Analysis
- max time kernel
101s - max time network
155s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
22/04/2024, 12:51
General
- Target 0e778abce3af4d6b730abbdb4e8298f1.exe
- Size 415KB
- Sample240422-p3gbmabe62
- SHA256 ee29e3aad14667b58642d965a332ffe5586ee1a2d8a09b2da7a54520b46d598e
Malware Config
Extracted
-
stealc
-
http://185.172.128.76
-
url_path
/3cd2b41cbde8fc9c.php
Signatures
- Detect ZGRat V1 3 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Stealc
Stealc is an infostealer written in C++.
- ZGRat
ZGRat is remote access trojan written in C#.
- Downloads MZ/PE file
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 20 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 34 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e778abce3af4d6b730abbdb4e8298f1.exe"C:\Users\Admin\AppData\Local\Temp\0e778abce3af4d6b730abbdb4e8298f1.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\u1pw.0.exe"C:\Users\Admin\AppData\Local\Temp\u1pw.0.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe"C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Uninstallcheck_alpha\ptInst.exeC:\Users\Admin\AppData\Local\Temp\Uninstallcheck_alpha\ptInst.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Uninstallcheck_alpha\ptInst.exeC:\Users\Admin\AppData\Roaming\Uninstallcheck_alpha\ptInst.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe5⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe6⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\u1pw.1.exe"C:\Users\Admin\AppData\Local\Temp\u1pw.1.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD13⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
27bc7c61
28605bbe
Qg_Appv5.exe
Qg_Appv5.exe
Qg_Appv5.exe
cosmetician.mpeg
quersprung.vhd
ioloDMLog.txt
u1pw.0.exe
Qg_Appv5.exe
Qg_Appv5.exe
Qg_Appv5.exe
Qg_Appv5.exe
WCLDll.dll
msvcp140.dll
ptInst.exe
vcruntime140.dll
u1pw.1.exe
memory/964-172-0x0000000004E90000-0x0000000004ED0000-memory.dmp
memory/964-171-0x0000000072BE0000-0x00000000732CE000-memory.dmp
memory/964-168-0x0000000004E90000-0x0000000004ED0000-memory.dmp
memory/964-167-0x0000000072BE0000-0x00000000732CE000-memory.dmp
memory/964-166-0x0000000000400000-0x00000000004C6000-memory.dmp
memory/964-163-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
memory/964-164-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
memory/964-161-0x00000000732D0000-0x0000000074332000-memory.dmp
memory/1272-236-0x0000000000DE0000-0x0000000000DEA000-memory.dmp
memory/1272-266-0x0000000000450000-0x00000000004D0000-memory.dmp
memory/1272-261-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1272-245-0x000000001F880000-0x000000001FB80000-memory.dmp
memory/1272-264-0x0000000000450000-0x00000000004D0000-memory.dmp
memory/1272-265-0x0000000000450000-0x00000000004D0000-memory.dmp
memory/1272-241-0x00000000003E0000-0x00000000003EA000-memory.dmp
memory/1272-239-0x000000001E2F0000-0x000000001E36A000-memory.dmp
memory/1272-240-0x0000000000550000-0x00000000005B2000-memory.dmp
memory/1272-255-0x0000000000450000-0x00000000004D0000-memory.dmp
memory/1272-238-0x000000001E850000-0x000000001E902000-memory.dmp
memory/1272-237-0x000000001E1C0000-0x000000001E1EA000-memory.dmp
memory/1272-235-0x0000000005CC0000-0x0000000005CE4000-memory.dmp
memory/1272-234-0x0000000000C30000-0x0000000000C44000-memory.dmp
memory/1272-232-0x0000000000440000-0x0000000000450000-memory.dmp
memory/1272-260-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1272-233-0x0000000000C40000-0x0000000000C4C000-memory.dmp
memory/1272-231-0x000000001EF40000-0x000000001F050000-memory.dmp
memory/1272-230-0x0000000000450000-0x00000000004D0000-memory.dmp
memory/1272-229-0x0000000000F60000-0x0000000004858000-memory.dmp
memory/1272-228-0x000007FEF64E0000-0x000007FEF6ECC000-memory.dmp
memory/1272-248-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1272-247-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1272-249-0x0000000000450000-0x00000000004D0000-memory.dmp
memory/1272-250-0x0000000000450000-0x00000000004D0000-memory.dmp
memory/1272-259-0x0000000000450000-0x00000000004D0000-memory.dmp
memory/1272-251-0x0000000000ED0000-0x0000000000EDA000-memory.dmp
memory/1272-252-0x0000000000EE0000-0x0000000000F02000-memory.dmp
memory/1272-256-0x0000000000F00000-0x0000000000F0C000-memory.dmp
memory/1272-258-0x000007FEF64E0000-0x000007FEF6ECC000-memory.dmp
memory/1596-56-0x0000000074A80000-0x0000000074BF4000-memory.dmp
memory/1596-103-0x0000000074A80000-0x0000000074BF4000-memory.dmp
memory/1596-45-0x0000000000280000-0x0000000000281000-memory.dmp
memory/1596-50-0x0000000074A80000-0x0000000074BF4000-memory.dmp
memory/1596-51-0x0000000077CA0000-0x0000000077E49000-memory.dmp
memory/1596-53-0x0000000074A80000-0x0000000074BF4000-memory.dmp
memory/1596-65-0x0000000074A80000-0x0000000074BF4000-memory.dmp
memory/1596-43-0x0000000000400000-0x0000000000BEB000-memory.dmp
memory/1596-104-0x0000000000400000-0x0000000000BEB000-memory.dmp
memory/1840-192-0x0000000000230000-0x0000000000231000-memory.dmp
memory/1840-214-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/1840-227-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/2228-3-0x0000000000400000-0x0000000002C4A000-memory.dmp
memory/2228-1-0x00000000002C0000-0x00000000003C0000-memory.dmp
memory/2228-187-0x0000000000400000-0x0000000002C4A000-memory.dmp
memory/2228-25-0x00000000002C0000-0x00000000003C0000-memory.dmp
memory/2228-24-0x0000000000400000-0x0000000002C4A000-memory.dmp
memory/2228-191-0x00000000002C0000-0x00000000003C0000-memory.dmp
memory/2228-2-0x0000000002CC0000-0x0000000002D2E000-memory.dmp
memory/2228-42-0x0000000000400000-0x0000000002C4A000-memory.dmp
memory/2372-23-0x0000000000400000-0x0000000002C26000-memory.dmp
memory/2372-20-0x0000000002CB0000-0x0000000002DB0000-memory.dmp
memory/2372-21-0x00000000002B0000-0x00000000002D7000-memory.dmp
memory/2372-22-0x0000000000400000-0x0000000002C26000-memory.dmp
memory/2460-78-0x0000000074A80000-0x0000000074BF4000-memory.dmp
memory/2460-79-0x0000000077CA0000-0x0000000077E49000-memory.dmp
memory/2556-99-0x0000000074A80000-0x0000000074BF4000-memory.dmp
memory/2556-100-0x0000000077CA0000-0x0000000077E49000-memory.dmp
memory/2556-101-0x0000000074A80000-0x0000000074BF4000-memory.dmp
memory/2556-105-0x0000000074A80000-0x0000000074BF4000-memory.dmp
memory/2688-107-0x0000000074A80000-0x0000000074BF4000-memory.dmp
memory/2688-109-0x0000000077CA0000-0x0000000077E49000-memory.dmp
memory/2688-157-0x0000000074A80000-0x0000000074BF4000-memory.dmp
memory/2688-158-0x0000000074A80000-0x0000000074BF4000-memory.dmp
memory/2688-159-0x0000000074A80000-0x0000000074BF4000-memory.dmp
memory/2688-162-0x0000000074A80000-0x0000000074BF4000-memory.dmp