Overview

overview

10

Static

static

10

aa5e905630...11.exe

windows7-x64

10

aa5e905630...11.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    137s
  • max time network
    167s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-03-2024 02:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    aa5e905630fdcd343ea0c1bdc41c67ec3b60abcab50f2ed7bcfba931e7d30f11.exe

  • Size

    2.4MB

  • MD5

    749404f8b6bd72307f017d1fd8f3081e

  • SHA1

    84995cbfec91c10df85c97d0f7acec531dba455c

  • SHA256

    aa5e905630fdcd343ea0c1bdc41c67ec3b60abcab50f2ed7bcfba931e7d30f11

  • SHA512

    1be07e218ebbe3750c0a62d2ca69bd3be19732fcb99452e7df111df79bccd5039893b37fd8ab31af1ba27b1c40ec90efa3803b6b2023141ce496c033b8dfd112

  • SSDEEP

    49152:i5L4P8xfttrOoXDhNkxtOTBcziRLhT2vWkYd9n:OymFtrOGhNkxY9RcOkY

Score
10/10
purelogstealerzgratratstealer

Malware Config

Signatures

  • Detect ZGRat V1 34 IoCs
  • PureLog Stealer

    PureLog Stealer is an infostealer written in C#.

    stealerpurelogstealer
  • PureLog Stealer payload 1 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aa5e905630fdcd343ea0c1bdc41c67ec3b60abcab50f2ed7bcfba931e7d30f11.exe
    "C:\Users\Admin\AppData\Local\Temp\aa5e905630fdcd343ea0c1bdc41c67ec3b60abcab50f2ed7bcfba931e7d30f11.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:908
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4148 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:2260

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/908-0-0x00000000751E0000-0x0000000075990000-memory.dmp
      Filesize

      7.7MB

      Download
    • memory/908-1-0x0000000000440000-0x00000000006B2000-memory.dmp
      Filesize

      2.4MB

      Download
    • memory/908-2-0x0000000005120000-0x0000000005130000-memory.dmp
      Filesize

      64KB

      Download
    • memory/908-3-0x0000000005130000-0x0000000005362000-memory.dmp
      Filesize

      2.2MB

      Download
    • memory/908-4-0x00000000053D0000-0x0000000005600000-memory.dmp
      Filesize

      2.2MB

      Download
    • memory/908-5-0x00000000053D0000-0x00000000055FB000-memory.dmp
      Filesize

      2.2MB

      Download
    • memory/908-6-0x00000000053D0000-0x00000000055FB000-memory.dmp
      Filesize

      2.2MB

      Download
    • memory/908-8-0x00000000053D0000-0x00000000055FB000-memory.dmp
      Filesize

      2.2MB

      Download
    • memory/908-10-0x00000000053D0000-0x00000000055FB000-memory.dmp
      Filesize

      2.2MB

      Download
    • memory/908-12-0x00000000053D0000-0x00000000055FB000-memory.dmp
      Filesize

      2.2MB

      Download
    • memory/908-14-0x00000000053D0000-0x00000000055FB000-memory.dmp
      Filesize

      2.2MB

      Download
    • memory/908-16-0x00000000053D0000-0x00000000055FB000-memory.dmp
      Filesize

      2.2MB

      Download
    • memory/908-18-0x00000000053D0000-0x00000000055FB000-memory.dmp
      Filesize

      2.2MB

      Download
    • memory/908-20-0x00000000053D0000-0x00000000055FB000-memory.dmp
      Filesize

      2.2MB

      Download
    • memory/908-22-0x00000000053D0000-0x00000000055FB000-memory.dmp
      Filesize

      2.2MB

      Download
    • memory/908-24-0x00000000053D0000-0x00000000055FB000-memory.dmp
      Filesize

      2.2MB

      Download
    • memory/908-26-0x00000000053D0000-0x00000000055FB000-memory.dmp
      Filesize

      2.2MB

      Download
    • memory/908-28-0x00000000053D0000-0x00000000055FB000-memory.dmp
      Filesize

      2.2MB

      Download
    • memory/908-30-0x00000000053D0000-0x00000000055FB000-memory.dmp
      Filesize

      2.2MB

      Download
    • memory/908-32-0x00000000053D0000-0x00000000055FB000-memory.dmp
      Filesize

      2.2MB

      Download
    • memory/908-34-0x00000000053D0000-0x00000000055FB000-memory.dmp
      Filesize

      2.2MB

      Download
    • memory/908-36-0x00000000053D0000-0x00000000055FB000-memory.dmp
      Filesize

      2.2MB

      Download
    • memory/908-38-0x00000000053D0000-0x00000000055FB000-memory.dmp
      Filesize

      2.2MB

      Download
    • memory/908-40-0x00000000053D0000-0x00000000055FB000-memory.dmp
      Filesize

      2.2MB

      Download
    • memory/908-42-0x00000000053D0000-0x00000000055FB000-memory.dmp
      Filesize

      2.2MB

      Download
    • memory/908-44-0x00000000053D0000-0x00000000055FB000-memory.dmp
      Filesize

      2.2MB

      Download
    • memory/908-46-0x00000000053D0000-0x00000000055FB000-memory.dmp
      Filesize

      2.2MB

      Download
    • memory/908-48-0x00000000053D0000-0x00000000055FB000-memory.dmp
      Filesize

      2.2MB

      Download
    • memory/908-50-0x00000000053D0000-0x00000000055FB000-memory.dmp
      Filesize

      2.2MB

      Download
    • memory/908-52-0x00000000053D0000-0x00000000055FB000-memory.dmp
      Filesize

      2.2MB

      Download
    • memory/908-54-0x00000000053D0000-0x00000000055FB000-memory.dmp
      Filesize

      2.2MB

      Download
    • memory/908-56-0x00000000053D0000-0x00000000055FB000-memory.dmp
      Filesize

      2.2MB

      Download
    • memory/908-58-0x00000000053D0000-0x00000000055FB000-memory.dmp
      Filesize

      2.2MB

      Download
    • memory/908-60-0x00000000053D0000-0x00000000055FB000-memory.dmp
      Filesize

      2.2MB

      Download
    • memory/908-62-0x00000000053D0000-0x00000000055FB000-memory.dmp
      Filesize

      2.2MB

      Download
    • memory/908-64-0x00000000053D0000-0x00000000055FB000-memory.dmp
      Filesize

      2.2MB

      Download
    • memory/908-66-0x00000000053D0000-0x00000000055FB000-memory.dmp
      Filesize

      2.2MB

      Download
    • memory/908-68-0x00000000053D0000-0x00000000055FB000-memory.dmp
      Filesize

      2.2MB

      Download
    • memory/908-1162-0x00000000751E0000-0x0000000075990000-memory.dmp
      Filesize

      7.7MB

      Download
    • memory/908-1570-0x0000000005120000-0x0000000005130000-memory.dmp
      Filesize

      64KB

      Download
    • memory/908-4887-0x0000000000BD0000-0x0000000000BD1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/908-4888-0x0000000000ED0000-0x0000000000F3C000-memory.dmp
      Filesize

      432KB

      Download
    • memory/908-4889-0x0000000000F40000-0x0000000000F8C000-memory.dmp
      Filesize

      304KB

      Download