Analysis
- max time kernel
137s - max time network
139s - platform
windows11-21h2_x64 - resource
win11-20240412-en - resource tags
- submitted
26/04/2024, 04:04
General
- Target be91111bb1e1de2451c5b71d3c8632b229c01322ea81715d30f4ba49b955ff4f.exe
- Size 395KB
- Sample240426-endbbahg8t
- SHA256 be91111bb1e1de2451c5b71d3c8632b229c01322ea81715d30f4ba49b955ff4f
Malware Config
Extracted
-
stealc
-
http://185.172.128.76
-
url_path
/3cd2b41cbde8fc9c.php
Signatures
- Detect ZGRat V1 3 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Stealc
Stealc is an infostealer written in C++.
- ZGRat
ZGRat is remote access trojan written in C#.
- Downloads MZ/PE file
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 4 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 24 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 7 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\be91111bb1e1de2451c5b71d3c8632b229c01322ea81715d30f4ba49b955ff4f.exe"C:\Users\Admin\AppData\Local\Temp\be91111bb1e1de2451c5b71d3c8632b229c01322ea81715d30f4ba49b955ff4f.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\u2ag.0.exe"C:\Users\Admin\AppData\Local\Temp\u2ag.0.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 11323⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 13563⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 13803⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\u2ag.2\run.exe"C:\Users\Admin\AppData\Local\Temp\u2ag.2\run.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\u2ag.3.exe"C:\Users\Admin\AppData\Local\Temp\u2ag.3.exe"2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 15442⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 536 -ip 5361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 536 -ip 5361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 536 -ip 5361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2968 -ip 29681⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
a6293fbe
ioloDMLog.txt
tmpF435.tmp
tmpF458.tmp
u2ag.0.exe
u2ag.1.zip
UIxMarketPlugin.dll
bunch.dat
relay.dll
run.exe
whale.dbf
u2ag.3.exe
memory/460-153-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/460-164-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/460-122-0x0000000000B70000-0x0000000000B71000-memory.dmp
memory/536-15-0x0000000000400000-0x0000000002AFD000-memory.dmp
memory/536-14-0x0000000002F60000-0x0000000002F87000-memory.dmp
memory/536-13-0x0000000002BB0000-0x0000000002CB0000-memory.dmp
memory/536-119-0x0000000000400000-0x0000000002AFD000-memory.dmp
memory/808-171-0x000002A6ACE60000-0x000002A6ACE74000-memory.dmp
memory/808-185-0x000002A6ACDF0000-0x000002A6ACE00000-memory.dmp
memory/808-213-0x000002A6ACDF0000-0x000002A6ACE00000-memory.dmp
memory/808-224-0x000002A6ACDF0000-0x000002A6ACE00000-memory.dmp
memory/808-212-0x000002A6ACDF0000-0x000002A6ACE00000-memory.dmp
memory/808-209-0x00007FFE54AF0000-0x00007FFE555B2000-memory.dmp
memory/808-216-0x000002A6ACDF0000-0x000002A6ACE00000-memory.dmp
memory/808-244-0x000002A6ACDF0000-0x000002A6ACE00000-memory.dmp
memory/808-200-0x000002A6CC150000-0x000002A6CC16E000-memory.dmp
memory/808-165-0x00007FFE54AF0000-0x00007FFE555B2000-memory.dmp
memory/808-166-0x000002A6A9070000-0x000002A6AC968000-memory.dmp
memory/808-167-0x000002A6ACDF0000-0x000002A6ACE00000-memory.dmp
memory/808-170-0x000002A6C7170000-0x000002A6C717C000-memory.dmp
memory/808-169-0x000002A6ACDE0000-0x000002A6ACDF0000-memory.dmp
memory/808-168-0x000002A6C7060000-0x000002A6C7170000-memory.dmp
memory/808-199-0x000002A6CC120000-0x000002A6CC142000-memory.dmp
memory/808-172-0x000002A6C71E0000-0x000002A6C7204000-memory.dmp
memory/808-173-0x000002A6C7360000-0x000002A6C736A000-memory.dmp
memory/808-174-0x000002A6C7380000-0x000002A6C73AA000-memory.dmp
memory/808-175-0x000002A6C73B0000-0x000002A6C7462000-memory.dmp
memory/808-176-0x000002A6C7460000-0x000002A6C74DA000-memory.dmp
memory/808-177-0x000002A6C74E0000-0x000002A6C7542000-memory.dmp
memory/808-178-0x000002A6C75C0000-0x000002A6C7636000-memory.dmp
memory/808-179-0x000002A6ACE30000-0x000002A6ACE3A000-memory.dmp
memory/808-183-0x000002A6C7640000-0x000002A6C7940000-memory.dmp
memory/808-198-0x000002A6ACDF0000-0x000002A6ACE00000-memory.dmp
memory/808-186-0x000002A6CBA60000-0x000002A6CBA68000-memory.dmp
memory/808-187-0x000002A6ACDF0000-0x000002A6ACE00000-memory.dmp
memory/808-189-0x000002A6ACDF0000-0x000002A6ACE00000-memory.dmp
memory/808-188-0x000002A6CB9E0000-0x000002A6CBA18000-memory.dmp
memory/808-190-0x000002A6CB9B0000-0x000002A6CB9BE000-memory.dmp
memory/808-191-0x000002A6CC300000-0x000002A6CC30A000-memory.dmp
memory/808-192-0x000002A6CC310000-0x000002A6CC332000-memory.dmp
memory/808-193-0x000002A6CC860000-0x000002A6CCD88000-memory.dmp
memory/808-196-0x000002A6CC0D0000-0x000002A6CC120000-memory.dmp
memory/808-197-0x000002A6CC080000-0x000002A6CC08C000-memory.dmp
memory/1896-205-0x0000000070FF0000-0x0000000072307000-memory.dmp
memory/1896-215-0x0000000005740000-0x0000000005CE6000-memory.dmp
memory/1896-245-0x0000000073A30000-0x00000000741E1000-memory.dmp
memory/1896-220-0x00000000050F0000-0x00000000050FA000-memory.dmp
memory/1896-217-0x0000000005360000-0x0000000005522000-memory.dmp
memory/1896-218-0x0000000005210000-0x0000000005286000-memory.dmp
memory/1896-210-0x0000000000900000-0x00000000009C6000-memory.dmp
memory/1896-223-0x0000000005ED0000-0x0000000005F36000-memory.dmp
memory/1896-219-0x0000000005290000-0x00000000052E0000-memory.dmp
memory/1896-211-0x0000000073A30000-0x00000000741E1000-memory.dmp
memory/1896-221-0x0000000006320000-0x000000000684C000-memory.dmp
memory/1896-214-0x0000000005030000-0x00000000050C2000-memory.dmp
memory/1896-243-0x00000000076E0000-0x00000000076EA000-memory.dmp
memory/1896-222-0x0000000005E10000-0x0000000005E2E000-memory.dmp
memory/2968-126-0x00000000030F0000-0x000000000315D000-memory.dmp
memory/2968-1-0x0000000002C50000-0x0000000002D50000-memory.dmp
memory/2968-2-0x00000000030F0000-0x000000000315D000-memory.dmp
memory/2968-3-0x0000000000400000-0x0000000002B21000-memory.dmp
memory/2968-125-0x0000000000400000-0x0000000002B21000-memory.dmp
memory/3264-102-0x00007FFE75C00000-0x00007FFE75E09000-memory.dmp
memory/3264-131-0x00000000724C0000-0x000000007263D000-memory.dmp
memory/3264-108-0x00000000724C0000-0x000000007263D000-memory.dmp
memory/3264-101-0x00000000724C0000-0x000000007263D000-memory.dmp
memory/4648-133-0x00000000724C0000-0x000000007263D000-memory.dmp
memory/4648-150-0x00007FFE75C00000-0x00007FFE75E09000-memory.dmp
memory/4648-206-0x00000000724C0000-0x000000007263D000-memory.dmp
memory/4648-202-0x00000000724C0000-0x000000007263D000-memory.dmp
memory/4648-203-0x00000000724C0000-0x000000007263D000-memory.dmp