Windows Analysis Report
17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll

Overview

General Information

Sample name:	17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll (renamed file extension from exe to dll)
Original sample name:	17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.exe
Analysis ID:	1526394
MD5:	f5062c56ca27f67f38a450377f091647
SHA1:	d6d00f98da705220c668f57d17f4e1ffbe80ccd7
SHA256:	d4d5ba9653ba3a4e273668992dfed87aa0d6a7b8b9e4d64ad145852e3b725793
Tags:	base64-decodedexeuser-abuse_ch
Infos:

Detection

PureLog Stealer, zgRAT

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Execute DLL with spoofed extension

Yara detected PureLog Stealer

Yara detected zgRAT

AI detected suspicious sample

Creates a process in suspended mode (likely to inject code)

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Yara signature match

Classification

Malware Threat Intel
Provided by

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Signatures

AV Detection

Multi AV Scanner detection for submitted file

Source: 17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll

Virustotal: Detection: 7%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 84.6% probability

System Summary

Malicious sample detected (through community Yara rule)

Source: 17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll, type: SAMPLE

Matched rule: Detects zgRAT Author: ditekSHen

Sample file is different than original file name gathered from version info

Source: 17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll

Binary or memory string: OriginalFilenameDispossess.exe" vs 17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll

Yara signature match

Source: 17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll, type: SAMPLE

Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT

Source: classification engine

Classification label: mal84.troj.evad.winDLL@81/0@0/0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3176:120:WilError_03

Source: 17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll

Static file information: TRID: Win32 Dynamic Link Library (generic) Net Framework (1011504/3) 50.14%

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1

Source: 17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll

Virustotal: Detection: 7%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1

Jump to behavior

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match

File source: 17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll, type: SAMPLE

Yara detected zgRAT

Source: Yara match

File source: 17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll, type: SAMPLE

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match

File source: 17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll, type: SAMPLE

Yara detected zgRAT

Source: Yara match

File source: 17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll, type: SAMPLE

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

AV Detection

Multi AV Scanner detection for submitted file

Source: 17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll

Virustotal: Detection: 7%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 84.6% probability

System Summary

Malicious sample detected (through community Yara rule)

Source: 17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll, type: SAMPLE

Matched rule: Detects zgRAT Author: ditekSHen

Sample file is different than original file name gathered from version info

Source: 17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll

Binary or memory string: OriginalFilenameDispossess.exe" vs 17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll

Yara signature match

Source: 17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll, type: SAMPLE

Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT

Source: classification engine

Classification label: mal84.troj.evad.winDLL@81/0@0/0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3176:120:WilError_03

Source: 17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll

Static file information: TRID: Win32 Dynamic Link Library (generic) Net Framework (1011504/3) 50.14%

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1

Source: 17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll

Virustotal: Detection: 7%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll",#1

Jump to behavior

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match

File source: 17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll, type: SAMPLE

Yara detected zgRAT

Source: Yara match

File source: 17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll, type: SAMPLE

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match

File source: 17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll, type: SAMPLE

Yara detected zgRAT

Source: Yara match

File source: 17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll, type: SAMPLE

ID:	1526394
Product:	CloudBasic
Start time:	15:01:08
Start date:	05.10.2024
Sample:	17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	f5062c56ca27f67f38a450377f091647
SHA1:	d6d00f98da705220c668f57d17f4e1ffbe80ccd7
SHA256:	d4d5ba9653ba3a4e273668992dfed87aa0d6a7b8b9e4d64ad145852e3b725793
Filetype:	Win32 Dynamic Link Library (generic) Net Framework (1011504/3) 50.14%

Windows Analysis Report
17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel
Provided by

Signatures

AV Detection

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Windows Analysis Report 17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel Provided by

Signatures

AV Detection

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Windows Analysis Report
17280510090f1289c4b32d1e219d22219124bf268c1b127a93455268343197d422433249d7443.dat-decoded.dll

Malware Threat Intel
Provided by