Resubmissions
14/01/2025, 09:11
250114-k5qwmatndx29/02/2024, 21:21
240229-z7ptnsch3w23/02/2024, 03:45
240223-ea6qpsaf9t1023/02/2024, 02:03
240223-cg4htahg5x10Analysis
- max time kernel
122s - max time network
147s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
23/02/2024, 03:45
General
- Target e268df66fb92ff6e5b2719279c5bee5383d56a4b97add2c7dc0ede45d2aec175.exe
- Size 1.4MB
- Sample240223-ea6qpsaf9t
- SHA256 e268df66fb92ff6e5b2719279c5bee5383d56a4b97add2c7dc0ede45d2aec175
Malware Config
Signatures
- Detect ZGRat V1 34 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Loads dropped DLL 1 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e268df66fb92ff6e5b2719279c5bee5383d56a4b97add2c7dc0ede45d2aec175.exe"C:\Users\Admin\AppData\Local\Temp\e268df66fb92ff6e5b2719279c5bee5383d56a4b97add2c7dc0ede45d2aec175.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e268df66fb92ff6e5b2719279c5bee5383d56a4b97add2c7dc0ede45d2aec175.exeC:\Users\Admin\AppData\Local\Temp\e268df66fb92ff6e5b2719279c5bee5383d56a4b97add2c7dc0ede45d2aec175.exe2⤵
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Jqrwlqupfig.tmp
sqlite.interop.dll
memory/2184-0-0x0000000000160000-0x00000000002D6000-memory.dmp
memory/2184-1-0x000007FEF5690000-0x000007FEF607C000-memory.dmp
memory/2184-2-0x000000001B2B0000-0x000000001B330000-memory.dmp
memory/2184-3-0x000000001BF70000-0x000000001C0E4000-memory.dmp
memory/2184-4-0x000000001BF70000-0x000000001C0DE000-memory.dmp
memory/2184-5-0x000000001BF70000-0x000000001C0DE000-memory.dmp
memory/2184-7-0x000000001BF70000-0x000000001C0DE000-memory.dmp
memory/2184-9-0x000000001BF70000-0x000000001C0DE000-memory.dmp
memory/2184-11-0x000000001BF70000-0x000000001C0DE000-memory.dmp
memory/2184-13-0x000000001BF70000-0x000000001C0DE000-memory.dmp
memory/2184-15-0x000000001BF70000-0x000000001C0DE000-memory.dmp
memory/2184-17-0x000000001BF70000-0x000000001C0DE000-memory.dmp
memory/2184-21-0x000000001BF70000-0x000000001C0DE000-memory.dmp
memory/2184-19-0x000000001BF70000-0x000000001C0DE000-memory.dmp
memory/2184-27-0x000000001BF70000-0x000000001C0DE000-memory.dmp
memory/2184-25-0x000000001BF70000-0x000000001C0DE000-memory.dmp
memory/2184-23-0x000000001BF70000-0x000000001C0DE000-memory.dmp
memory/2184-29-0x000000001BF70000-0x000000001C0DE000-memory.dmp
memory/2184-31-0x000000001BF70000-0x000000001C0DE000-memory.dmp
memory/2184-33-0x000000001BF70000-0x000000001C0DE000-memory.dmp
memory/2184-35-0x000000001BF70000-0x000000001C0DE000-memory.dmp
memory/2184-37-0x000000001BF70000-0x000000001C0DE000-memory.dmp
memory/2184-39-0x000000001BF70000-0x000000001C0DE000-memory.dmp
memory/2184-41-0x000000001BF70000-0x000000001C0DE000-memory.dmp
memory/2184-43-0x000000001BF70000-0x000000001C0DE000-memory.dmp
memory/2184-45-0x000000001BF70000-0x000000001C0DE000-memory.dmp
memory/2184-47-0x000000001BF70000-0x000000001C0DE000-memory.dmp
memory/2184-49-0x000000001BF70000-0x000000001C0DE000-memory.dmp
memory/2184-51-0x000000001BF70000-0x000000001C0DE000-memory.dmp
memory/2184-53-0x000000001BF70000-0x000000001C0DE000-memory.dmp
memory/2184-55-0x000000001BF70000-0x000000001C0DE000-memory.dmp
memory/2184-57-0x000000001BF70000-0x000000001C0DE000-memory.dmp
memory/2184-63-0x000000001BF70000-0x000000001C0DE000-memory.dmp
memory/2184-65-0x000000001BF70000-0x000000001C0DE000-memory.dmp
memory/2184-61-0x000000001BF70000-0x000000001C0DE000-memory.dmp
memory/2184-59-0x000000001BF70000-0x000000001C0DE000-memory.dmp
memory/2184-67-0x000000001BF70000-0x000000001C0DE000-memory.dmp
memory/2184-1118-0x0000000000150000-0x0000000000151000-memory.dmp
memory/2184-1119-0x000000001C0E0000-0x000000001C1DE000-memory.dmp
memory/2184-1120-0x0000000000600000-0x000000000064C000-memory.dmp
memory/2184-1131-0x000007FEF5690000-0x000007FEF607C000-memory.dmp
memory/2520-1130-0x0000000140000000-0x00000001400D6000-memory.dmp
memory/2520-1132-0x000000001AB00000-0x000000001AC14000-memory.dmp
memory/2520-1133-0x000007FEF5690000-0x000007FEF607C000-memory.dmp
memory/2520-1136-0x000000001AE70000-0x000000001AEF0000-memory.dmp
memory/2520-3437-0x000000001AD20000-0x000000001ADBE000-memory.dmp
memory/2520-3438-0x000000001BB60000-0x000000001BD70000-memory.dmp
memory/2520-3443-0x000007FEF5690000-0x000007FEF607C000-memory.dmp
memory/2520-3444-0x000000001AE70000-0x000000001AEF0000-memory.dmp
memory/2520-3445-0x000000001BE70000-0x000000001BEEA000-memory.dmp
memory/2520-3446-0x000000001B2A0000-0x000000001B30C000-memory.dmp
memory/2520-3449-0x0000000002160000-0x0000000002185000-memory.dmp
memory/2520-3469-0x000007FEF5690000-0x000007FEF607C000-memory.dmp