Analysis

  • max time kernel
    145s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-03-2024 14:02

General

  • Target

    ATM Dekont E-Maili pdf.exe

  • Size

    320KB

  • MD5

    857f57632320c296ed42603d5dc50753

  • SHA1

    5383f9059896b7f871d7c974ed887aced42789f7

  • SHA256

    7199c9f3d8524e27b8fd14131f0992eb16433d0aa21563805f7fee29e773e719

  • SHA512

    269b4f8961667c44edef79527cb70b5b53e5dd062fc4a4e28ab79ba4049415c29499b0cb1f9f0967a03dda197a3ff3784316e73171e479449daa461230da4930

  • SSDEEP

    6144:6PBJmR7777rL0DWuRbao46Li4/bPrCt9UHNxizH+zyfw4spWJy:6PmjuRbn4qjTPOtQNxDzyo4spl

Malware Config

Signatures

  • Detect ZGRat V1 34 IoCs
  • PureLog Stealer

    PureLog Stealer is an infostealer written in C#.

  • PureLog Stealer payload 1 IoCs
  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 1 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ATM Dekont E-Maili pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\ATM Dekont E-Maili pdf.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3440
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:4556

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3440-0-0x00000162D1770000-0x00000162D17C4000-memory.dmp

    Filesize

    336KB

  • memory/3440-1-0x00000162D3440000-0x00000162D344C000-memory.dmp

    Filesize

    48KB

  • memory/3440-2-0x00007FFA4D9D0000-0x00007FFA4E491000-memory.dmp

    Filesize

    10.8MB

  • memory/3440-3-0x00000162D3470000-0x00000162D3480000-memory.dmp

    Filesize

    64KB

  • memory/3440-4-0x00000162EBE00000-0x00000162EBFF4000-memory.dmp

    Filesize

    2.0MB

  • memory/3440-5-0x00000162EBE00000-0x00000162EBFED000-memory.dmp

    Filesize

    1.9MB

  • memory/3440-6-0x00000162EBE00000-0x00000162EBFED000-memory.dmp

    Filesize

    1.9MB

  • memory/3440-8-0x00000162EBE00000-0x00000162EBFED000-memory.dmp

    Filesize

    1.9MB

  • memory/3440-10-0x00000162EBE00000-0x00000162EBFED000-memory.dmp

    Filesize

    1.9MB

  • memory/3440-12-0x00000162EBE00000-0x00000162EBFED000-memory.dmp

    Filesize

    1.9MB

  • memory/3440-14-0x00000162EBE00000-0x00000162EBFED000-memory.dmp

    Filesize

    1.9MB

  • memory/3440-16-0x00000162EBE00000-0x00000162EBFED000-memory.dmp

    Filesize

    1.9MB

  • memory/3440-18-0x00000162EBE00000-0x00000162EBFED000-memory.dmp

    Filesize

    1.9MB

  • memory/3440-20-0x00000162EBE00000-0x00000162EBFED000-memory.dmp

    Filesize

    1.9MB

  • memory/3440-24-0x00000162EBE00000-0x00000162EBFED000-memory.dmp

    Filesize

    1.9MB

  • memory/3440-22-0x00000162EBE00000-0x00000162EBFED000-memory.dmp

    Filesize

    1.9MB

  • memory/3440-26-0x00000162EBE00000-0x00000162EBFED000-memory.dmp

    Filesize

    1.9MB

  • memory/3440-28-0x00000162EBE00000-0x00000162EBFED000-memory.dmp

    Filesize

    1.9MB

  • memory/3440-30-0x00000162EBE00000-0x00000162EBFED000-memory.dmp

    Filesize

    1.9MB

  • memory/3440-32-0x00000162EBE00000-0x00000162EBFED000-memory.dmp

    Filesize

    1.9MB

  • memory/3440-34-0x00000162EBE00000-0x00000162EBFED000-memory.dmp

    Filesize

    1.9MB

  • memory/3440-36-0x00000162EBE00000-0x00000162EBFED000-memory.dmp

    Filesize

    1.9MB

  • memory/3440-38-0x00000162EBE00000-0x00000162EBFED000-memory.dmp

    Filesize

    1.9MB

  • memory/3440-40-0x00000162EBE00000-0x00000162EBFED000-memory.dmp

    Filesize

    1.9MB

  • memory/3440-44-0x00000162EBE00000-0x00000162EBFED000-memory.dmp

    Filesize

    1.9MB

  • memory/3440-42-0x00000162EBE00000-0x00000162EBFED000-memory.dmp

    Filesize

    1.9MB

  • memory/3440-46-0x00000162EBE00000-0x00000162EBFED000-memory.dmp

    Filesize

    1.9MB

  • memory/3440-48-0x00000162EBE00000-0x00000162EBFED000-memory.dmp

    Filesize

    1.9MB

  • memory/3440-52-0x00000162EBE00000-0x00000162EBFED000-memory.dmp

    Filesize

    1.9MB

  • memory/3440-50-0x00000162EBE00000-0x00000162EBFED000-memory.dmp

    Filesize

    1.9MB

  • memory/3440-54-0x00000162EBE00000-0x00000162EBFED000-memory.dmp

    Filesize

    1.9MB

  • memory/3440-56-0x00000162EBE00000-0x00000162EBFED000-memory.dmp

    Filesize

    1.9MB

  • memory/3440-58-0x00000162EBE00000-0x00000162EBFED000-memory.dmp

    Filesize

    1.9MB

  • memory/3440-60-0x00000162EBE00000-0x00000162EBFED000-memory.dmp

    Filesize

    1.9MB

  • memory/3440-62-0x00000162EBE00000-0x00000162EBFED000-memory.dmp

    Filesize

    1.9MB

  • memory/3440-64-0x00000162EBE00000-0x00000162EBFED000-memory.dmp

    Filesize

    1.9MB

  • memory/3440-66-0x00000162EBE00000-0x00000162EBFED000-memory.dmp

    Filesize

    1.9MB

  • memory/3440-68-0x00000162EBE00000-0x00000162EBFED000-memory.dmp

    Filesize

    1.9MB

  • memory/3440-2219-0x00007FFA4D9D0000-0x00007FFA4E491000-memory.dmp

    Filesize

    10.8MB

  • memory/3440-2851-0x00000162D3470000-0x00000162D3480000-memory.dmp

    Filesize

    64KB

  • memory/3440-4783-0x00000162D3580000-0x00000162D3581000-memory.dmp

    Filesize

    4KB

  • memory/3440-4784-0x00000162D36F0000-0x00000162D372A000-memory.dmp

    Filesize

    232KB

  • memory/3440-4785-0x00000162EC060000-0x00000162EC0AC000-memory.dmp

    Filesize

    304KB

  • memory/3440-4790-0x00007FFA4D9D0000-0x00007FFA4E491000-memory.dmp

    Filesize

    10.8MB

  • memory/4556-4789-0x0000000140000000-0x0000000140024000-memory.dmp

    Filesize

    144KB

  • memory/4556-4791-0x00007FFA4D9D0000-0x00007FFA4E491000-memory.dmp

    Filesize

    10.8MB

  • memory/4556-4792-0x000001C644060000-0x000001C644070000-memory.dmp

    Filesize

    64KB

  • memory/4556-4793-0x000001C65E2F0000-0x000001C65E340000-memory.dmp

    Filesize

    320KB

  • memory/4556-4794-0x000001C65E510000-0x000001C65E6D2000-memory.dmp

    Filesize

    1.8MB

  • memory/4556-4795-0x00007FFA4D9D0000-0x00007FFA4E491000-memory.dmp

    Filesize

    10.8MB

  • memory/4556-4796-0x000001C644060000-0x000001C644070000-memory.dmp

    Filesize

    64KB