Analysis
- max time kernel
0s - max time network
122s - platform
windows7_x64 - resource
win7-20240215-en - resource tags
- submitted
28/03/2024, 02:38
General
- Target d545f5b27e90abc54cf5a37c35e866c08336a500cecd95e8267c0c729a6b9bbc.exe
- Size 4.8MB
- Sample240328-c482tadc7x
- SHA256 d545f5b27e90abc54cf5a37c35e866c08336a500cecd95e8267c0c729a6b9bbc
Malware Config
Signatures
- Detect ZGRat V1 36 IoCs
- PureLog Stealer
PureLog Stealer is an infostealer written in C#.
- PureLog Stealer payload 4 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d545f5b27e90abc54cf5a37c35e866c08336a500cecd95e8267c0c729a6b9bbc.exe"C:\Users\Admin\AppData\Local\Temp\d545f5b27e90abc54cf5a37c35e866c08336a500cecd95e8267c0c729a6b9bbc.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs"2⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\update.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\update.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
run.vbs
setup.exe
update.exe
memory/2608-79-0x00000000057C0000-0x0000000005A14000-memory.dmp
memory/2608-75-0x00000000057C0000-0x0000000005A14000-memory.dmp
memory/2608-2688-0x00000000008B0000-0x00000000008F0000-memory.dmp
memory/2608-87-0x00000000057C0000-0x0000000005A14000-memory.dmp
memory/2608-19-0x00000000008B0000-0x00000000008F0000-memory.dmp
memory/2608-20-0x0000000072C50000-0x000000007333E000-memory.dmp
memory/2608-83-0x00000000057C0000-0x0000000005A14000-memory.dmp
memory/2608-21-0x0000000005560000-0x00000000057BA000-memory.dmp
memory/2608-23-0x00000000057C0000-0x0000000005A1A000-memory.dmp
memory/2608-56-0x00000000057C0000-0x0000000005A14000-memory.dmp
memory/2608-26-0x00000000057C0000-0x0000000005A14000-memory.dmp
memory/2608-16-0x0000000001240000-0x00000000014A6000-memory.dmp
memory/2608-28-0x00000000057C0000-0x0000000005A14000-memory.dmp
memory/2608-71-0x00000000057C0000-0x0000000005A14000-memory.dmp
memory/2608-32-0x00000000057C0000-0x0000000005A14000-memory.dmp
memory/2608-36-0x00000000057C0000-0x0000000005A14000-memory.dmp
memory/2608-67-0x00000000057C0000-0x0000000005A14000-memory.dmp
memory/2608-40-0x00000000057C0000-0x0000000005A14000-memory.dmp
memory/2608-63-0x00000000057C0000-0x0000000005A14000-memory.dmp
memory/2608-44-0x00000000057C0000-0x0000000005A14000-memory.dmp
memory/2608-2991-0x0000000072C50000-0x000000007333E000-memory.dmp
memory/2608-48-0x00000000057C0000-0x0000000005A14000-memory.dmp
memory/2608-60-0x00000000057C0000-0x0000000005A14000-memory.dmp
memory/2608-52-0x00000000057C0000-0x0000000005A14000-memory.dmp
memory/2624-43-0x0000000005250000-0x000000000546E000-memory.dmp
memory/2624-51-0x0000000005250000-0x000000000546E000-memory.dmp
memory/2624-55-0x0000000005250000-0x000000000546E000-memory.dmp
memory/2624-47-0x0000000005250000-0x000000000546E000-memory.dmp
memory/2624-59-0x0000000005250000-0x000000000546E000-memory.dmp
memory/2624-39-0x0000000005250000-0x000000000546E000-memory.dmp
memory/2624-64-0x0000000005250000-0x000000000546E000-memory.dmp
memory/2624-35-0x0000000005250000-0x000000000546E000-memory.dmp
memory/2624-68-0x0000000005250000-0x000000000546E000-memory.dmp
memory/2624-25-0x0000000005250000-0x000000000546E000-memory.dmp
memory/2624-72-0x0000000005250000-0x000000000546E000-memory.dmp
memory/2624-31-0x0000000005250000-0x000000000546E000-memory.dmp
memory/2624-76-0x0000000005250000-0x000000000546E000-memory.dmp
memory/2624-27-0x0000000005250000-0x000000000546E000-memory.dmp
memory/2624-80-0x0000000005250000-0x000000000546E000-memory.dmp
memory/2624-24-0x0000000005250000-0x0000000005474000-memory.dmp
memory/2624-84-0x0000000005250000-0x000000000546E000-memory.dmp
memory/2624-22-0x0000000005030000-0x0000000005252000-memory.dmp
memory/2624-88-0x0000000005250000-0x000000000546E000-memory.dmp
memory/2624-18-0x0000000004B90000-0x0000000004BD0000-memory.dmp
memory/2624-2382-0x0000000072C50000-0x000000007333E000-memory.dmp
memory/2624-2685-0x0000000004B90000-0x0000000004BD0000-memory.dmp
memory/2624-17-0x0000000072C50000-0x000000007333E000-memory.dmp
memory/2624-15-0x0000000000A80000-0x0000000000CB0000-memory.dmp