Analysis
- max time kernel
153s - max time network
159s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
26/03/2024, 08:59
General
- Target dec7bbc61e5fac7b9dcc798e85c6cffc.exe
- Size 2.6MB
- Sample240326-kxtmjsef96
- SHA256 ff067dcb1df6837231a965295ce09eb39ddc7856b72f23c59f8bd950bcc8c3f8
Malware Config
Extracted
-
blustealer
-
https://api.telegram.org/bot1949235546:AAFJ8hWHynuHinrzOjcAE-TQlS6bYGcf8J8/sendMessage?chat_id=1947722068
Signatures
- BluStealer
A Modular information stealer written in Visual Basic.
- Detect ZGRat V1 1 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dec7bbc61e5fac7b9dcc798e85c6cffc.exe"C:\Users\Admin\AppData\Local\Temp\dec7bbc61e5fac7b9dcc798e85c6cffc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dec7bbc61e5fac7b9dcc798e85c6cffc.exe"C:\Users\Admin\AppData\Local\Temp\dec7bbc61e5fac7b9dcc798e85c6cffc.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2628 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1160-6-0x0000000005310000-0x0000000005320000-memory.dmp
memory/1160-15-0x0000000074520000-0x0000000074CD0000-memory.dmp
memory/1160-2-0x0000000005480000-0x0000000005A24000-memory.dmp
memory/1160-3-0x0000000004F70000-0x0000000005002000-memory.dmp
memory/1160-4-0x0000000005010000-0x0000000005086000-memory.dmp
memory/1160-5-0x0000000005130000-0x00000000051CC000-memory.dmp
memory/1160-8-0x0000000005A30000-0x0000000005BAA000-memory.dmp
memory/1160-0-0x0000000074520000-0x0000000074CD0000-memory.dmp
memory/1160-1-0x00000000002B0000-0x0000000000554000-memory.dmp
memory/1160-9-0x0000000000F40000-0x0000000000F56000-memory.dmp
memory/1160-7-0x0000000004F30000-0x0000000004F4E000-memory.dmp
memory/2356-13-0x0000000000400000-0x0000000000478000-memory.dmp
memory/2356-10-0x0000000000400000-0x0000000000478000-memory.dmp
memory/2356-17-0x0000000000400000-0x0000000000478000-memory.dmp