Analysis
- max time kernel
150s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
27/03/2024, 11:51
General
- Target e199b649f562ee61d10b1f77a77fef2a3bf0c1f870e4aa9958402a4059f2fa1c.exe
- Size 2.5MB
- Sample240327-n1f3eaee9y
- SHA256 e199b649f562ee61d10b1f77a77fef2a3bf0c1f870e4aa9958402a4059f2fa1c
Malware Config
Signatures
- Detect ZGRat V1 32 IoCs
- PureLog Stealer
PureLog Stealer is an infostealer written in C#.
- PureLog Stealer payload 2 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Drops startup file 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e199b649f562ee61d10b1f77a77fef2a3bf0c1f870e4aa9958402a4059f2fa1c.exe"C:\Users\Admin\AppData\Local\Temp\e199b649f562ee61d10b1f77a77fef2a3bf0c1f870e4aa9958402a4059f2fa1c.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3852 --field-trial-handle=2228,i,521073434451423547,2311651514500527526,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1452-957-0x0000000000400000-0x000000000040E000-memory.dmp
memory/1452-960-0x0000000074EF0000-0x00000000756A0000-memory.dmp
memory/1452-962-0x0000000005250000-0x0000000005260000-memory.dmp
memory/1452-984-0x0000000006110000-0x00000000061A2000-memory.dmp
memory/1452-985-0x00000000060F0000-0x00000000060FA000-memory.dmp
memory/1452-987-0x0000000005250000-0x0000000005260000-memory.dmp
memory/1452-986-0x0000000074EF0000-0x00000000756A0000-memory.dmp
memory/3052-34-0x00000000056E0000-0x0000000005774000-memory.dmp
memory/3052-42-0x00000000056E0000-0x0000000005774000-memory.dmp
memory/3052-6-0x00000000055B0000-0x00000000055C0000-memory.dmp
memory/3052-7-0x00000000055B0000-0x00000000055C0000-memory.dmp
memory/3052-8-0x00000000055B0000-0x00000000055C0000-memory.dmp
memory/3052-9-0x00000000053D0000-0x000000000546C000-memory.dmp
memory/3052-10-0x00000000056E0000-0x000000000577A000-memory.dmp
memory/3052-11-0x00000000056E0000-0x0000000005774000-memory.dmp
memory/3052-12-0x00000000056E0000-0x0000000005774000-memory.dmp
memory/3052-14-0x00000000056E0000-0x0000000005774000-memory.dmp
memory/3052-16-0x00000000056E0000-0x0000000005774000-memory.dmp
memory/3052-18-0x00000000056E0000-0x0000000005774000-memory.dmp
memory/3052-20-0x00000000056E0000-0x0000000005774000-memory.dmp
memory/3052-22-0x00000000056E0000-0x0000000005774000-memory.dmp
memory/3052-24-0x00000000056E0000-0x0000000005774000-memory.dmp
memory/3052-26-0x00000000056E0000-0x0000000005774000-memory.dmp
memory/3052-28-0x00000000056E0000-0x0000000005774000-memory.dmp
memory/3052-30-0x00000000056E0000-0x0000000005774000-memory.dmp
memory/3052-32-0x00000000056E0000-0x0000000005774000-memory.dmp
memory/3052-4-0x00000000055C0000-0x00000000056E6000-memory.dmp
memory/3052-36-0x00000000056E0000-0x0000000005774000-memory.dmp
memory/3052-38-0x00000000056E0000-0x0000000005774000-memory.dmp
memory/3052-40-0x00000000056E0000-0x0000000005774000-memory.dmp
memory/3052-5-0x0000000074EF0000-0x00000000756A0000-memory.dmp
memory/3052-44-0x00000000056E0000-0x0000000005774000-memory.dmp
memory/3052-46-0x00000000056E0000-0x0000000005774000-memory.dmp
memory/3052-48-0x00000000056E0000-0x0000000005774000-memory.dmp
memory/3052-50-0x00000000056E0000-0x0000000005774000-memory.dmp
memory/3052-52-0x00000000056E0000-0x0000000005774000-memory.dmp
memory/3052-54-0x00000000056E0000-0x0000000005774000-memory.dmp
memory/3052-56-0x00000000056E0000-0x0000000005774000-memory.dmp
memory/3052-58-0x00000000056E0000-0x0000000005774000-memory.dmp
memory/3052-60-0x00000000056E0000-0x0000000005774000-memory.dmp
memory/3052-62-0x00000000056E0000-0x0000000005774000-memory.dmp
memory/3052-64-0x00000000056E0000-0x0000000005774000-memory.dmp
memory/3052-66-0x00000000056E0000-0x0000000005774000-memory.dmp
memory/3052-68-0x00000000056E0000-0x0000000005774000-memory.dmp
memory/3052-70-0x00000000056E0000-0x0000000005774000-memory.dmp
memory/3052-944-0x0000000003070000-0x0000000003071000-memory.dmp
memory/3052-945-0x00000000057F0000-0x0000000005820000-memory.dmp
memory/3052-946-0x0000000005820000-0x000000000586C000-memory.dmp
memory/3052-947-0x0000000074EF0000-0x00000000756A0000-memory.dmp
memory/3052-949-0x00000000055B0000-0x00000000055C0000-memory.dmp
memory/3052-950-0x0000000005C30000-0x00000000061D4000-memory.dmp
memory/3052-1-0x0000000002630000-0x0000000002755000-memory.dmp
memory/3052-0-0x0000000000010000-0x0000000000294000-memory.dmp
memory/3052-953-0x00000000055B0000-0x00000000055C0000-memory.dmp
memory/3052-963-0x0000000074EF0000-0x00000000756A0000-memory.dmp