Analysis
- max time kernel
289s - max time network
310s - platform
windows10-1703_x64 - resource
win10-20231215-en - resource tags
- submitted
15/01/2024, 05:00
General
- Target f9d7b25312a0a6bbc599c4a97b3ae6648e842fc1c22d6212c4a4cf7f68f7853f.exe
- Size 6.0MB
- Sample240115-fnf8msagg3
- SHA256 f9d7b25312a0a6bbc599c4a97b3ae6648e842fc1c22d6212c4a4cf7f68f7853f
Malware Config
Signatures
- Detect ZGRat V1 1 IoCs
- Detects Arechclient2 RAT 1 IoCs
Arechclient2.
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Drops startup file 1 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9d7b25312a0a6bbc599c4a97b3ae6648e842fc1c22d6212c4a4cf7f68f7853f.exe"C:\Users\Admin\AppData\Local\Temp\f9d7b25312a0a6bbc599c4a97b3ae6648e842fc1c22d6212c4a4cf7f68f7853f.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
tmp1C4F.tmp
Protect544cd51a.dll
memory/3612-17-0x0000000005850000-0x0000000005860000-memory.dmp
memory/3612-16-0x0000000005850000-0x0000000005860000-memory.dmp
memory/3612-4-0x0000000005850000-0x0000000005860000-memory.dmp
memory/3612-5-0x0000000005960000-0x0000000005AF2000-memory.dmp
memory/3612-2-0x0000000005500000-0x000000000559C000-memory.dmp
memory/3612-11-0x0000000005850000-0x0000000005860000-memory.dmp
memory/3612-12-0x0000000005850000-0x0000000005860000-memory.dmp
memory/3612-13-0x0000000005850000-0x0000000005860000-memory.dmp
memory/3612-14-0x0000000005D70000-0x0000000005D80000-memory.dmp
memory/3612-18-0x0000000005F70000-0x0000000006070000-memory.dmp
memory/3612-3-0x00000000731E0000-0x00000000738CE000-memory.dmp
memory/3612-34-0x0000000005850000-0x0000000005860000-memory.dmp
memory/3612-15-0x0000000005850000-0x0000000005860000-memory.dmp
memory/3612-19-0x0000000005F70000-0x0000000006070000-memory.dmp
memory/3612-20-0x0000000005F70000-0x0000000006070000-memory.dmp
memory/3612-51-0x00000000731E0000-0x00000000738CE000-memory.dmp
memory/3612-0-0x00000000731E0000-0x00000000738CE000-memory.dmp
memory/3612-45-0x0000000005850000-0x0000000005860000-memory.dmp
memory/3612-24-0x0000000005850000-0x0000000005860000-memory.dmp
memory/3612-44-0x0000000005850000-0x0000000005860000-memory.dmp
memory/3612-1-0x00000000006D0000-0x0000000000CC8000-memory.dmp
memory/3612-33-0x0000000005850000-0x0000000005860000-memory.dmp
memory/4932-22-0x0000000004F60000-0x0000000004FF2000-memory.dmp
memory/4932-29-0x00000000053B0000-0x0000000005426000-memory.dmp
memory/4932-30-0x00000000062E0000-0x000000000680C000-memory.dmp
memory/4932-31-0x0000000005740000-0x000000000575E000-memory.dmp
memory/4932-32-0x0000000005840000-0x00000000058A6000-memory.dmp
memory/4932-28-0x0000000005060000-0x00000000050B0000-memory.dmp
memory/4932-27-0x00000000058B0000-0x0000000005DAE000-memory.dmp
memory/4932-26-0x00000000051E0000-0x00000000053A2000-memory.dmp
memory/4932-25-0x0000000004F40000-0x0000000004F50000-memory.dmp
memory/4932-23-0x00000000731E0000-0x00000000738CE000-memory.dmp
memory/4932-21-0x0000000000400000-0x00000000004D4000-memory.dmp
memory/4932-52-0x00000000731E0000-0x00000000738CE000-memory.dmp
memory/4932-53-0x0000000004F40000-0x0000000004F50000-memory.dmp