Analysis
- max time kernel
139s - max time network
141s - platform
windows11-21h2_x64 - resource
win11-20240412-en - resource tags
- submitted
25/04/2024, 16:03
General
- Target 567c1b49fe11b07455f838eb73cba70615693d71ad22d3e2a5866ebcd2665474.exe
- Size 396KB
- Sample240425-thhfeacd28
- SHA256 567c1b49fe11b07455f838eb73cba70615693d71ad22d3e2a5866ebcd2665474
Malware Config
Signatures
- Detect ZGRat V1 3 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Stealc
Stealc is an infostealer written in C++.
- ZGRat
ZGRat is remote access trojan written in C#.
- Downloads MZ/PE file
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 25 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 7 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\567c1b49fe11b07455f838eb73cba70615693d71ad22d3e2a5866ebcd2665474.exe"C:\Users\Admin\AppData\Local\Temp\567c1b49fe11b07455f838eb73cba70615693d71ad22d3e2a5866ebcd2665474.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\u3kg.0.exe"C:\Users\Admin\AppData\Local\Temp\u3kg.0.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 10963⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\u3kg.2\run.exe"C:\Users\Admin\AppData\Local\Temp\u3kg.2\run.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\u3kg.3.exe"C:\Users\Admin\AppData\Local\Temp\u3kg.3.exe"2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 15922⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4304 -ip 43041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4624 -ip 46241⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
c4638fd3
ioloDMLog.txt
tmpAF58.tmp
tmpAF7A.tmp
u3kg.0.exe
u3kg.1.zip
UIxMarketPlugin.dll
bunch.dat
relay.dll
run.exe
whale.dbf
u3kg.3.exe
memory/424-202-0x0000000073030000-0x00000000731AD000-memory.dmp
memory/424-151-0x00007FFF3E060000-0x00007FFF3E269000-memory.dmp
memory/424-134-0x0000000073030000-0x00000000731AD000-memory.dmp
memory/424-207-0x0000000073030000-0x00000000731AD000-memory.dmp
memory/424-203-0x0000000073030000-0x00000000731AD000-memory.dmp
memory/1480-153-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/1480-165-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/1480-121-0x0000000002860000-0x0000000002861000-memory.dmp
memory/2880-220-0x000001FFC1270000-0x000001FFC1280000-memory.dmp
memory/2880-174-0x000001FFC1640000-0x000001FFC164A000-memory.dmp
memory/2880-200-0x000001FFC66C0000-0x000001FFC66E2000-memory.dmp
memory/2880-215-0x00007FFF1CD00000-0x00007FFF1D7C2000-memory.dmp
memory/2880-199-0x000001FFC1270000-0x000001FFC1280000-memory.dmp
memory/2880-221-0x000001FFC1270000-0x000001FFC1280000-memory.dmp
memory/2880-222-0x000001FFC1270000-0x000001FFC1280000-memory.dmp
memory/2880-223-0x000001FFC1270000-0x000001FFC1280000-memory.dmp
memory/2880-224-0x000001FFC1270000-0x000001FFC1280000-memory.dmp
memory/2880-166-0x00007FFF1CD00000-0x00007FFF1D7C2000-memory.dmp
memory/2880-167-0x000001FFA3350000-0x000001FFA6C48000-memory.dmp
memory/2880-168-0x000001FFC1270000-0x000001FFC1280000-memory.dmp
memory/2880-169-0x000001FFC1370000-0x000001FFC1480000-memory.dmp
memory/2880-170-0x000001FFA8940000-0x000001FFA8950000-memory.dmp
memory/2880-171-0x000001FFC1240000-0x000001FFC124C000-memory.dmp
memory/2880-172-0x000001FFA8950000-0x000001FFA8964000-memory.dmp
memory/2880-173-0x000001FFC14D0000-0x000001FFC14F4000-memory.dmp
memory/2880-201-0x000001FFC63D0000-0x000001FFC63EE000-memory.dmp
memory/2880-175-0x000001FFC1680000-0x000001FFC16AA000-memory.dmp
memory/2880-176-0x000001FFC16B0000-0x000001FFC1762000-memory.dmp
memory/2880-177-0x000001FFC1760000-0x000001FFC17DA000-memory.dmp
memory/2880-178-0x000001FFC17E0000-0x000001FFC1842000-memory.dmp
memory/2880-179-0x000001FFC18C0000-0x000001FFC1936000-memory.dmp
memory/2880-180-0x000001FFA8920000-0x000001FFA892A000-memory.dmp
memory/2880-184-0x000001FFC1940000-0x000001FFC1C40000-memory.dmp
memory/2880-186-0x000001FFC1270000-0x000001FFC1280000-memory.dmp
memory/2880-187-0x000001FFC6340000-0x000001FFC6348000-memory.dmp
memory/2880-188-0x000001FFC1270000-0x000001FFC1280000-memory.dmp
memory/2880-189-0x000001FFC5C80000-0x000001FFC5CB8000-memory.dmp
memory/2880-191-0x000001FFC5C50000-0x000001FFC5C5E000-memory.dmp
memory/2880-190-0x000001FFC1270000-0x000001FFC1280000-memory.dmp
memory/2880-192-0x000001FFC6350000-0x000001FFC635A000-memory.dmp
memory/2880-193-0x000001FFC6380000-0x000001FFC63A2000-memory.dmp
memory/2880-194-0x000001FFC68D0000-0x000001FFC6DF8000-memory.dmp
memory/2880-197-0x000001FFC63F0000-0x000001FFC6440000-memory.dmp
memory/2880-198-0x000001FFC6360000-0x000001FFC636C000-memory.dmp
memory/3768-210-0x0000000000F00000-0x0000000000FC6000-memory.dmp
memory/3768-225-0x0000000075100000-0x00000000758B1000-memory.dmp
memory/3768-229-0x00000000065A0000-0x0000000006606000-memory.dmp
memory/3768-228-0x00000000064C0000-0x00000000064DE000-memory.dmp
memory/3768-227-0x00000000069F0000-0x0000000006F1C000-memory.dmp
memory/3768-226-0x00000000056F0000-0x0000000005700000-memory.dmp
memory/3768-206-0x00000000735D0000-0x00000000748E7000-memory.dmp
memory/3768-219-0x0000000005700000-0x000000000570A000-memory.dmp
memory/3768-211-0x0000000075100000-0x00000000758B1000-memory.dmp
memory/3768-212-0x0000000005630000-0x00000000056C2000-memory.dmp
memory/3768-213-0x0000000005D10000-0x00000000062B6000-memory.dmp
memory/3768-214-0x0000000005930000-0x0000000005AF2000-memory.dmp
memory/3768-218-0x0000000005770000-0x00000000057C0000-memory.dmp
memory/3768-217-0x00000000056F0000-0x0000000005700000-memory.dmp
memory/3768-216-0x00000000057E0000-0x0000000005856000-memory.dmp
memory/4056-132-0x0000000073030000-0x00000000731AD000-memory.dmp
memory/4056-110-0x0000000073030000-0x00000000731AD000-memory.dmp
memory/4056-102-0x0000000073030000-0x00000000731AD000-memory.dmp
memory/4056-103-0x00007FFF3E060000-0x00007FFF3E269000-memory.dmp
memory/4304-16-0x0000000000400000-0x0000000002C22000-memory.dmp
memory/4304-14-0x0000000002DC0000-0x0000000002DE7000-memory.dmp
memory/4304-13-0x0000000002E30000-0x0000000002F30000-memory.dmp
memory/4304-15-0x0000000000400000-0x0000000002C22000-memory.dmp
memory/4624-109-0x0000000000400000-0x0000000002C46000-memory.dmp
memory/4624-1-0x0000000002EC0000-0x0000000002FC0000-memory.dmp
memory/4624-126-0x0000000000400000-0x0000000002C46000-memory.dmp
memory/4624-127-0x0000000003200000-0x000000000326D000-memory.dmp
memory/4624-3-0x0000000000400000-0x0000000002C46000-memory.dmp
memory/4624-2-0x0000000003200000-0x000000000326D000-memory.dmp