Analysis
- max time kernel
145s - max time network
146s - platform
windows11-21h2_x64 - resource
win11-20240426-en - resource tags
- submitted
26/04/2024, 23:20
General
- Target 8fccb807b4e815a83f1b75c048b85ab71ef3d378aea8909b5c0ec5bdde148fd8.exe
- Size 431KB
- Sample240426-3bmafsfa5w
- SHA256 8fccb807b4e815a83f1b75c048b85ab71ef3d378aea8909b5c0ec5bdde148fd8
Malware Config
Signatures
- Detect ZGRat V1 3 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Downloads MZ/PE file
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 26 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 7 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8fccb807b4e815a83f1b75c048b85ab71ef3d378aea8909b5c0ec5bdde148fd8.exe"C:\Users\Admin\AppData\Local\Temp\8fccb807b4e815a83f1b75c048b85ab71ef3d378aea8909b5c0ec5bdde148fd8.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\u1l0.0.exe"C:\Users\Admin\AppData\Local\Temp\u1l0.0.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4900 -s 12443⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\u1l0.2\run.exe"C:\Users\Admin\AppData\Local\Temp\u1l0.2\run.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\u1l0.3.exe"C:\Users\Admin\AppData\Local\Temp\u1l0.3.exe"2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 11642⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4900 -ip 49001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2052 -ip 20521⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
93f69223
ioloDMLog.txt
tmpF2DE.tmp
tmpF2F0.tmp
u1l0.0.exe
u1l0.1.zip
UIxMarketPlugin.dll
bunch.dat
relay.dll
run.exe
whale.dbf
u1l0.3.exe
memory/560-99-0x00000000729D0000-0x0000000072B4D000-memory.dmp
memory/560-100-0x00007FFE70900000-0x00007FFE70B09000-memory.dmp
memory/560-125-0x00000000729D0000-0x0000000072B4D000-memory.dmp
memory/2052-120-0x0000000000400000-0x000000000405C000-memory.dmp
memory/2052-1-0x0000000004410000-0x0000000004510000-memory.dmp
memory/2052-3-0x0000000000400000-0x000000000405C000-memory.dmp
memory/2052-2-0x0000000005DB0000-0x0000000005E1D000-memory.dmp
memory/2260-146-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/2260-157-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/3020-167-0x000001FBCAF90000-0x000001FBCB00A000-memory.dmp
memory/3020-181-0x000001FBD0120000-0x000001FBD0648000-memory.dmp
memory/3020-161-0x000001FBCAA80000-0x000001FBCAA8C000-memory.dmp
memory/3020-160-0x000001FBB0940000-0x000001FBB0950000-memory.dmp
memory/3020-162-0x000001FBCAA70000-0x000001FBCAA84000-memory.dmp
memory/3020-163-0x000001FBCAD00000-0x000001FBCAD24000-memory.dmp
memory/3020-164-0x000001FBCAE90000-0x000001FBCAE9A000-memory.dmp
memory/3020-165-0x000001FBCAEB0000-0x000001FBCAEDA000-memory.dmp
memory/3020-166-0x000001FBCAEE0000-0x000001FBCAF92000-memory.dmp
memory/3020-158-0x000001FBACBA0000-0x000001FBB0498000-memory.dmp
memory/3020-168-0x000001FBCB010000-0x000001FBCB072000-memory.dmp
memory/3020-169-0x000001FBCB0F0000-0x000001FBCB166000-memory.dmp
memory/3020-170-0x000001FBCAA50000-0x000001FBCAA5A000-memory.dmp
memory/3020-174-0x000001FBCB170000-0x000001FBCB470000-memory.dmp
memory/3020-176-0x000001FBCEE20000-0x000001FBCEE28000-memory.dmp
memory/3020-177-0x000001FBCF520000-0x000001FBCF558000-memory.dmp
memory/3020-178-0x000001FBCF4F0000-0x000001FBCF4FE000-memory.dmp
memory/3020-179-0x000001FBCF570000-0x000001FBCF57A000-memory.dmp
memory/3020-180-0x000001FBCFBB0000-0x000001FBCFBD2000-memory.dmp
memory/3020-159-0x000001FBCABE0000-0x000001FBCACF0000-memory.dmp
memory/3020-184-0x000001FBCFC30000-0x000001FBCFC80000-memory.dmp
memory/3020-185-0x000001FBCFBE0000-0x000001FBCFBEC000-memory.dmp
memory/3020-186-0x000001FBCFF00000-0x000001FBCFF22000-memory.dmp
memory/3020-187-0x000001FBCFF30000-0x000001FBCFF4E000-memory.dmp
memory/3824-198-0x0000000005AB0000-0x0000000005B26000-memory.dmp
memory/3824-202-0x00000000066C0000-0x00000000066DE000-memory.dmp
memory/3824-194-0x0000000001190000-0x0000000001256000-memory.dmp
memory/3824-195-0x0000000005950000-0x00000000059E2000-memory.dmp
memory/3824-196-0x0000000005FA0000-0x0000000006546000-memory.dmp
memory/3824-197-0x0000000005C80000-0x0000000005E42000-memory.dmp
memory/3824-191-0x0000000072F70000-0x0000000074287000-memory.dmp
memory/3824-200-0x0000000005920000-0x000000000592A000-memory.dmp
memory/3824-222-0x0000000007FD0000-0x0000000007FDA000-memory.dmp
memory/3824-201-0x0000000006B80000-0x00000000070AC000-memory.dmp
memory/3824-199-0x0000000005A20000-0x0000000005A70000-memory.dmp
memory/3824-203-0x0000000006790000-0x00000000067F6000-memory.dmp
memory/4688-143-0x00007FFE70900000-0x00007FFE70B09000-memory.dmp
memory/4688-189-0x00000000729D0000-0x0000000072B4D000-memory.dmp
memory/4900-13-0x0000000000400000-0x0000000004038000-memory.dmp