Analysis
- max time kernel
147s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20240412-en - resource tags
- submitted
25/04/2024, 09:47
General
- Target 71f134655c1be04282acfbf0944314f016c26a50f34dbaea9122013d2cc1d351.exe
- Size 411KB
- Sample240425-lsf2bshe7z
- SHA256 71f134655c1be04282acfbf0944314f016c26a50f34dbaea9122013d2cc1d351
Malware Config
Signatures
- Detect ZGRat V1 3 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Stealc
Stealc is an infostealer written in C++.
- ZGRat
ZGRat is remote access trojan written in C#.
- Downloads MZ/PE file
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 24 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 7 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\71f134655c1be04282acfbf0944314f016c26a50f34dbaea9122013d2cc1d351.exe"C:\Users\Admin\AppData\Local\Temp\71f134655c1be04282acfbf0944314f016c26a50f34dbaea9122013d2cc1d351.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\u1ok.0.exe"C:\Users\Admin\AppData\Local\Temp\u1ok.0.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 11123⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\u1ok.2\run.exe"C:\Users\Admin\AppData\Local\Temp\u1ok.2\run.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\u1ok.3.exe"C:\Users\Admin\AppData\Local\Temp\u1ok.3.exe"2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 7362⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2072 -ip 20721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2180 -ip 21801⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
d2e55434
ioloDMLog.txt
tmp15F6.tmp
tmp1618.tmp
u1ok.0.exe
u1ok.1.zip
UIxMarketPlugin.dll
bunch.dat
relay.dll
run.exe
whale.dbf
u1ok.3.exe
memory/1884-104-0x00007FFE320A0000-0x00007FFE322A9000-memory.dmp
memory/1884-103-0x0000000072A30000-0x0000000072BAD000-memory.dmp
memory/1884-114-0x0000000072A30000-0x0000000072BAD000-memory.dmp
memory/1884-110-0x0000000072A30000-0x0000000072BAD000-memory.dmp
memory/2072-16-0x0000000000400000-0x0000000002C27000-memory.dmp
memory/2072-15-0x0000000000400000-0x0000000002C27000-memory.dmp
memory/2072-14-0x00000000030B0000-0x00000000030D7000-memory.dmp
memory/2072-13-0x0000000002E70000-0x0000000002F70000-memory.dmp
memory/2180-17-0x0000000000400000-0x0000000000869000-memory.dmp
memory/2180-113-0x0000000000400000-0x0000000000869000-memory.dmp
memory/2180-111-0x0000000000AC0000-0x0000000000BC0000-memory.dmp
memory/2180-112-0x0000000002720000-0x000000000278D000-memory.dmp
memory/2180-2-0x0000000002720000-0x000000000278D000-memory.dmp
memory/2180-137-0x0000000000400000-0x0000000000869000-memory.dmp
memory/2180-3-0x0000000000400000-0x0000000000869000-memory.dmp
memory/2180-1-0x0000000000AC0000-0x0000000000BC0000-memory.dmp
memory/2212-116-0x0000000072A30000-0x0000000072BAD000-memory.dmp
memory/2212-118-0x00007FFE320A0000-0x00007FFE322A9000-memory.dmp
memory/2212-138-0x0000000072A30000-0x0000000072BAD000-memory.dmp
memory/2212-139-0x0000000072A30000-0x0000000072BAD000-memory.dmp
memory/2212-162-0x0000000072A30000-0x0000000072BAD000-memory.dmp
memory/2720-184-0x000002855F280000-0x000002855F2A4000-memory.dmp
memory/2720-218-0x0000028564470000-0x0000028564492000-memory.dmp
memory/2720-177-0x00007FFE10A60000-0x00007FFE11522000-memory.dmp
memory/2720-178-0x0000028541110000-0x0000028544A08000-memory.dmp
memory/2720-179-0x00000285465E0000-0x00000285465F0000-memory.dmp
memory/2720-180-0x000002855F110000-0x000002855F220000-memory.dmp
memory/2720-182-0x000002855F000000-0x000002855F00C000-memory.dmp
memory/2720-181-0x0000028546630000-0x0000028546640000-memory.dmp
memory/2720-183-0x000002855EFF0000-0x000002855F004000-memory.dmp
memory/2720-249-0x00000285465E0000-0x00000285465F0000-memory.dmp
memory/2720-248-0x00000285465E0000-0x00000285465F0000-memory.dmp
memory/2720-247-0x00000285465E0000-0x00000285465F0000-memory.dmp
memory/2720-244-0x00000285465E0000-0x00000285465F0000-memory.dmp
memory/2720-243-0x00007FFE10A60000-0x00007FFE11522000-memory.dmp
memory/2720-189-0x000002855F400000-0x000002855F40A000-memory.dmp
memory/2720-190-0x000002855F450000-0x000002855F47A000-memory.dmp
memory/2720-221-0x00000285644A0000-0x00000285644BE000-memory.dmp
memory/2720-216-0x00000285641A0000-0x00000285641F0000-memory.dmp
memory/2720-194-0x000002855F530000-0x000002855F5AA000-memory.dmp
memory/2720-217-0x0000028564150000-0x000002856415C000-memory.dmp
memory/2720-191-0x000002855F480000-0x000002855F532000-memory.dmp
memory/2720-213-0x00000285646C0000-0x0000028564BE8000-memory.dmp
memory/2720-198-0x000002855F690000-0x000002855F706000-memory.dmp
memory/2720-197-0x000002855F5B0000-0x000002855F612000-memory.dmp
memory/2720-199-0x00000285466F0000-0x00000285466FA000-memory.dmp
memory/2720-203-0x000002855F710000-0x000002855FA10000-memory.dmp
memory/2720-212-0x0000028564130000-0x0000028564152000-memory.dmp
memory/2720-206-0x00000285465E0000-0x00000285465F0000-memory.dmp
memory/2720-207-0x00000285465E0000-0x00000285465F0000-memory.dmp
memory/2720-208-0x0000028563750000-0x0000028563758000-memory.dmp
memory/2720-209-0x0000028563A60000-0x0000028563A98000-memory.dmp
memory/2720-210-0x0000028563A20000-0x0000028563A2E000-memory.dmp
memory/2720-211-0x0000028563AE0000-0x0000028563AEA000-memory.dmp
memory/2796-188-0x0000000005A00000-0x0000000005FA6000-memory.dmp
memory/2796-187-0x0000000005370000-0x0000000005402000-memory.dmp
memory/2796-195-0x0000000005530000-0x00000000055A6000-memory.dmp
memory/2796-161-0x0000000071310000-0x0000000072627000-memory.dmp
memory/2796-185-0x0000000000D20000-0x0000000000DE6000-memory.dmp
memory/2796-219-0x00000000065E0000-0x0000000006B0C000-memory.dmp
memory/2796-220-0x00000000060B0000-0x00000000060CE000-memory.dmp
memory/2796-193-0x00000000054A0000-0x00000000054B0000-memory.dmp
memory/2796-196-0x00000000055B0000-0x0000000005600000-memory.dmp
memory/2796-186-0x0000000073B30000-0x00000000742E1000-memory.dmp
memory/2796-192-0x0000000005680000-0x0000000005842000-memory.dmp
memory/2796-242-0x0000000007A30000-0x0000000007A3A000-memory.dmp
memory/2796-204-0x0000000005360000-0x000000000536A000-memory.dmp
memory/2796-222-0x0000000006160000-0x00000000061C6000-memory.dmp
memory/2796-245-0x0000000073B30000-0x00000000742E1000-memory.dmp
memory/2796-246-0x00000000054A0000-0x00000000054B0000-memory.dmp
memory/4640-132-0x0000000002670000-0x0000000002671000-memory.dmp
memory/4640-176-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/4640-160-0x0000000000400000-0x00000000008AD000-memory.dmp