            • memory/640-13-0x0000000006C00000-0x0000000006E04000-memory.dmp

              Filesize

              2.0MB

            • memory/640-936-0x0000000002B70000-0x0000000002B71000-memory.dmp

              Filesize

              4KB

            • memory/640-938-0x0000000006F80000-0x0000000006FCC000-memory.dmp

              Filesize

              304KB

            • memory/640-937-0x0000000007110000-0x00000000072B2000-memory.dmp

              Filesize

              1.6MB

            • memory/640-939-0x0000000007920000-0x0000000007EC4000-memory.dmp

              Filesize

              5.6MB

            • memory/640-945-0x0000000074CA0000-0x0000000075450000-memory.dmp

              Filesize

              7.7MB

            • memory/640-0-0x0000000074CA0000-0x0000000075450000-memory.dmp

              Filesize

              7.7MB

            • memory/640-1-0x0000000000740000-0x000000000075C000-memory.dmp

              Filesize

              112KB

            • memory/640-2-0x0000000005100000-0x0000000005110000-memory.dmp

              Filesize

              64KB

            • memory/640-3-0x0000000006C00000-0x0000000006E0A000-memory.dmp

              Filesize

              2.0MB

            • memory/4480-943-0x0000000000400000-0x0000000000592000-memory.dmp

              Filesize

              1.6MB

            • memory/4480-944-0x0000000074CA0000-0x0000000075450000-memory.dmp

              Filesize

              7.7MB

            • memory/4480-951-0x0000000005F70000-0x0000000006002000-memory.dmp

              Filesize

              584KB

            • memory/4480-955-0x0000000006E60000-0x0000000006E68000-memory.dmp

              Filesize

              32KB

            • memory/4480-956-0x0000000006E80000-0x0000000006E9E000-memory.dmp

              Filesize

              120KB

            • memory/4480-954-0x0000000006E50000-0x0000000006E5A000-memory.dmp

              Filesize

              40KB

            • memory/4480-1013-0x00000000077B0000-0x0000000007842000-memory.dmp

              Filesize

              584KB

            • memory/4480-953-0x0000000006030000-0x0000000006038000-memory.dmp

              Filesize

              32KB

            • memory/4480-1239-0x00000000057C0000-0x00000000057D0000-memory.dmp

              Filesize

              64KB

            • memory/4480-952-0x0000000006000000-0x0000000006026000-memory.dmp

              Filesize

              152KB

            • memory/4480-1113-0x00000000057C0000-0x00000000057D0000-memory.dmp

              Filesize

              64KB

            • memory/4480-1148-0x0000000006FE0000-0x000000000705A000-memory.dmp

              Filesize

              488KB

            • memory/4480-1221-0x00000000072A0000-0x0000000007352000-memory.dmp

              Filesize

              712KB

            • memory/4480-1223-0x0000000007100000-0x0000000007122000-memory.dmp

              Filesize

              136KB

            • memory/4480-1224-0x00000000088B0000-0x0000000008C04000-memory.dmp

              Filesize

              3.3MB

            • memory/4480-1225-0x0000000074CA0000-0x0000000075450000-memory.dmp

              Filesize

              7.7MB

            • memory/4480-1226-0x00000000057C0000-0x00000000057D0000-memory.dmp

              Filesize

              64KB

            • memory/4480-946-0x0000000005710000-0x0000000005776000-memory.dmp

              Filesize

              408KB

            • memory/4480-1238-0x0000000007730000-0x000000000773A000-memory.dmp

              Filesize

              40KB

            • memory/4480-947-0x00000000057C0000-0x00000000057D0000-memory.dmp

              Filesize

              64KB