Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
18/03/2024, 01:58
General
- Target NEW ORDER.exe
- Size 2.9MB
- Sample240318-cdyhdsdf86
- SHA256 88670303d986c2ab42c91bf120273ceb7df2754708fc871820ca084e1678f670
Malware Config
Signatures
- Detect ZGRat V1 35 IoCs
- PureLog Stealer
PureLog Stealer is an infostealer written in C#.
- PureLog Stealer payload 1 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Loads dropped DLL 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
sqlite.interop.dll
Mjprzpru.tmp
Udhgt.tmp
memory/1184-7101-0x0000000006260000-0x0000000006281000-memory.dmp
memory/1184-7092-0x0000000008BC0000-0x0000000008C52000-memory.dmp
memory/1184-7100-0x00000000062B0000-0x00000000062EC000-memory.dmp
memory/1184-7096-0x00000000061E0000-0x000000000622C000-memory.dmp
memory/1184-7095-0x0000000005E80000-0x00000000061D4000-memory.dmp
memory/1184-7094-0x0000000005CB0000-0x0000000005D1C000-memory.dmp
memory/1184-7093-0x0000000005D60000-0x0000000005DDA000-memory.dmp
memory/1184-4791-0x0000000000400000-0x00000000004D8000-memory.dmp
memory/1184-7091-0x00000000088B0000-0x0000000008916000-memory.dmp
memory/1184-7140-0x0000000074AA0000-0x0000000075250000-memory.dmp
memory/1184-7086-0x0000000008280000-0x00000000085CC000-memory.dmp
memory/1184-7085-0x0000000006DE0000-0x0000000007022000-memory.dmp
memory/1184-7084-0x0000000074AA0000-0x0000000075250000-memory.dmp
memory/1184-7083-0x0000000005100000-0x000000000519E000-memory.dmp
memory/1184-4794-0x0000000004EF0000-0x0000000005006000-memory.dmp
memory/1184-4792-0x0000000074AA0000-0x0000000075250000-memory.dmp
memory/4304-26-0x00000000053B0000-0x000000000568B000-memory.dmp
memory/4304-4787-0x00000000073A0000-0x0000000007944000-memory.dmp
memory/4304-36-0x00000000053B0000-0x000000000568B000-memory.dmp
memory/4304-38-0x00000000053B0000-0x000000000568B000-memory.dmp
memory/4304-40-0x00000000053B0000-0x000000000568B000-memory.dmp
memory/4304-42-0x00000000053B0000-0x000000000568B000-memory.dmp
memory/4304-44-0x00000000053B0000-0x000000000568B000-memory.dmp
memory/4304-46-0x00000000053B0000-0x000000000568B000-memory.dmp
memory/4304-48-0x00000000053B0000-0x000000000568B000-memory.dmp
memory/4304-50-0x00000000053B0000-0x000000000568B000-memory.dmp
memory/4304-52-0x00000000053B0000-0x000000000568B000-memory.dmp
memory/4304-54-0x00000000053B0000-0x000000000568B000-memory.dmp
memory/4304-56-0x00000000053B0000-0x000000000568B000-memory.dmp
memory/4304-58-0x00000000053B0000-0x000000000568B000-memory.dmp
memory/4304-60-0x00000000053B0000-0x000000000568B000-memory.dmp
memory/4304-62-0x00000000053B0000-0x000000000568B000-memory.dmp
memory/4304-64-0x00000000053B0000-0x000000000568B000-memory.dmp
memory/4304-66-0x00000000053B0000-0x000000000568B000-memory.dmp
memory/4304-68-0x00000000053B0000-0x000000000568B000-memory.dmp
memory/4304-2113-0x0000000074AA0000-0x0000000075250000-memory.dmp
memory/4304-4784-0x00000000057E0000-0x00000000057E1000-memory.dmp
memory/4304-4785-0x0000000006CC0000-0x0000000006DE8000-memory.dmp
memory/4304-4786-0x0000000002860000-0x00000000028AC000-memory.dmp
memory/4304-34-0x00000000053B0000-0x000000000568B000-memory.dmp
memory/4304-4788-0x00000000059F0000-0x0000000005A44000-memory.dmp
memory/4304-32-0x00000000053B0000-0x000000000568B000-memory.dmp
memory/4304-4793-0x0000000074AA0000-0x0000000075250000-memory.dmp
memory/4304-30-0x00000000053B0000-0x000000000568B000-memory.dmp
memory/4304-28-0x00000000053B0000-0x000000000568B000-memory.dmp
memory/4304-0-0x0000000000400000-0x00000000006EE000-memory.dmp
memory/4304-24-0x00000000053B0000-0x000000000568B000-memory.dmp
memory/4304-22-0x00000000053B0000-0x000000000568B000-memory.dmp
memory/4304-20-0x00000000053B0000-0x000000000568B000-memory.dmp
memory/4304-18-0x00000000053B0000-0x000000000568B000-memory.dmp
memory/4304-16-0x00000000053B0000-0x000000000568B000-memory.dmp
memory/4304-14-0x00000000053B0000-0x000000000568B000-memory.dmp
memory/4304-12-0x00000000053B0000-0x000000000568B000-memory.dmp
memory/4304-10-0x00000000053B0000-0x000000000568B000-memory.dmp
memory/4304-8-0x00000000053B0000-0x000000000568B000-memory.dmp
memory/4304-6-0x00000000053B0000-0x000000000568B000-memory.dmp
memory/4304-5-0x00000000053B0000-0x000000000568B000-memory.dmp
memory/4304-4-0x00000000053B0000-0x0000000005692000-memory.dmp
memory/4304-3-0x0000000005060000-0x0000000005340000-memory.dmp
memory/4304-2-0x0000000005050000-0x0000000005060000-memory.dmp
memory/4304-1-0x0000000074AA0000-0x0000000075250000-memory.dmp