Analysis
- max time kernel
160s - max time network
177s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
02/04/2024, 10:15
General
- Target QUOTATION_MARQTRA031244PDF.scr
- Size 2.4MB
- Sample240402-l99pzaee7v
- SHA256 aa5e905630fdcd343ea0c1bdc41c67ec3b60abcab50f2ed7bcfba931e7d30f11
Malware Config
Signatures
- Detect ZGRat V1 34 IoCs
- PureLog Stealer
PureLog Stealer is an infostealer written in C#.
- PureLog Stealer payload 1 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION_MARQTRA031244PDF.scr"C:\Users\Admin\AppData\Local\Temp\QUOTATION_MARQTRA031244PDF.scr" /S1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4312 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3164-0-0x0000000074ED0000-0x0000000075680000-memory.dmp
memory/3164-1-0x0000000000090000-0x0000000000302000-memory.dmp
memory/3164-2-0x0000000004DF0000-0x0000000004E00000-memory.dmp
memory/3164-3-0x0000000074ED0000-0x0000000075680000-memory.dmp
memory/3164-4-0x0000000004E00000-0x0000000005032000-memory.dmp
memory/3164-5-0x0000000005030000-0x0000000005260000-memory.dmp
memory/3164-6-0x0000000005030000-0x000000000525B000-memory.dmp
memory/3164-7-0x0000000005030000-0x000000000525B000-memory.dmp
memory/3164-9-0x0000000005030000-0x000000000525B000-memory.dmp
memory/3164-11-0x0000000005030000-0x000000000525B000-memory.dmp
memory/3164-13-0x0000000005030000-0x000000000525B000-memory.dmp
memory/3164-15-0x0000000005030000-0x000000000525B000-memory.dmp
memory/3164-17-0x0000000005030000-0x000000000525B000-memory.dmp
memory/3164-19-0x0000000005030000-0x000000000525B000-memory.dmp
memory/3164-21-0x0000000005030000-0x000000000525B000-memory.dmp
memory/3164-23-0x0000000005030000-0x000000000525B000-memory.dmp
memory/3164-25-0x0000000005030000-0x000000000525B000-memory.dmp
memory/3164-27-0x0000000005030000-0x000000000525B000-memory.dmp
memory/3164-29-0x0000000005030000-0x000000000525B000-memory.dmp
memory/3164-31-0x0000000005030000-0x000000000525B000-memory.dmp
memory/3164-33-0x0000000005030000-0x000000000525B000-memory.dmp
memory/3164-35-0x0000000005030000-0x000000000525B000-memory.dmp
memory/3164-37-0x0000000005030000-0x000000000525B000-memory.dmp
memory/3164-39-0x0000000005030000-0x000000000525B000-memory.dmp
memory/3164-41-0x0000000005030000-0x000000000525B000-memory.dmp
memory/3164-43-0x0000000005030000-0x000000000525B000-memory.dmp
memory/3164-45-0x0000000005030000-0x000000000525B000-memory.dmp
memory/3164-47-0x0000000005030000-0x000000000525B000-memory.dmp
memory/3164-49-0x0000000005030000-0x000000000525B000-memory.dmp
memory/3164-51-0x0000000005030000-0x000000000525B000-memory.dmp
memory/3164-53-0x0000000005030000-0x000000000525B000-memory.dmp
memory/3164-55-0x0000000005030000-0x000000000525B000-memory.dmp
memory/3164-57-0x0000000005030000-0x000000000525B000-memory.dmp
memory/3164-59-0x0000000005030000-0x000000000525B000-memory.dmp
memory/3164-61-0x0000000005030000-0x000000000525B000-memory.dmp
memory/3164-63-0x0000000005030000-0x000000000525B000-memory.dmp
memory/3164-65-0x0000000005030000-0x000000000525B000-memory.dmp
memory/3164-67-0x0000000005030000-0x000000000525B000-memory.dmp
memory/3164-69-0x0000000005030000-0x000000000525B000-memory.dmp
memory/3164-445-0x0000000004DF0000-0x0000000004E00000-memory.dmp
memory/3164-4887-0x00000000007D0000-0x00000000007D1000-memory.dmp
memory/3164-4888-0x00000000008E0000-0x000000000094C000-memory.dmp
memory/3164-4889-0x0000000000950000-0x000000000099C000-memory.dmp