Analysis
- max time kernel
147s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20240412-en - resource tags
- submitted
26/04/2024, 05:14
General
- Target bdc17d6fb9d21c9bb5bcbf4d9ea8a7a9104d820a2f8745ff517c4580b397e18f.exe
- Size 406KB
- Sample240426-fxb1aaac69
- SHA256 bdc17d6fb9d21c9bb5bcbf4d9ea8a7a9104d820a2f8745ff517c4580b397e18f
Malware Config
Signatures
- Detect ZGRat V1 3 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Stealc
Stealc is an infostealer written in C++.
- ZGRat
ZGRat is remote access trojan written in C#.
- Downloads MZ/PE file
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 24 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 7 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bdc17d6fb9d21c9bb5bcbf4d9ea8a7a9104d820a2f8745ff517c4580b397e18f.exe"C:\Users\Admin\AppData\Local\Temp\bdc17d6fb9d21c9bb5bcbf4d9ea8a7a9104d820a2f8745ff517c4580b397e18f.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\u2ug.0.exe"C:\Users\Admin\AppData\Local\Temp\u2ug.0.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 11883⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\u2ug.2\run.exe"C:\Users\Admin\AppData\Local\Temp\u2ug.2\run.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\u2ug.3.exe"C:\Users\Admin\AppData\Local\Temp\u2ug.3.exe"2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 11602⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3052 -ip 30521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3688 -ip 36881⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
9fcc953f
ioloDMLog.txt
tmpE1A7.tmp
tmpE1CA.tmp
u2ug.0.exe
u2ug.1.zip
UIxMarketPlugin.dll
bunch.dat
relay.dll
run.exe
whale.dbf
u2ug.3.exe
memory/332-101-0x00007FFE8F080000-0x00007FFE8F289000-memory.dmp
memory/332-129-0x00000000730C0000-0x000000007323D000-memory.dmp
memory/332-107-0x00000000730C0000-0x000000007323D000-memory.dmp
memory/332-100-0x00000000730C0000-0x000000007323D000-memory.dmp
memory/1380-118-0x0000000002760000-0x0000000002761000-memory.dmp
memory/1380-150-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/1380-162-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/1876-177-0x00000272C4A30000-0x00000272C4A3A000-memory.dmp
memory/1876-193-0x00000272C9D20000-0x00000272C9D70000-memory.dmp
memory/1876-241-0x00000272C4A90000-0x00000272C4AA0000-memory.dmp
memory/1876-240-0x00000272C4A90000-0x00000272C4AA0000-memory.dmp
memory/1876-238-0x00000272C4A90000-0x00000272C4AA0000-memory.dmp
memory/1876-212-0x00000272C4A90000-0x00000272C4AA0000-memory.dmp
memory/1876-209-0x00000272C4A90000-0x00000272C4AA0000-memory.dmp
memory/1876-163-0x00007FFE6DF70000-0x00007FFE6EA32000-memory.dmp
memory/1876-164-0x00000272A6C80000-0x00000272AA578000-memory.dmp
memory/1876-165-0x00000272C4A90000-0x00000272C4AA0000-memory.dmp
memory/1876-166-0x00000272C4CB0000-0x00000272C4DC0000-memory.dmp
memory/1876-167-0x00000272C4A50000-0x00000272C4A60000-memory.dmp
memory/1876-168-0x00000272C4A70000-0x00000272C4A7C000-memory.dmp
memory/1876-169-0x00000272C4A60000-0x00000272C4A74000-memory.dmp
memory/1876-170-0x00000272C4E00000-0x00000272C4E24000-memory.dmp
memory/1876-171-0x00000272C4F70000-0x00000272C4F7A000-memory.dmp
memory/1876-173-0x00000272C4F90000-0x00000272C5042000-memory.dmp
memory/1876-172-0x00000272C5040000-0x00000272C506A000-memory.dmp
memory/1876-174-0x00000272C5070000-0x00000272C50EA000-memory.dmp
memory/1876-175-0x00000272C50F0000-0x00000272C5152000-memory.dmp
memory/1876-176-0x00000272C51D0000-0x00000272C5246000-memory.dmp
memory/1876-203-0x00007FFE6DF70000-0x00007FFE6EA32000-memory.dmp
memory/1876-181-0x00000272C5250000-0x00000272C5550000-memory.dmp
memory/1876-183-0x00000272C4A90000-0x00000272C4AA0000-memory.dmp
memory/1876-185-0x00000272C4A90000-0x00000272C4AA0000-memory.dmp
memory/1876-184-0x00000272C9C70000-0x00000272C9C78000-memory.dmp
memory/1876-186-0x00000272C95F0000-0x00000272C9628000-memory.dmp
memory/1876-187-0x00000272C95C0000-0x00000272C95CE000-memory.dmp
memory/1876-188-0x00000272C9C80000-0x00000272C9C8A000-memory.dmp
memory/1876-189-0x00000272C9CB0000-0x00000272C9CD2000-memory.dmp
memory/1876-190-0x00000272CA200000-0x00000272CA728000-memory.dmp
memory/1876-197-0x00000272C9D00000-0x00000272C9D1E000-memory.dmp
memory/1876-195-0x00000272C4A90000-0x00000272C4AA0000-memory.dmp
memory/1876-194-0x00000272C9C90000-0x00000272C9C9C000-memory.dmp
memory/1876-196-0x00000272C9FF0000-0x00000272CA012000-memory.dmp
memory/2788-199-0x00000000730C0000-0x000000007323D000-memory.dmp
memory/2788-200-0x00000000730C0000-0x000000007323D000-memory.dmp
memory/2788-204-0x00000000730C0000-0x000000007323D000-memory.dmp
memory/2788-131-0x00000000730C0000-0x000000007323D000-memory.dmp
memory/2788-148-0x00007FFE8F080000-0x00007FFE8F289000-memory.dmp
memory/3052-13-0x00000000041D0000-0x00000000041F7000-memory.dmp
memory/3052-12-0x0000000004200000-0x0000000004300000-memory.dmp
memory/3052-14-0x0000000000400000-0x0000000004033000-memory.dmp
memory/3688-124-0x0000000005D80000-0x0000000005DED000-memory.dmp
memory/3688-1-0x00000000041D0000-0x00000000042D0000-memory.dmp
memory/3688-123-0x0000000000400000-0x0000000004056000-memory.dmp
memory/3688-2-0x0000000005D80000-0x0000000005DED000-memory.dmp
memory/4008-213-0x0000000005D30000-0x0000000005EF2000-memory.dmp
memory/4008-211-0x0000000006000000-0x00000000065A6000-memory.dmp
memory/4008-215-0x0000000005AD0000-0x0000000005B20000-memory.dmp
memory/4008-216-0x0000000005940000-0x000000000594A000-memory.dmp
memory/4008-217-0x0000000006BE0000-0x000000000710C000-memory.dmp
memory/4008-218-0x00000000066E0000-0x00000000066FE000-memory.dmp
memory/4008-219-0x00000000067B0000-0x0000000006816000-memory.dmp
memory/4008-214-0x0000000005A50000-0x0000000005AC6000-memory.dmp
memory/4008-210-0x00000000059B0000-0x0000000005A42000-memory.dmp
memory/4008-207-0x00000000011B0000-0x0000000001276000-memory.dmp
memory/4008-239-0x0000000007FC0000-0x0000000007FCA000-memory.dmp
memory/4008-208-0x0000000072640000-0x0000000072DF1000-memory.dmp
memory/4008-202-0x0000000073660000-0x0000000074977000-memory.dmp
memory/4008-242-0x0000000072640000-0x0000000072DF1000-memory.dmp