Analysis
- max time kernel
148s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20240412-en - resource tags
- submitted
25/04/2024, 16:04
General
- Target fcb5d2a31d1461a8c9cc257954b7954fc3f900999cc4d90132c4cf69af5ab861.exe
- Size 396KB
- Sample240425-tjcljscc7x
- SHA256 fcb5d2a31d1461a8c9cc257954b7954fc3f900999cc4d90132c4cf69af5ab861
Malware Config
Signatures
- Detect ZGRat V1 3 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Stealc
Stealc is an infostealer written in C++.
- ZGRat
ZGRat is remote access trojan written in C#.
- Downloads MZ/PE file
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 25 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 7 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fcb5d2a31d1461a8c9cc257954b7954fc3f900999cc4d90132c4cf69af5ab861.exe"C:\Users\Admin\AppData\Local\Temp\fcb5d2a31d1461a8c9cc257954b7954fc3f900999cc4d90132c4cf69af5ab861.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\u37o.0.exe"C:\Users\Admin\AppData\Local\Temp\u37o.0.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 10963⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\u37o.2\run.exe"C:\Users\Admin\AppData\Local\Temp\u37o.2\run.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\u37o.3.exe"C:\Users\Admin\AppData\Local\Temp\u37o.3.exe"2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 12282⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2256 -ip 22561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4164 -ip 41641⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
ee3b2a9d
ioloDMLog.txt
tmpD9F2.tmp
tmpDA24.tmp
u37o.0.exe
u37o.1.zip
UIxMarketPlugin.dll
bunch.dat
relay.dll
run.exe
whale.dbf
u37o.3.exe
memory/1200-240-0x00000168FDDA0000-0x00000168FDDAA000-memory.dmp
memory/1200-229-0x00000168F81B0000-0x00000168F81BA000-memory.dmp
memory/1200-248-0x00000168F9800000-0x00000168F9822000-memory.dmp
memory/1200-245-0x00000168F9530000-0x00000168F9580000-memory.dmp
memory/1200-251-0x00007FF907DD0000-0x00007FF908892000-memory.dmp
memory/1200-246-0x00000168F94E0000-0x00000168F94EC000-memory.dmp
memory/1200-247-0x00000168F89E0000-0x00000168F89F0000-memory.dmp
memory/1200-242-0x00000168FE2E0000-0x00000168FE808000-memory.dmp
memory/1200-241-0x00000168FDB20000-0x00000168FDB42000-memory.dmp
memory/1200-252-0x00000168F89E0000-0x00000168F89F0000-memory.dmp
memory/1200-253-0x00000168F89E0000-0x00000168F89F0000-memory.dmp
memory/1200-239-0x00000168FD410000-0x00000168FD41E000-memory.dmp
memory/1200-238-0x00000168FD440000-0x00000168FD478000-memory.dmp
memory/1200-236-0x00000168FDB00000-0x00000168FDB08000-memory.dmp
memory/1200-237-0x00000168F89E0000-0x00000168F89F0000-memory.dmp
memory/1200-235-0x00000168F89E0000-0x00000168F89F0000-memory.dmp
memory/1200-233-0x00000168F90E0000-0x00000168F93E0000-memory.dmp
memory/1200-249-0x00000168F9830000-0x00000168F984E000-memory.dmp
memory/1200-228-0x00000168F9060000-0x00000168F90D6000-memory.dmp
memory/1200-226-0x00000168F8F00000-0x00000168F8F7A000-memory.dmp
memory/1200-227-0x00000168F8F80000-0x00000168F8FE2000-memory.dmp
memory/1200-225-0x00000168F8ED0000-0x00000168F8EFA000-memory.dmp
memory/1200-224-0x00000168F8E10000-0x00000168F8EC2000-memory.dmp
memory/1200-223-0x00000168F8E00000-0x00000168F8E0A000-memory.dmp
memory/1200-222-0x00000168F8C80000-0x00000168F8CA4000-memory.dmp
memory/1200-221-0x00000168F89F0000-0x00000168F8A04000-memory.dmp
memory/1200-220-0x00000168F8A00000-0x00000168F8A0C000-memory.dmp
memory/1200-219-0x00000168F89D0000-0x00000168F89E0000-memory.dmp
memory/1200-218-0x00000168F8B10000-0x00000168F8C20000-memory.dmp
memory/1200-217-0x00000168F89E0000-0x00000168F89F0000-memory.dmp
memory/1200-216-0x00000168F2B10000-0x00000168F6408000-memory.dmp
memory/1200-254-0x00000168F89E0000-0x00000168F89F0000-memory.dmp
memory/1200-255-0x00000168F89E0000-0x00000168F89F0000-memory.dmp
memory/1200-256-0x00000168F89E0000-0x00000168F89F0000-memory.dmp
memory/1200-215-0x00007FF907DD0000-0x00007FF908892000-memory.dmp
memory/1552-145-0x00000000064F0000-0x000000000650E000-memory.dmp
memory/1552-131-0x00000000054A0000-0x0000000005532000-memory.dmp
memory/1552-125-0x0000000071750000-0x0000000072A67000-memory.dmp
memory/1552-129-0x0000000000D40000-0x0000000000E06000-memory.dmp
memory/1552-130-0x00000000732E0000-0x0000000073A91000-memory.dmp
memory/1552-146-0x00000000065C0000-0x0000000006626000-memory.dmp
memory/1552-132-0x0000000005AF0000-0x0000000006096000-memory.dmp
memory/1552-144-0x00000000069D0000-0x0000000006EFC000-memory.dmp
memory/1552-141-0x0000000005590000-0x00000000055A0000-memory.dmp
memory/1552-140-0x00000000732E0000-0x0000000073A91000-memory.dmp
memory/1552-137-0x0000000005570000-0x000000000557A000-memory.dmp
memory/1552-136-0x00000000056F0000-0x0000000005740000-memory.dmp
memory/1552-135-0x0000000005620000-0x0000000005696000-memory.dmp
memory/1552-134-0x0000000005770000-0x0000000005932000-memory.dmp
memory/1552-133-0x0000000005590000-0x00000000055A0000-memory.dmp
memory/2256-16-0x0000000000400000-0x0000000002C22000-memory.dmp
memory/2256-15-0x0000000000400000-0x0000000002C22000-memory.dmp
memory/2256-14-0x00000000030A0000-0x00000000030C7000-memory.dmp
memory/2256-13-0x0000000002D70000-0x0000000002E70000-memory.dmp
memory/2988-112-0x0000000072D30000-0x0000000072EAD000-memory.dmp
memory/2988-103-0x0000000072D30000-0x0000000072EAD000-memory.dmp
memory/2988-104-0x00007FF929B60000-0x00007FF929D69000-memory.dmp
memory/2988-110-0x0000000072D30000-0x0000000072EAD000-memory.dmp
memory/3404-127-0x0000000072D30000-0x0000000072EAD000-memory.dmp
memory/3404-114-0x0000000072D30000-0x0000000072EAD000-memory.dmp
memory/3404-117-0x00007FF929B60000-0x00007FF929D69000-memory.dmp
memory/3404-121-0x0000000072D30000-0x0000000072EAD000-memory.dmp
memory/3404-122-0x0000000072D30000-0x0000000072EAD000-memory.dmp
memory/3676-177-0x0000000002670000-0x0000000002671000-memory.dmp
memory/3676-211-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/3676-214-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/4164-119-0x0000000000400000-0x0000000002C46000-memory.dmp
memory/4164-17-0x0000000000400000-0x0000000002C46000-memory.dmp
memory/4164-1-0x0000000002EA0000-0x0000000002FA0000-memory.dmp
memory/4164-182-0x0000000000400000-0x0000000002C46000-memory.dmp
memory/4164-111-0x0000000002EA0000-0x0000000002FA0000-memory.dmp
memory/4164-116-0x0000000004B40000-0x0000000004BAD000-memory.dmp
memory/4164-3-0x0000000000400000-0x0000000002C46000-memory.dmp
memory/4164-2-0x0000000004B40000-0x0000000004BAD000-memory.dmp