Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/04/2024, 23:21

General

  • Target

    cf51137fd01fbda379208b0f344dfebb6832454c69596b8fd39846fd833f04a9.exe

  • Size

    425KB

  • MD5

    03f91cfb52d95a096ad2b211e49f9e76

  • SHA1

    5f5680e1bfaa6b806c3be68536c7fd2c6089ca66

  • SHA256

    cf51137fd01fbda379208b0f344dfebb6832454c69596b8fd39846fd833f04a9

  • SHA512

    c5a8a3608b559574878ed96379010a35d695846ab24317d6938be70a4c1aa6aeb5505f27949e2ee64b6b5c95c829f18120c536cf9e3536a37dc49096cf668c20

  • SSDEEP

    6144:Q5aN2Vntc5AZgFculbmTyNdviCkR0ybsQM4PJirrxGP1dY1Bu/fK:caNyqZKre/iL0ywQLBirrQNP/fK

Score
10/10

Malware Config

Signatures

  • Detect ZGRat V1 3 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cf51137fd01fbda379208b0f344dfebb6832454c69596b8fd39846fd833f04a9.exe
    "C:\Users\Admin\AppData\Local\Temp\cf51137fd01fbda379208b0f344dfebb6832454c69596b8fd39846fd833f04a9.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:512
    • C:\Users\Admin\AppData\Local\Temp\ue8.0.exe
      "C:\Users\Admin\AppData\Local\Temp\ue8.0.exe"
      2⤵
      • Executes dropped EXE
      PID:4796
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 1020
        3⤵
        • Program crash
        PID:5088
    • C:\Users\Admin\AppData\Local\Temp\ue8.2\run.exe
      "C:\Users\Admin\AppData\Local\Temp\ue8.2\run.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:4948
    • C:\Users\Admin\AppData\Local\Temp\ue8.3.exe
      "C:\Users\Admin\AppData\Local\Temp\ue8.3.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3904
      • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4484
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 512 -s 1512
      2⤵
      • Program crash
      PID:3940
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4796 -ip 4796
    1⤵
      PID:4048
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 512 -ip 512
      1⤵
        PID:2996

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\ue8.0.exe

        Filesize

        269KB

        MD5

        cbac14c597164fcb009195c0f69f1825

        SHA1

        78e86605711b599521fb44c83800cc770ab0d09b

        SHA256

        acc31b4538f0c0f8e16d30262762f5d8695fe6b18d9b3294f2176b0b960bbe09

        SHA512

        08c7133768ee149340cbfa074a41272a8dded0bab79d1e26ddf8ed152fa3fe75ac60fa7f9ac82f47c8751343ccf9b67dfd57b9dd07c9e12c4f925dac83015fa7

      • C:\Users\Admin\AppData\Local\Temp\ue8.2\UIxMarketPlugin.dll

        Filesize

        1.6MB

        MD5

        aaa68086149eb0a5b76c67e2a687b262

        SHA1

        63fcb9226a7d8489fb15f930c081347ddec58c25

        SHA256

        40e1b9e74963052d04e267185d7c03ac348416363ed2ce6e210a7550a285ff83

        SHA512

        6b5fd86426955db14793c057e5d6d5ba183262f903dbf307609da05e6a7b90a90801082844b270c8f7fb65985e67d53bf8c03245c55e62fcde1b0254921766a8

      • C:\Users\Admin\AppData\Local\Temp\ue8.2\relay.dll

        Filesize

        1.5MB

        MD5

        e2021d931fb1e423c18bf8d16b22228e

        SHA1

        9efb4c88cc7bf296a81b73425d91873b6fb98a9f

        SHA256

        ae8628900ff30d4a7c826137ee817bc7c6fdfbb4b00618e015bcb69a2f19bbb7

        SHA512

        7fdc66c9fa47199fc5d3f2886831adb67e0241431350ad813dfa0b7e17026477bc2d9c551a1a4e158dec6204d9e9124e1918954cd630136538cd6e52838b9a43

      • C:\Users\Admin\AppData\Local\Temp\ue8.2\run.exe

        Filesize

        2.4MB

        MD5

        817ea35f043d663cba3b81ee02880d34

        SHA1

        b6bbf7e8d53eb24fa2bfb7d3fb9410adbcfffd50

        SHA256

        18727c065a688f805813aef0e38ce040ae32deb6ec87116d70e696bca5d5da13

        SHA512

        69bbc00fcff0a4f0b17e96b72e711052dbfde4501a29365167ff3c16e70be14545c7a2ffc32bdc9377a3d1eb74d5d66d89313a9bf5bbca0b01a557d109f59c11

      • C:\Users\Admin\AppData\Local\Temp\ue8.3.exe

        Filesize

        4.6MB

        MD5

        397926927bca55be4a77839b1c44de6e

        SHA1

        e10f3434ef3021c399dbba047832f02b3c898dbd

        SHA256

        4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

        SHA512

        cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

      • memory/512-3-0x0000000000400000-0x0000000002C4D000-memory.dmp

        Filesize

        40.3MB

      • memory/512-1-0x0000000002E00000-0x0000000002F00000-memory.dmp

        Filesize

        1024KB

      • memory/512-53-0x0000000003100000-0x0000000003172000-memory.dmp

        Filesize

        456KB

      • memory/512-52-0x0000000000400000-0x0000000002C4D000-memory.dmp

        Filesize

        40.3MB

      • memory/512-2-0x0000000003100000-0x0000000003172000-memory.dmp

        Filesize

        456KB

      • memory/3904-85-0x0000000000400000-0x00000000008AD000-memory.dmp

        Filesize

        4.7MB

      • memory/3904-73-0x0000000000400000-0x00000000008AD000-memory.dmp

        Filesize

        4.7MB

      • memory/3904-47-0x0000000002540000-0x0000000002541000-memory.dmp

        Filesize

        4KB

      • memory/4484-96-0x000001D44DFC0000-0x000001D44E072000-memory.dmp

        Filesize

        712KB

      • memory/4484-104-0x000001D44E1E0000-0x000001D44E4E0000-memory.dmp

        Filesize

        3.0MB

      • memory/4484-128-0x000001D44DB10000-0x000001D44DB20000-memory.dmp

        Filesize

        64KB

      • memory/4484-127-0x000001D44DB10000-0x000001D44DB20000-memory.dmp

        Filesize

        64KB

      • memory/4484-86-0x00007FFFFBB30000-0x00007FFFFC5F1000-memory.dmp

        Filesize

        10.8MB

      • memory/4484-87-0x000001D42FBA0000-0x000001D433498000-memory.dmp

        Filesize

        57.0MB

      • memory/4484-88-0x000001D44DB10000-0x000001D44DB20000-memory.dmp

        Filesize

        64KB

      • memory/4484-89-0x000001D44DD70000-0x000001D44DE80000-memory.dmp

        Filesize

        1.1MB

      • memory/4484-91-0x000001D44DB20000-0x000001D44DB2C000-memory.dmp

        Filesize

        48KB

      • memory/4484-90-0x000001D44DAF0000-0x000001D44DB00000-memory.dmp

        Filesize

        64KB

      • memory/4484-92-0x000001D4352D0000-0x000001D4352E4000-memory.dmp

        Filesize

        80KB

      • memory/4484-93-0x000001D44DB70000-0x000001D44DB94000-memory.dmp

        Filesize

        144KB

      • memory/4484-94-0x000001D44DB90000-0x000001D44DB9A000-memory.dmp

        Filesize

        40KB

      • memory/4484-126-0x000001D44DB10000-0x000001D44DB20000-memory.dmp

        Filesize

        64KB

      • memory/4484-95-0x000001D44DBC0000-0x000001D44DBEA000-memory.dmp

        Filesize

        168KB

      • memory/4484-98-0x000001D44E080000-0x000001D44E0E2000-memory.dmp

        Filesize

        392KB

      • memory/4484-99-0x000001D44E160000-0x000001D44E1D6000-memory.dmp

        Filesize

        472KB

      • memory/4484-97-0x000001D44DBF0000-0x000001D44DC6A000-memory.dmp

        Filesize

        488KB

      • memory/4484-100-0x000001D44DBB0000-0x000001D44DBBA000-memory.dmp

        Filesize

        40KB

      • memory/4484-125-0x000001D44DB10000-0x000001D44DB20000-memory.dmp

        Filesize

        64KB

      • memory/4484-106-0x000001D44DB10000-0x000001D44DB20000-memory.dmp

        Filesize

        64KB

      • memory/4484-108-0x000001D44DB10000-0x000001D44DB20000-memory.dmp

        Filesize

        64KB

      • memory/4484-107-0x000001D452BD0000-0x000001D452BD8000-memory.dmp

        Filesize

        32KB

      • memory/4484-109-0x000001D44DB10000-0x000001D44DB20000-memory.dmp

        Filesize

        64KB

      • memory/4484-111-0x000001D4524E0000-0x000001D4524EE000-memory.dmp

        Filesize

        56KB

      • memory/4484-112-0x000001D453670000-0x000001D45367A000-memory.dmp

        Filesize

        40KB

      • memory/4484-110-0x000001D452510000-0x000001D452548000-memory.dmp

        Filesize

        224KB

      • memory/4484-113-0x000001D453680000-0x000001D4536A2000-memory.dmp

        Filesize

        136KB

      • memory/4484-114-0x000001D453BD0000-0x000001D4540F8000-memory.dmp

        Filesize

        5.2MB

      • memory/4484-117-0x000001D453440000-0x000001D453490000-memory.dmp

        Filesize

        320KB

      • memory/4484-119-0x000001D44DB10000-0x000001D44DB20000-memory.dmp

        Filesize

        64KB

      • memory/4484-118-0x000001D4533F0000-0x000001D4533FC000-memory.dmp

        Filesize

        48KB

      • memory/4484-120-0x000001D453490000-0x000001D4534B2000-memory.dmp

        Filesize

        136KB

      • memory/4484-121-0x000001D4534C0000-0x000001D4534DE000-memory.dmp

        Filesize

        120KB

      • memory/4484-123-0x00007FFFFBB30000-0x00007FFFFC5F1000-memory.dmp

        Filesize

        10.8MB

      • memory/4484-124-0x000001D44DB10000-0x000001D44DB20000-memory.dmp

        Filesize

        64KB

      • memory/4796-16-0x0000000000400000-0x0000000002C26000-memory.dmp

        Filesize

        40.1MB

      • memory/4796-13-0x0000000002E70000-0x0000000002F70000-memory.dmp

        Filesize

        1024KB

      • memory/4796-14-0x00000000030B0000-0x00000000030D7000-memory.dmp

        Filesize

        156KB

      • memory/4796-15-0x0000000000400000-0x0000000002C26000-memory.dmp

        Filesize

        40.1MB