Analysis
- max time kernel
121s - max time network
121s - platform
windows7_x64 - resource
win7-20240508-en - resource tags
- submitted
10/05/2024, 08:35
General
- Target NEW ORDER CONFIRMATION.scr
- Size 3.0MB
- Sample240510-khdmsagc69
- SHA256 ba58f8ba7420adb8ffa2c999e7b20c1958d353c1146cb5eff41b5057f320f7be
Malware Config
Signatures
- Detect ZGRat V1 35 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER CONFIRMATION.scr"C:\Users\Admin\AppData\Local\Temp\NEW ORDER CONFIRMATION.scr" /S1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwATgBFAFcAIABPAFIARABFAFIAIABDAE8ATgBGAEkAUgBNAEEAVABJAE8ATgAuAHMAYwByADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAATgBFAFcAIABPAFIARABFAFIAIABDAE8ATgBGAEkAUgBNAEEAVABJAE8ATgAuAHMAYwByADsA2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Xmlabiiyxdx.tmpdb
memory/1580-4902-0x0000000000400000-0x00000000004D8000-memory.dmp
memory/1580-7228-0x0000000005E10000-0x0000000005E8A000-memory.dmp
memory/1580-7227-0x0000000001FC0000-0x0000000001FCA000-memory.dmp
memory/1580-7226-0x0000000002260000-0x00000000022D0000-memory.dmp
memory/1580-7225-0x0000000002020000-0x00000000020BE000-memory.dmp
memory/1580-4903-0x0000000004380000-0x0000000004496000-memory.dmp
memory/2244-4884-0x00000000043F0000-0x000000000443C000-memory.dmp
memory/2244-4886-0x0000000073EB0000-0x000000007459E000-memory.dmp
memory/2244-16-0x0000000004DC0000-0x00000000050A5000-memory.dmp
memory/2244-18-0x0000000004DC0000-0x00000000050A5000-memory.dmp
memory/2244-10-0x0000000004DC0000-0x00000000050A5000-memory.dmp
memory/2244-48-0x0000000004DC0000-0x00000000050A5000-memory.dmp
memory/2244-20-0x0000000004DC0000-0x00000000050A5000-memory.dmp
memory/2244-66-0x0000000004DC0000-0x00000000050A5000-memory.dmp
memory/2244-64-0x0000000004DC0000-0x00000000050A5000-memory.dmp
memory/2244-62-0x0000000004DC0000-0x00000000050A5000-memory.dmp
memory/2244-60-0x0000000004DC0000-0x00000000050A5000-memory.dmp
memory/2244-58-0x0000000004DC0000-0x00000000050A5000-memory.dmp
memory/2244-56-0x0000000004DC0000-0x00000000050A5000-memory.dmp
memory/2244-54-0x0000000004DC0000-0x00000000050A5000-memory.dmp
memory/2244-52-0x0000000004DC0000-0x00000000050A5000-memory.dmp
memory/2244-50-0x0000000004DC0000-0x00000000050A5000-memory.dmp
memory/2244-46-0x0000000004DC0000-0x00000000050A5000-memory.dmp
memory/2244-0-0x0000000073EBE000-0x0000000073EBF000-memory.dmp
memory/2244-4883-0x0000000004B50000-0x0000000004C78000-memory.dmp
memory/2244-44-0x0000000004DC0000-0x00000000050A5000-memory.dmp
memory/2244-42-0x0000000004DC0000-0x00000000050A5000-memory.dmp
memory/2244-14-0x0000000004DC0000-0x00000000050A5000-memory.dmp
memory/2244-4885-0x0000000073EB0000-0x000000007459E000-memory.dmp
memory/2244-40-0x0000000004DC0000-0x00000000050A5000-memory.dmp
memory/2244-38-0x0000000004DC0000-0x00000000050A5000-memory.dmp
memory/2244-36-0x0000000004DC0000-0x00000000050A5000-memory.dmp
memory/2244-34-0x0000000004DC0000-0x00000000050A5000-memory.dmp
memory/2244-32-0x0000000004DC0000-0x00000000050A5000-memory.dmp
memory/2244-30-0x0000000004DC0000-0x00000000050A5000-memory.dmp
memory/2244-28-0x0000000004DC0000-0x00000000050A5000-memory.dmp
memory/2244-4887-0x0000000002150000-0x00000000021A4000-memory.dmp
memory/2244-26-0x0000000004DC0000-0x00000000050A5000-memory.dmp
memory/2244-24-0x0000000004DC0000-0x00000000050A5000-memory.dmp
memory/2244-22-0x0000000004DC0000-0x00000000050A5000-memory.dmp
memory/2244-12-0x0000000004DC0000-0x00000000050A5000-memory.dmp
memory/2244-4904-0x0000000073EB0000-0x000000007459E000-memory.dmp
memory/2244-8-0x0000000004DC0000-0x00000000050A5000-memory.dmp
memory/2244-6-0x0000000004DC0000-0x00000000050A5000-memory.dmp
memory/2244-4-0x0000000004DC0000-0x00000000050A5000-memory.dmp
memory/2244-3-0x0000000004DC0000-0x00000000050A5000-memory.dmp
memory/2244-2-0x0000000004DC0000-0x00000000050AA000-memory.dmp
memory/2244-1-0x0000000000270000-0x000000000056A000-memory.dmp