Analysis
- max time kernel
147s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
04/04/2024, 09:49
General
- Target ee61b0c1c0b1e270c8c15d0eebc7e0db0e0d4426ec0f6bf2d6b8eb69d81c534c.exe
- Size 359KB
- Sample240404-lts3aacd49
- SHA256 ee61b0c1c0b1e270c8c15d0eebc7e0db0e0d4426ec0f6bf2d6b8eb69d81c534c
Malware Config
Extracted
-
stealc
-
http://185.172.128.209
-
url_path
/3cd2b41cbde8fc9c.php
Signatures
- Detect ZGRat V1 3 IoCs
- Stealc
Stealc is an infostealer written in C++.
- ZGRat
ZGRat is remote access trojan written in C#.
- Downloads MZ/PE file
- Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 2 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 31 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 7 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee61b0c1c0b1e270c8c15d0eebc7e0db0e0d4426ec0f6bf2d6b8eb69d81c534c.exe"C:\Users\Admin\AppData\Local\Temp\ee61b0c1c0b1e270c8c15d0eebc7e0db0e0d4426ec0f6bf2d6b8eb69d81c534c.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\u3ps.0.exe"C:\Users\Admin\AppData\Local\Temp\u3ps.0.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\BKFIJJEGHD.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BKFIJJEGHD.exe"C:\Users\Admin\AppData\Local\Temp\BKFIJJEGHD.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\BKFIJJEGHD.exe5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 2.2.2.2 -n 1 -w 30006⤵
- Runs ping.exe
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 23643⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\u3ps.1.exe"C:\Users\Admin\AppData\Local\Temp\u3ps.1.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 11522⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4816 -ip 48161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1744 -ip 17441⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Are.docx
mozglue.dll
nss3.dll
BKFIJJEGHD.exe
ioloDMLog.txt
u3ps.0.exe
u3ps.1.exe
memory/1744-13-0x0000000002CA0000-0x0000000002DA0000-memory.dmp
memory/1744-31-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/1744-15-0x0000000000400000-0x0000000002B60000-memory.dmp
memory/1744-14-0x0000000002C10000-0x0000000002C37000-memory.dmp
memory/1744-167-0x0000000000400000-0x0000000002B60000-memory.dmp
memory/1744-131-0x0000000000400000-0x0000000002B60000-memory.dmp
memory/3972-26-0x00000000026B0000-0x00000000026B1000-memory.dmp
memory/3972-150-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/3972-132-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/4308-166-0x0000025E32D00000-0x0000025E32D24000-memory.dmp
memory/4308-190-0x0000025E39620000-0x0000025E39642000-memory.dmp
memory/4308-203-0x0000025E32D20000-0x0000025E32D30000-memory.dmp
memory/4308-151-0x00007FF9573A0000-0x00007FF957E61000-memory.dmp
memory/4308-152-0x0000025E14F70000-0x0000025E18868000-memory.dmp
memory/4308-202-0x0000025E32D20000-0x0000025E32D30000-memory.dmp
memory/4308-159-0x0000025E32D20000-0x0000025E32D30000-memory.dmp
memory/4308-201-0x0000025E32D20000-0x0000025E32D30000-memory.dmp
memory/4308-161-0x0000025E33F70000-0x0000025E34080000-memory.dmp
memory/4308-164-0x0000025E32CE0000-0x0000025E32CEC000-memory.dmp
memory/4308-163-0x0000025E32CC0000-0x0000025E32CD0000-memory.dmp
memory/4308-200-0x0000025E32D20000-0x0000025E32D30000-memory.dmp
memory/4308-165-0x0000025E32CD0000-0x0000025E32CE4000-memory.dmp
memory/4308-199-0x00007FF9573A0000-0x00007FF957E61000-memory.dmp
memory/4308-197-0x0000025E39710000-0x0000025E3972E000-memory.dmp
memory/4308-196-0x0000025E396E0000-0x0000025E39702000-memory.dmp
memory/4308-170-0x0000025E32D80000-0x0000025E32D8A000-memory.dmp
memory/4308-171-0x0000025E32DA0000-0x0000025E32DCA000-memory.dmp
memory/4308-176-0x0000025E343D0000-0x0000025E34446000-memory.dmp
memory/4308-174-0x0000025E342F0000-0x0000025E34352000-memory.dmp
memory/4308-195-0x0000025E39640000-0x0000025E3964C000-memory.dmp
memory/4308-173-0x0000025E34270000-0x0000025E342EA000-memory.dmp
memory/4308-172-0x0000025E341C0000-0x0000025E34272000-memory.dmp
memory/4308-178-0x0000025E32CA0000-0x0000025E32CAA000-memory.dmp
memory/4308-182-0x0000025E34450000-0x0000025E34750000-memory.dmp
memory/4308-184-0x0000025E32D20000-0x0000025E32D30000-memory.dmp
memory/4308-186-0x0000025E38E00000-0x0000025E38E08000-memory.dmp
memory/4308-188-0x0000025E38710000-0x0000025E3871E000-memory.dmp
memory/4308-187-0x0000025E38740000-0x0000025E38778000-memory.dmp
memory/4308-185-0x0000025E32D20000-0x0000025E32D30000-memory.dmp
memory/4308-189-0x0000025E398A0000-0x0000025E398AA000-memory.dmp
memory/4308-194-0x0000025E39690000-0x0000025E396E0000-memory.dmp
memory/4308-191-0x0000025E39DE0000-0x0000025E3A308000-memory.dmp
memory/4816-75-0x0000000004940000-0x00000000049AC000-memory.dmp
memory/4816-2-0x0000000004940000-0x00000000049AC000-memory.dmp
memory/4816-1-0x0000000002EA0000-0x0000000002FA0000-memory.dmp
memory/4816-3-0x0000000000400000-0x0000000002B83000-memory.dmp
memory/4816-68-0x0000000000400000-0x0000000002B83000-memory.dmp
memory/4848-177-0x0000000072470000-0x0000000072C20000-memory.dmp
memory/4848-168-0x0000000005260000-0x0000000005270000-memory.dmp
memory/4848-162-0x0000000072470000-0x0000000072C20000-memory.dmp
memory/4848-160-0x0000000000930000-0x0000000000950000-memory.dmp