Overview

overview

10

Static

static

3

NEW PURCHA...cr.exe

windows7-x64

10

NEW PURCHA...cr.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NEW PURCHASE ORDER RFQ-0982928_1.scr.exe

  • Size

    112KB

  • Sample

    240515-je84vafd2t

  • MD5

    54f71c7479218838fedb673fc8cf3ca3

  • SHA1

    ef95cd965489f904f796513993295aef40e868b1

  • SHA256

    222a0ad2708775b55bb0ca82bee641b624acb8fc96ca5082e2d1759d44de2f35

  • SHA512

    4ea06b747a32e0feb368853597ab92ca69e3b31f04b979cf5845208aecf6515455c3f37382dd50b48bc3bfaef00b7439465ca290bd7d9a477e3e5986f72b5f37

  • SSDEEP

    1536:vwKxTUge0zKmiEn8SvR+chVcf7eWZt+qxpqojTwXK:vFd99iEn8SRVcDe1qx8ATwXK

Score
10/10
zgratcollectionpersistenceratspywarestealer

Malware Config

Targets

    • Target

      NEW PURCHASE ORDER RFQ-0982928_1.scr.exe

    • Size

      112KB

    • MD5

      54f71c7479218838fedb673fc8cf3ca3

    • SHA1

      ef95cd965489f904f796513993295aef40e868b1

    • SHA256

      222a0ad2708775b55bb0ca82bee641b624acb8fc96ca5082e2d1759d44de2f35

    • SHA512

      4ea06b747a32e0feb368853597ab92ca69e3b31f04b979cf5845208aecf6515455c3f37382dd50b48bc3bfaef00b7439465ca290bd7d9a477e3e5986f72b5f37

    • SSDEEP

      1536:vwKxTUge0zKmiEn8SvR+chVcf7eWZt+qxpqojTwXK:vFd99iEn8SRVcDe1qx8ATwXK

    Score
    10/10
    zgratpersistenceratcollectionspywarestealer

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

1
T1552.001

Credentials in Registry

1
T1552.002

Discovery

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks