Analysis
- max time kernel
143s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
22/04/2024, 16:01
General
- Target 3da04dd1b6495f2b933344d768179d32.exe
- Size 415KB
- Sample240422-tf7mhsdc71
- SHA256 165c16df4dfeccd94efab42dad5ab311036d2938abda3a04e4ff7ed027ed8946
Malware Config
Signatures
- Detect ZGRat V1 3 IoCs
- Stealc
Stealc is an infostealer written in C++.
- ZGRat
ZGRat is remote access trojan written in C#.
- Downloads MZ/PE file
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 24 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 7 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3da04dd1b6495f2b933344d768179d32.exe"C:\Users\Admin\AppData\Local\Temp\3da04dd1b6495f2b933344d768179d32.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\uvo.0.exe"C:\Users\Admin\AppData\Local\Temp\uvo.0.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 11523⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\uvo.1.exe"C:\Users\Admin\AppData\Local\Temp\uvo.1.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2128 -ip 21281⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3276 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
ioloDMLog.txt
uvo.0.exe
uvo.1.exe
memory/212-31-0x00000000028E0000-0x00000000028E1000-memory.dmp
memory/212-50-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/212-70-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/212-60-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/1140-2-0x0000000003290000-0x00000000032FE000-memory.dmp
memory/1140-5-0x0000000000400000-0x0000000002C4A000-memory.dmp
memory/1140-17-0x0000000000400000-0x0000000002C4A000-memory.dmp
memory/1140-3-0x0000000000400000-0x0000000002C4A000-memory.dmp
memory/1140-29-0x0000000000400000-0x0000000002C4A000-memory.dmp
memory/1140-30-0x0000000003290000-0x00000000032FE000-memory.dmp
memory/1140-1-0x0000000002DC0000-0x0000000002EC0000-memory.dmp
memory/2128-16-0x0000000000400000-0x0000000002C26000-memory.dmp
memory/2128-40-0x0000000000400000-0x0000000002C26000-memory.dmp
memory/2128-14-0x0000000002E90000-0x0000000002F90000-memory.dmp
memory/2128-15-0x0000000003090000-0x00000000030B7000-memory.dmp
memory/4700-79-0x00000291414C0000-0x00000291414CA000-memory.dmp
memory/4700-92-0x0000029141300000-0x0000029141310000-memory.dmp
memory/4700-73-0x0000029141300000-0x0000029141310000-memory.dmp
memory/4700-74-0x0000029141690000-0x00000291417A0000-memory.dmp
memory/4700-75-0x0000029141410000-0x0000029141420000-memory.dmp
memory/4700-76-0x0000029141430000-0x000002914143C000-memory.dmp
memory/4700-77-0x0000029141420000-0x0000029141434000-memory.dmp
memory/4700-78-0x0000029141490000-0x00000291414B4000-memory.dmp
memory/4700-71-0x00007FFFA3B80000-0x00007FFFA4641000-memory.dmp
memory/4700-81-0x0000029141510000-0x000002914153A000-memory.dmp
memory/4700-80-0x00000291418E0000-0x0000029141992000-memory.dmp
memory/4700-82-0x0000029141990000-0x0000029141A0A000-memory.dmp
memory/4700-83-0x0000029141A10000-0x0000029141A72000-memory.dmp
memory/4700-84-0x0000029141AF0000-0x0000029141B66000-memory.dmp
memory/4700-85-0x0000029127270000-0x000002912727A000-memory.dmp
memory/4700-89-0x0000029141B70000-0x0000029141E70000-memory.dmp
memory/4700-91-0x0000029141300000-0x0000029141310000-memory.dmp
memory/4700-72-0x00000291234E0000-0x0000029126DD8000-memory.dmp
memory/4700-93-0x0000029145760000-0x0000029145768000-memory.dmp
memory/4700-94-0x0000029145E70000-0x0000029145EA8000-memory.dmp
memory/4700-95-0x0000029145E30000-0x0000029145E3E000-memory.dmp
memory/4700-96-0x0000029145EF0000-0x0000029145EFA000-memory.dmp
memory/4700-97-0x0000029146D40000-0x0000029146D62000-memory.dmp
memory/4700-98-0x00000291472B0000-0x00000291477D8000-memory.dmp
memory/4700-101-0x0000029141300000-0x0000029141310000-memory.dmp
memory/4700-102-0x0000029146DB0000-0x0000029146E00000-memory.dmp
memory/4700-103-0x0000029146D60000-0x0000029146D6C000-memory.dmp
memory/4700-104-0x00007FFFA3B80000-0x00007FFFA4641000-memory.dmp
memory/4700-105-0x0000029147080000-0x00000291470A2000-memory.dmp
memory/4700-106-0x00000291470B0000-0x00000291470CE000-memory.dmp
memory/4700-108-0x0000029141300000-0x0000029141310000-memory.dmp
memory/4700-109-0x0000029141300000-0x0000029141310000-memory.dmp
memory/4700-110-0x0000029141300000-0x0000029141310000-memory.dmp
memory/4700-111-0x0000029141300000-0x0000029141310000-memory.dmp