Analysis

  • max time kernel
    151s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-03-2024 15:52

General

  • Target

    EdUpdMachine.exe

  • Size

    131.6MB

  • MD5

    0aabf386604e94f11fdbd56778bb8234

  • SHA1

    54b3f0ff8d93b42da1c353d64fc71509e9b26255

  • SHA256

    d373492b42a14e6b91b4a64c89086e19d2a166710fa237bbda80b6d0c1a7ad8a

  • SHA512

    d0d227af2d41c02e03ef25bd980b2347188bcb054b1e8f77685fc87ef5ece0f56c60115ea15dec9d5e66f8bf16f314b3cad4d23f8baf8d343e750937fa5e82c6

  • SSDEEP

    196608:AYic7JWa0zYsJuY5nqAgX3qs8QoSUcEGnUlFk/nlewwMQ/i:AE9P0H8YgoSUwCFile3MQ

Malware Config

Signatures

  • Detect ZGRat V1 34 IoCs
  • PureLog Stealer

    PureLog Stealer is an infostealer written in C#.

  • PureLog Stealer payload 1 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Drops file in Drivers directory 1 IoCs
  • Stops running service(s) 3 TTPs
  • Suspicious use of SetThreadContext 2 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3384
      • C:\Users\Admin\AppData\Local\Temp\EdUpdMachine.exe
        "C:\Users\Admin\AppData\Local\Temp\EdUpdMachine.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1456
        • C:\Users\Admin\AppData\Local\Temp\EdUpdMachine.exe
          C:\Users\Admin\AppData\Local\Temp\EdUpdMachine.exe
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Drops file in Drivers directory
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4456
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4412
        • C:\Windows\System32\sc.exe
          sc stop UsoSvc
          3⤵
          • Launches sc.exe
          PID:1756
        • C:\Windows\System32\sc.exe
          sc stop WaaSMedicSvc
          3⤵
          • Launches sc.exe
          PID:1604
        • C:\Windows\System32\sc.exe
          sc stop wuauserv
          3⤵
          • Launches sc.exe
          PID:3368
        • C:\Windows\System32\sc.exe
          sc stop bits
          3⤵
          • Launches sc.exe
          PID:1368
        • C:\Windows\System32\sc.exe
          sc stop dosvc
          3⤵
          • Launches sc.exe
          PID:1992
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:5000
        • C:\Windows\System32\powercfg.exe
          powercfg /x -hibernate-timeout-ac 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4112
        • C:\Windows\System32\powercfg.exe
          powercfg /x -hibernate-timeout-dc 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4756
        • C:\Windows\System32\powercfg.exe
          powercfg /x -standby-timeout-ac 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:968
        • C:\Windows\System32\powercfg.exe
          powercfg /x -standby-timeout-dc 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4452
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:448

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/448-951-0x0000023FD5BD0000-0x0000023FD5BF0000-memory.dmp

      Filesize

      128KB

    • memory/448-958-0x0000023F80050000-0x0000023F80070000-memory.dmp

      Filesize

      128KB

    • memory/448-955-0x0000023F80050000-0x0000023F80070000-memory.dmp

      Filesize

      128KB

    • memory/1456-38-0x00000210EF2C0000-0x00000210EF9FB000-memory.dmp

      Filesize

      7.2MB

    • memory/1456-6-0x00000210EF2C0000-0x00000210EF9FB000-memory.dmp

      Filesize

      7.2MB

    • memory/1456-5-0x00000210EF2C0000-0x00000210EF9FB000-memory.dmp

      Filesize

      7.2MB

    • memory/1456-42-0x00000210EF2C0000-0x00000210EF9FB000-memory.dmp

      Filesize

      7.2MB

    • memory/1456-8-0x00000210EF2C0000-0x00000210EF9FB000-memory.dmp

      Filesize

      7.2MB

    • memory/1456-10-0x00000210EF2C0000-0x00000210EF9FB000-memory.dmp

      Filesize

      7.2MB

    • memory/1456-12-0x00000210EF2C0000-0x00000210EF9FB000-memory.dmp

      Filesize

      7.2MB

    • memory/1456-14-0x00000210EF2C0000-0x00000210EF9FB000-memory.dmp

      Filesize

      7.2MB

    • memory/1456-16-0x00000210EF2C0000-0x00000210EF9FB000-memory.dmp

      Filesize

      7.2MB

    • memory/1456-18-0x00000210EF2C0000-0x00000210EF9FB000-memory.dmp

      Filesize

      7.2MB

    • memory/1456-40-0x00000210EF2C0000-0x00000210EF9FB000-memory.dmp

      Filesize

      7.2MB

    • memory/1456-22-0x00000210EF2C0000-0x00000210EF9FB000-memory.dmp

      Filesize

      7.2MB

    • memory/1456-44-0x00000210EF2C0000-0x00000210EF9FB000-memory.dmp

      Filesize

      7.2MB

    • memory/1456-26-0x00000210EF2C0000-0x00000210EF9FB000-memory.dmp

      Filesize

      7.2MB

    • memory/1456-28-0x00000210EF2C0000-0x00000210EF9FB000-memory.dmp

      Filesize

      7.2MB

    • memory/1456-30-0x00000210EF2C0000-0x00000210EF9FB000-memory.dmp

      Filesize

      7.2MB

    • memory/1456-32-0x00000210EF2C0000-0x00000210EF9FB000-memory.dmp

      Filesize

      7.2MB

    • memory/1456-34-0x00000210EF2C0000-0x00000210EF9FB000-memory.dmp

      Filesize

      7.2MB

    • memory/1456-36-0x00000210EF2C0000-0x00000210EF9FB000-memory.dmp

      Filesize

      7.2MB

    • memory/1456-0-0x00000210D3EC0000-0x00000210D4608000-memory.dmp

      Filesize

      7.3MB

    • memory/1456-20-0x00000210EF2C0000-0x00000210EF9FB000-memory.dmp

      Filesize

      7.2MB

    • memory/1456-4-0x00000210EF2C0000-0x00000210EFA00000-memory.dmp

      Filesize

      7.2MB

    • memory/1456-24-0x00000210EF2C0000-0x00000210EF9FB000-memory.dmp

      Filesize

      7.2MB

    • memory/1456-48-0x00000210EF2C0000-0x00000210EF9FB000-memory.dmp

      Filesize

      7.2MB

    • memory/1456-50-0x00000210EF2C0000-0x00000210EF9FB000-memory.dmp

      Filesize

      7.2MB

    • memory/1456-46-0x00000210EF2C0000-0x00000210EF9FB000-memory.dmp

      Filesize

      7.2MB

    • memory/1456-52-0x00000210EF2C0000-0x00000210EF9FB000-memory.dmp

      Filesize

      7.2MB

    • memory/1456-54-0x00000210EF2C0000-0x00000210EF9FB000-memory.dmp

      Filesize

      7.2MB

    • memory/1456-56-0x00000210EF2C0000-0x00000210EF9FB000-memory.dmp

      Filesize

      7.2MB

    • memory/1456-58-0x00000210EF2C0000-0x00000210EF9FB000-memory.dmp

      Filesize

      7.2MB

    • memory/1456-60-0x00000210EF2C0000-0x00000210EF9FB000-memory.dmp

      Filesize

      7.2MB

    • memory/1456-62-0x00000210EF2C0000-0x00000210EF9FB000-memory.dmp

      Filesize

      7.2MB

    • memory/1456-64-0x00000210EF2C0000-0x00000210EF9FB000-memory.dmp

      Filesize

      7.2MB

    • memory/1456-66-0x00000210EF2C0000-0x00000210EF9FB000-memory.dmp

      Filesize

      7.2MB

    • memory/1456-68-0x00000210EF2C0000-0x00000210EF9FB000-memory.dmp

      Filesize

      7.2MB

    • memory/1456-937-0x00000210D49C0000-0x00000210D49C1000-memory.dmp

      Filesize

      4KB

    • memory/1456-938-0x00000210EFA00000-0x00000210F00D8000-memory.dmp

      Filesize

      6.8MB

    • memory/1456-939-0x00000210D4A10000-0x00000210D4A5C000-memory.dmp

      Filesize

      304KB

    • memory/1456-943-0x00007FFDB2610000-0x00007FFDB30D1000-memory.dmp

      Filesize

      10.8MB

    • memory/1456-1-0x00007FFDB2610000-0x00007FFDB30D1000-memory.dmp

      Filesize

      10.8MB

    • memory/1456-2-0x00000210D4A00000-0x00000210D4A10000-memory.dmp

      Filesize

      64KB

    • memory/1456-3-0x00000210EEB80000-0x00000210EF2C0000-memory.dmp

      Filesize

      7.2MB

    • memory/4456-950-0x0000000140000000-0x0000000140985000-memory.dmp

      Filesize

      9.5MB

    • memory/4456-945-0x0000000140000000-0x0000000140985000-memory.dmp

      Filesize

      9.5MB