Analysis

  • max time kernel
    93s
  • max time network
    116s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-02-2024 06:27

General

  • Target

    a12c11f756f90c583890425f3a76a921.exe

  • Size

    756KB

  • MD5

    a12c11f756f90c583890425f3a76a921

  • SHA1

    012738d0119b247d323a22391d901780033b7610

  • SHA256

    73e0d4f10e0f6d61bab433d14f75ea26392838fad4a491db5b24512055c49602

  • SHA512

    9ec1f61f625bc350cfe1423061b36b0812d97986d112eb437635754c11d5c8b855ede4c6355415bbac31449c7d031f1ba6fdb1a087498f4db1872dae6f288b59

  • SSDEEP

    12288:cr9vM3/EZrmFcutwSpsx5dC0YoTkNzi0DmW/t6giEAVZWeKlewlcatFbAS01pZAB:chvM3/ZwGsx5Bgi92thAfWLvlcYCS0dL

Malware Config

Extracted

Family

blustealer

Credentials

  • Protocol:
    smtp
  • Host:
    netjul.shop
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    mQJrXsvkEb#S

Signatures

  • BluStealer

    A Modular information stealer written in Visual Basic.

  • Detect ZGRat V1 34 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a12c11f756f90c583890425f3a76a921.exe
    "C:\Users\Admin\AppData\Local\Temp\a12c11f756f90c583890425f3a76a921.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1924
    • C:\Users\Admin\AppData\Local\Temp\a12c11f756f90c583890425f3a76a921.exe
      C:\Users\Admin\AppData\Local\Temp\a12c11f756f90c583890425f3a76a921.exe
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:2772

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1924-0-0x0000000000520000-0x00000000005E4000-memory.dmp

    Filesize

    784KB

  • memory/1924-1-0x0000000074860000-0x0000000075010000-memory.dmp

    Filesize

    7.7MB

  • memory/1924-2-0x00000000055F0000-0x0000000005B94000-memory.dmp

    Filesize

    5.6MB

  • memory/1924-3-0x0000000005040000-0x00000000050D2000-memory.dmp

    Filesize

    584KB

  • memory/1924-4-0x0000000005190000-0x00000000051A0000-memory.dmp

    Filesize

    64KB

  • memory/1924-5-0x0000000004FD0000-0x0000000004FDA000-memory.dmp

    Filesize

    40KB

  • memory/1924-6-0x0000000074860000-0x0000000075010000-memory.dmp

    Filesize

    7.7MB

  • memory/1924-7-0x0000000006810000-0x00000000068C2000-memory.dmp

    Filesize

    712KB

  • memory/1924-8-0x0000000006CC0000-0x0000000006D48000-memory.dmp

    Filesize

    544KB

  • memory/1924-10-0x0000000006CC0000-0x0000000006D42000-memory.dmp

    Filesize

    520KB

  • memory/1924-9-0x0000000006CC0000-0x0000000006D42000-memory.dmp

    Filesize

    520KB

  • memory/1924-12-0x0000000006CC0000-0x0000000006D42000-memory.dmp

    Filesize

    520KB

  • memory/1924-14-0x0000000006CC0000-0x0000000006D42000-memory.dmp

    Filesize

    520KB

  • memory/1924-16-0x0000000006CC0000-0x0000000006D42000-memory.dmp

    Filesize

    520KB

  • memory/1924-18-0x0000000006CC0000-0x0000000006D42000-memory.dmp

    Filesize

    520KB

  • memory/1924-20-0x0000000006CC0000-0x0000000006D42000-memory.dmp

    Filesize

    520KB

  • memory/1924-26-0x0000000006CC0000-0x0000000006D42000-memory.dmp

    Filesize

    520KB

  • memory/1924-24-0x0000000006CC0000-0x0000000006D42000-memory.dmp

    Filesize

    520KB

  • memory/1924-22-0x0000000006CC0000-0x0000000006D42000-memory.dmp

    Filesize

    520KB

  • memory/1924-28-0x0000000006CC0000-0x0000000006D42000-memory.dmp

    Filesize

    520KB

  • memory/1924-30-0x0000000006CC0000-0x0000000006D42000-memory.dmp

    Filesize

    520KB

  • memory/1924-38-0x0000000006CC0000-0x0000000006D42000-memory.dmp

    Filesize

    520KB

  • memory/1924-36-0x0000000006CC0000-0x0000000006D42000-memory.dmp

    Filesize

    520KB

  • memory/1924-34-0x0000000006CC0000-0x0000000006D42000-memory.dmp

    Filesize

    520KB

  • memory/1924-40-0x0000000006CC0000-0x0000000006D42000-memory.dmp

    Filesize

    520KB

  • memory/1924-32-0x0000000006CC0000-0x0000000006D42000-memory.dmp

    Filesize

    520KB

  • memory/1924-42-0x0000000006CC0000-0x0000000006D42000-memory.dmp

    Filesize

    520KB

  • memory/1924-44-0x0000000006CC0000-0x0000000006D42000-memory.dmp

    Filesize

    520KB

  • memory/1924-46-0x0000000006CC0000-0x0000000006D42000-memory.dmp

    Filesize

    520KB

  • memory/1924-50-0x0000000006CC0000-0x0000000006D42000-memory.dmp

    Filesize

    520KB

  • memory/1924-48-0x0000000006CC0000-0x0000000006D42000-memory.dmp

    Filesize

    520KB

  • memory/1924-66-0x0000000006CC0000-0x0000000006D42000-memory.dmp

    Filesize

    520KB

  • memory/1924-64-0x0000000006CC0000-0x0000000006D42000-memory.dmp

    Filesize

    520KB

  • memory/1924-62-0x0000000006CC0000-0x0000000006D42000-memory.dmp

    Filesize

    520KB

  • memory/1924-60-0x0000000006CC0000-0x0000000006D42000-memory.dmp

    Filesize

    520KB

  • memory/1924-58-0x0000000006CC0000-0x0000000006D42000-memory.dmp

    Filesize

    520KB

  • memory/1924-56-0x0000000006CC0000-0x0000000006D42000-memory.dmp

    Filesize

    520KB

  • memory/1924-54-0x0000000006CC0000-0x0000000006D42000-memory.dmp

    Filesize

    520KB

  • memory/1924-52-0x0000000006CC0000-0x0000000006D42000-memory.dmp

    Filesize

    520KB

  • memory/1924-72-0x0000000006CC0000-0x0000000006D42000-memory.dmp

    Filesize

    520KB

  • memory/1924-70-0x0000000006CC0000-0x0000000006D42000-memory.dmp

    Filesize

    520KB

  • memory/1924-68-0x0000000006CC0000-0x0000000006D42000-memory.dmp

    Filesize

    520KB

  • memory/1924-285-0x0000000005190000-0x00000000051A0000-memory.dmp

    Filesize

    64KB

  • memory/1924-2537-0x0000000074860000-0x0000000075010000-memory.dmp

    Filesize

    7.7MB

  • memory/2772-2538-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2772-2541-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB