Analysis
- max time kernel
37s - max time network
147s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
23/04/2024, 02:56
General
- Target 03f91cfb52d95a096ad2b211e49f9e76.exe
- Size 425KB
- Sample240423-de1vksca49
- SHA256 cf51137fd01fbda379208b0f344dfebb6832454c69596b8fd39846fd833f04a9
Malware Config
Extracted
-
stealc
-
http://185.172.128.76
-
url_path
/3cd2b41cbde8fc9c.php
Signatures
- Detect ZGRat V1 3 IoCs
- Stealc
Stealc is an infostealer written in C++.
- ZGRat
ZGRat is remote access trojan written in C#.
- Downloads MZ/PE file
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 9 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\03f91cfb52d95a096ad2b211e49f9e76.exe"C:\Users\Admin\AppData\Local\Temp\03f91cfb52d95a096ad2b211e49f9e76.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\u1pk.0.exe"C:\Users\Admin\AppData\Local\Temp\u1pk.0.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\u1pk.2\run.exe"C:\Users\Admin\AppData\Local\Temp\u1pk.2\run.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\u1pk.3.exe"C:\Users\Admin\AppData\Local\Temp\u1pk.3.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD13⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
a9cac9b35a634977a1c1109a4d6a3a40.tmp
ioloDMLog.txt
u1pk.0.exe
UIxMarketPlugin.dll
relay.dll
run.exe
u1pk.3.exe
memory/1948-110-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/1948-98-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/1948-73-0x0000000000230000-0x0000000000231000-memory.dmp
memory/2120-22-0x00000000040D0000-0x00000000041D0000-memory.dmp
memory/2120-24-0x0000000000400000-0x0000000004045000-memory.dmp
memory/2120-23-0x00000000002B0000-0x00000000002D7000-memory.dmp
memory/2216-28-0x0000000000230000-0x00000000002A2000-memory.dmp
memory/2216-27-0x0000000002D50000-0x0000000002E50000-memory.dmp
memory/2216-54-0x0000000000400000-0x0000000002C4D000-memory.dmp
memory/2216-25-0x0000000000400000-0x0000000002C4D000-memory.dmp
memory/2216-72-0x0000000000400000-0x0000000002C4D000-memory.dmp
memory/2216-74-0x0000000002D50000-0x0000000002E50000-memory.dmp
memory/2216-1-0x0000000002D50000-0x0000000002E50000-memory.dmp
memory/2216-3-0x0000000000400000-0x0000000002C4D000-memory.dmp
memory/2216-2-0x0000000000230000-0x00000000002A2000-memory.dmp
memory/2292-116-0x00000000057B0000-0x00000000057BC000-memory.dmp
memory/2292-131-0x0000000005840000-0x000000000584A000-memory.dmp
memory/2292-114-0x000000001EFC0000-0x000000001F0D0000-memory.dmp
memory/2292-115-0x0000000003E60000-0x0000000003E70000-memory.dmp
memory/2292-112-0x0000000000020000-0x0000000003918000-memory.dmp
memory/2292-117-0x0000000004080000-0x0000000004094000-memory.dmp
memory/2292-118-0x000000001E5E0000-0x000000001E604000-memory.dmp
memory/2292-120-0x000000001E600000-0x000000001E62A000-memory.dmp
memory/2292-122-0x000000001E630000-0x000000001E6AA000-memory.dmp
memory/2292-123-0x0000000005750000-0x00000000057B2000-memory.dmp
memory/2292-121-0x000000001EA30000-0x000000001EAE2000-memory.dmp
memory/2292-119-0x00000000058D0000-0x00000000058DA000-memory.dmp
memory/2292-124-0x0000000005730000-0x000000000573A000-memory.dmp
memory/2292-128-0x000000001F850000-0x000000001FB50000-memory.dmp
memory/2292-130-0x0000000005840000-0x000000000584A000-memory.dmp
memory/2292-113-0x000000001EAE0000-0x000000001EB60000-memory.dmp
memory/2292-132-0x000000001EAE0000-0x000000001EB60000-memory.dmp
memory/2292-133-0x000000001EAE0000-0x000000001EB60000-memory.dmp
memory/2292-134-0x00000000058E0000-0x00000000058EA000-memory.dmp
memory/2292-135-0x0000000005A80000-0x0000000005AA2000-memory.dmp
memory/2292-139-0x0000000005AA0000-0x0000000005AAC000-memory.dmp
memory/2292-138-0x000000001EAE0000-0x000000001EB60000-memory.dmp
memory/2292-141-0x000007FEF58A0000-0x000007FEF628C000-memory.dmp
memory/2292-142-0x000000001EAE0000-0x000000001EB60000-memory.dmp
memory/2292-144-0x0000000005840000-0x000000000584A000-memory.dmp
memory/2292-143-0x0000000005840000-0x000000000584A000-memory.dmp
memory/2292-147-0x000000001EAE0000-0x000000001EB60000-memory.dmp
memory/2292-148-0x000000001EAE0000-0x000000001EB60000-memory.dmp
memory/2292-149-0x000000001EAE0000-0x000000001EB60000-memory.dmp
memory/2292-111-0x000007FEF58A0000-0x000007FEF628C000-memory.dmp