Analysis
- max time kernel
13s - max time network
1s - platform
windows7_x64 - resource
win7-20240215-en - resource tags
- submitted
19/04/2024, 07:39
General
- Target Bnyoyenjf.exe
- Size 2.7MB
- Sample240419-jg4bdada2x
- SHA256 b50a24fe7d0efd0f3463d8971633544475739bfcac06a79112739f03149f674d
Malware Config
Signatures
- Detect ZGRat V1 34 IoCs
- PureLog Stealer
PureLog Stealer is an infostealer written in C#.
- PureLog Stealer payload 1 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bnyoyenjf.exe"C:\Users\Admin\AppData\Local\Temp\Bnyoyenjf.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1624-1-0x0000000074810000-0x0000000074EFE000-memory.dmp
memory/1624-0-0x00000000003B0000-0x0000000000666000-memory.dmp
memory/1624-2-0x00000000007C0000-0x0000000000800000-memory.dmp
memory/1624-3-0x0000000004E20000-0x00000000050B0000-memory.dmp
memory/1624-4-0x00000000061E0000-0x0000000006470000-memory.dmp
memory/1624-5-0x00000000061E0000-0x000000000646B000-memory.dmp
memory/1624-6-0x00000000061E0000-0x000000000646B000-memory.dmp
memory/1624-8-0x00000000061E0000-0x000000000646B000-memory.dmp
memory/1624-10-0x00000000061E0000-0x000000000646B000-memory.dmp
memory/1624-12-0x00000000061E0000-0x000000000646B000-memory.dmp
memory/1624-14-0x00000000061E0000-0x000000000646B000-memory.dmp
memory/1624-16-0x00000000061E0000-0x000000000646B000-memory.dmp
memory/1624-18-0x00000000061E0000-0x000000000646B000-memory.dmp
memory/1624-20-0x00000000061E0000-0x000000000646B000-memory.dmp
memory/1624-22-0x00000000061E0000-0x000000000646B000-memory.dmp
memory/1624-24-0x00000000061E0000-0x000000000646B000-memory.dmp
memory/1624-32-0x00000000061E0000-0x000000000646B000-memory.dmp
memory/1624-30-0x00000000061E0000-0x000000000646B000-memory.dmp
memory/1624-28-0x00000000061E0000-0x000000000646B000-memory.dmp
memory/1624-26-0x00000000061E0000-0x000000000646B000-memory.dmp
memory/1624-36-0x00000000061E0000-0x000000000646B000-memory.dmp
memory/1624-38-0x00000000061E0000-0x000000000646B000-memory.dmp
memory/1624-34-0x00000000061E0000-0x000000000646B000-memory.dmp
memory/1624-40-0x00000000061E0000-0x000000000646B000-memory.dmp
memory/1624-46-0x00000000061E0000-0x000000000646B000-memory.dmp
memory/1624-44-0x00000000061E0000-0x000000000646B000-memory.dmp
memory/1624-42-0x00000000061E0000-0x000000000646B000-memory.dmp
memory/1624-48-0x00000000061E0000-0x000000000646B000-memory.dmp
memory/1624-50-0x00000000061E0000-0x000000000646B000-memory.dmp
memory/1624-56-0x00000000061E0000-0x000000000646B000-memory.dmp
memory/1624-54-0x00000000061E0000-0x000000000646B000-memory.dmp
memory/1624-52-0x00000000061E0000-0x000000000646B000-memory.dmp
memory/1624-64-0x00000000061E0000-0x000000000646B000-memory.dmp
memory/1624-62-0x00000000061E0000-0x000000000646B000-memory.dmp
memory/1624-68-0x00000000061E0000-0x000000000646B000-memory.dmp
memory/1624-66-0x00000000061E0000-0x000000000646B000-memory.dmp
memory/1624-60-0x00000000061E0000-0x000000000646B000-memory.dmp
memory/1624-58-0x00000000061E0000-0x000000000646B000-memory.dmp