purelogstealer | d1e97dd47e3903ba07de598a3048d1bffff8df29c47cbd852c958a4c210d677a

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08-05-2024 13:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d1e97dd47e3903ba07de598a3048d1bffff8df29c47cbd852c958a4c210d677a.exe
Size

68KB
MD5

ac015ea331170ea31df4abc5461b51f4
SHA1

f31473ebcab052a6a632ce165fd7c717b8add5d4
SHA256

d1e97dd47e3903ba07de598a3048d1bffff8df29c47cbd852c958a4c210d677a
SHA512

e33d433df818f096d09b3f5337800a98fb2d88fd07d75a722edfe8b8d7cc57c599c3431fbf5809c718c802e60fd00fa2a2a46a1c41fe8b6a7e586a7b2c5aa615
SSDEEP

1536:y1gopCTSbwFnN/GGGw8RbXnnzo5d9Zb35LhlEDSUlJA7FAx:yISkFAq8Rbnnzo5d9Zb35LhlEDSUlJA

Score

10^/10

purelogstealer xworm zgrat persistence rat stealer trojan

Malware Config

Extracted

Family

xworm

Version

5.0

193.161.193.99:40303

Mutex

DRVHzSADfqFLqC90

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3060-4897-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm

Detect ZGRat V1 34 IoCs

resource	yara_rule
behavioral2/memory/4616-4-0x0000000005D90000-0x0000000005FAE000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-24-0x0000000005D90000-0x0000000005FA8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-18-0x0000000005D90000-0x0000000005FA8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-14-0x0000000005D90000-0x0000000005FA8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-30-0x0000000005D90000-0x0000000005FA8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-42-0x0000000005D90000-0x0000000005FA8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-62-0x0000000005D90000-0x0000000005FA8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-68-0x0000000005D90000-0x0000000005FA8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-70-0x0000000005D90000-0x0000000005FA8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-66-0x0000000005D90000-0x0000000005FA8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-64-0x0000000005D90000-0x0000000005FA8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-60-0x0000000005D90000-0x0000000005FA8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-58-0x0000000005D90000-0x0000000005FA8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-56-0x0000000005D90000-0x0000000005FA8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-54-0x0000000005D90000-0x0000000005FA8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-52-0x0000000005D90000-0x0000000005FA8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-50-0x0000000005D90000-0x0000000005FA8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-48-0x0000000005D90000-0x0000000005FA8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-46-0x0000000005D90000-0x0000000005FA8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-44-0x0000000005D90000-0x0000000005FA8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-40-0x0000000005D90000-0x0000000005FA8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-38-0x0000000005D90000-0x0000000005FA8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-36-0x0000000005D90000-0x0000000005FA8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-34-0x0000000005D90000-0x0000000005FA8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-32-0x0000000005D90000-0x0000000005FA8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-28-0x0000000005D90000-0x0000000005FA8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-26-0x0000000005D90000-0x0000000005FA8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-22-0x0000000005D90000-0x0000000005FA8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-20-0x0000000005D90000-0x0000000005FA8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-16-0x0000000005D90000-0x0000000005FA8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-12-0x0000000005D90000-0x0000000005FA8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-10-0x0000000005D90000-0x0000000005FA8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-8-0x0000000005D90000-0x0000000005FA8000-memory.dmp	family_zgrat_v1
behavioral2/memory/4616-7-0x0000000005D90000-0x0000000005FA8000-memory.dmp	family_zgrat_v1

PureLog Stealer
PureLog Stealer is an infostealer written in C#.
stealer purelogstealer

PureLog Stealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/4616-1-0x0000000000170000-0x0000000000184000-memory.dmp	family_purelog_stealer

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\notepad = "C:\\Users\\Admin\\AppData\\Roaming\\notepad.exe"	d1e97dd47e3903ba07de598a3048d1bffff8df29c47cbd852c958a4c210d677a.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4616 set thread context of 3060	4616	d1e97dd47e3903ba07de598a3048d1bffff8df29c47cbd852c958a4c210d677a.exe	91

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4616	d1e97dd47e3903ba07de598a3048d1bffff8df29c47cbd852c958a4c210d677a.exe
Token: SeDebugPrivilege	4616	d1e97dd47e3903ba07de598a3048d1bffff8df29c47cbd852c958a4c210d677a.exe
Token: SeDebugPrivilege	3060	d1e97dd47e3903ba07de598a3048d1bffff8df29c47cbd852c958a4c210d677a.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 3060	4616	d1e97dd47e3903ba07de598a3048d1bffff8df29c47cbd852c958a4c210d677a.exe	91
PID 4616 wrote to memory of 3060	4616	d1e97dd47e3903ba07de598a3048d1bffff8df29c47cbd852c958a4c210d677a.exe	91
PID 4616 wrote to memory of 3060	4616	d1e97dd47e3903ba07de598a3048d1bffff8df29c47cbd852c958a4c210d677a.exe	91
PID 4616 wrote to memory of 3060	4616	d1e97dd47e3903ba07de598a3048d1bffff8df29c47cbd852c958a4c210d677a.exe	91
PID 4616 wrote to memory of 3060	4616	d1e97dd47e3903ba07de598a3048d1bffff8df29c47cbd852c958a4c210d677a.exe	91
PID 4616 wrote to memory of 3060	4616	d1e97dd47e3903ba07de598a3048d1bffff8df29c47cbd852c958a4c210d677a.exe	91
PID 4616 wrote to memory of 3060	4616	d1e97dd47e3903ba07de598a3048d1bffff8df29c47cbd852c958a4c210d677a.exe	91
PID 4616 wrote to memory of 3060	4616	d1e97dd47e3903ba07de598a3048d1bffff8df29c47cbd852c958a4c210d677a.exe	91

C:\Users\Admin\AppData\Local\Temp\d1e97dd47e3903ba07de598a3048d1bffff8df29c47cbd852c958a4c210d677a.exe
"C:\Users\Admin\AppData\Local\Temp\d1e97dd47e3903ba07de598a3048d1bffff8df29c47cbd852c958a4c210d677a.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Users\Admin\AppData\Local\Temp\d1e97dd47e3903ba07de598a3048d1bffff8df29c47cbd852c958a4c210d677a.exe
  "C:\Users\Admin\AppData\Local\Temp\d1e97dd47e3903ba07de598a3048d1bffff8df29c47cbd852c958a4c210d677a.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\d1e97dd47e3903ba07de598a3048d1bffff8df29c47cbd852c958a4c210d677a.exe.log

Filesize
1KB

MD5
f3eb81974dc5933681e933f07209ff5f

SHA1
7af8cae0f1d03e82daaf784df9886705685baac7

SHA256
e82069884dd428bd6a1c67fe00c5fa56f9c4d62b538b694694a699588f1f4ab2

SHA512
d9aa3871dffb76c8a73a7940fa03bbc9b65cf575cbd07f7c1fbf490cb0f3d670415eaef0bf79e34689f61ab3cdfbb104efdef004becc12e54b501f02f948aaff

Download Submit
memory/3060-4895-0x0000000074F70000-0x0000000075720000-memory.dmp

Filesize
7.7MB

Download
memory/3060-4897-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3060-4898-0x0000000004E10000-0x0000000004EAC000-memory.dmp

Filesize
624KB

Download
memory/3060-4899-0x0000000074F70000-0x0000000075720000-memory.dmp

Filesize
7.7MB

Download
memory/3060-4900-0x0000000074F70000-0x0000000075720000-memory.dmp

Filesize
7.7MB

Download
memory/4616-56-0x0000000005D90000-0x0000000005FA8000-memory.dmp

Filesize
2.1MB

Download
memory/4616-46-0x0000000005D90000-0x0000000005FA8000-memory.dmp

Filesize
2.1MB

Download
memory/4616-3-0x0000000074F70000-0x0000000075720000-memory.dmp

Filesize
7.7MB

Download
memory/4616-4-0x0000000005D90000-0x0000000005FAE000-memory.dmp

Filesize
2.1MB

Download
memory/4616-5-0x00000000065A0000-0x0000000006B44000-memory.dmp

Filesize
5.6MB

Download
memory/4616-6-0x0000000006200000-0x0000000006292000-memory.dmp

Filesize
584KB

Download
memory/4616-24-0x0000000005D90000-0x0000000005FA8000-memory.dmp

Filesize
2.1MB

Download
memory/4616-18-0x0000000005D90000-0x0000000005FA8000-memory.dmp

Filesize
2.1MB

Download
memory/4616-14-0x0000000005D90000-0x0000000005FA8000-memory.dmp

Filesize
2.1MB

Download
memory/4616-30-0x0000000005D90000-0x0000000005FA8000-memory.dmp

Filesize
2.1MB

Download
memory/4616-42-0x0000000005D90000-0x0000000005FA8000-memory.dmp

Filesize
2.1MB

Download
memory/4616-62-0x0000000005D90000-0x0000000005FA8000-memory.dmp

Filesize
2.1MB

Download
memory/4616-68-0x0000000005D90000-0x0000000005FA8000-memory.dmp

Filesize
2.1MB

Download
memory/4616-70-0x0000000005D90000-0x0000000005FA8000-memory.dmp

Filesize
2.1MB

Download
memory/4616-66-0x0000000005D90000-0x0000000005FA8000-memory.dmp

Filesize
2.1MB

Download
memory/4616-64-0x0000000005D90000-0x0000000005FA8000-memory.dmp

Filesize
2.1MB

Download
memory/4616-60-0x0000000005D90000-0x0000000005FA8000-memory.dmp

Filesize
2.1MB

Download
memory/4616-58-0x0000000005D90000-0x0000000005FA8000-memory.dmp

Filesize
2.1MB

Download
memory/4616-1-0x0000000000170000-0x0000000000184000-memory.dmp

Filesize
80KB

Download
memory/4616-54-0x0000000005D90000-0x0000000005FA8000-memory.dmp

Filesize
2.1MB

Download
memory/4616-52-0x0000000005D90000-0x0000000005FA8000-memory.dmp

Filesize
2.1MB

Download
memory/4616-50-0x0000000005D90000-0x0000000005FA8000-memory.dmp

Filesize
2.1MB

Download
memory/4616-48-0x0000000005D90000-0x0000000005FA8000-memory.dmp

Filesize
2.1MB

Download
memory/4616-2-0x0000000004AC0000-0x0000000004AC6000-memory.dmp

Filesize
24KB

Download
memory/4616-44-0x0000000005D90000-0x0000000005FA8000-memory.dmp

Filesize
2.1MB

Download
memory/4616-40-0x0000000005D90000-0x0000000005FA8000-memory.dmp

Filesize
2.1MB

Download
memory/4616-38-0x0000000005D90000-0x0000000005FA8000-memory.dmp

Filesize
2.1MB

Download
memory/4616-36-0x0000000005D90000-0x0000000005FA8000-memory.dmp

Filesize
2.1MB

Download
memory/4616-34-0x0000000005D90000-0x0000000005FA8000-memory.dmp

Filesize
2.1MB

Download
memory/4616-32-0x0000000005D90000-0x0000000005FA8000-memory.dmp

Filesize
2.1MB

Download
memory/4616-28-0x0000000005D90000-0x0000000005FA8000-memory.dmp

Filesize
2.1MB

Download
memory/4616-26-0x0000000005D90000-0x0000000005FA8000-memory.dmp

Filesize
2.1MB

Download
memory/4616-22-0x0000000005D90000-0x0000000005FA8000-memory.dmp

Filesize
2.1MB

Download
memory/4616-20-0x0000000005D90000-0x0000000005FA8000-memory.dmp

Filesize
2.1MB

Download
memory/4616-16-0x0000000005D90000-0x0000000005FA8000-memory.dmp

Filesize
2.1MB

Download
memory/4616-12-0x0000000005D90000-0x0000000005FA8000-memory.dmp

Filesize
2.1MB

Download
memory/4616-10-0x0000000005D90000-0x0000000005FA8000-memory.dmp

Filesize
2.1MB

Download
memory/4616-8-0x0000000005D90000-0x0000000005FA8000-memory.dmp

Filesize
2.1MB

Download
memory/4616-7-0x0000000005D90000-0x0000000005FA8000-memory.dmp

Filesize
2.1MB

Download
memory/4616-4887-0x0000000074F70000-0x0000000075720000-memory.dmp

Filesize
7.7MB

Download
memory/4616-4888-0x00000000053F0000-0x000000000544C000-memory.dmp

Filesize
368KB

Download
memory/4616-0-0x0000000074F7E000-0x0000000074F7F000-memory.dmp

Filesize
4KB

Download
memory/4616-4889-0x00000000058C0000-0x000000000590C000-memory.dmp

Filesize
304KB

Download
memory/4616-4890-0x0000000005920000-0x0000000005974000-memory.dmp

Filesize
336KB

Download
memory/4616-4896-0x0000000074F70000-0x0000000075720000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads