Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
26/04/2024, 15:37
General
- Target f91fc462b41ac642d139f6eb7ed1bb8d146c68d804ee9646c114a78e935b8f37.exe
- Size 451KB
- Sample240426-s2rmraef44
- SHA256 f91fc462b41ac642d139f6eb7ed1bb8d146c68d804ee9646c114a78e935b8f37
Malware Config
Signatures
- Detect ZGRat V1 3 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Downloads MZ/PE file
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 24 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 7 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f91fc462b41ac642d139f6eb7ed1bb8d146c68d804ee9646c114a78e935b8f37.exe"C:\Users\Admin\AppData\Local\Temp\f91fc462b41ac642d139f6eb7ed1bb8d146c68d804ee9646c114a78e935b8f37.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\u1qo.0.exe"C:\Users\Admin\AppData\Local\Temp\u1qo.0.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\u1qo.2\run.exe"C:\Users\Admin\AppData\Local\Temp\u1qo.2\run.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\u1qo.3.exe"C:\Users\Admin\AppData\Local\Temp\u1qo.3.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 11522⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2256 -ip 22561⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
a7793149
ioloDMLog.txt
tmpC8E0.tmp
tmpC912.tmp
u1qo.0.exe
u1qo.1.zip
UIxMarketPlugin.dll
bunch.dat
relay.dll
run.exe
whale.dbf
u1qo.3.exe
memory/544-13-0x0000000000400000-0x000000000403D000-memory.dmp
memory/2076-146-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/2076-158-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/2256-120-0x0000000000400000-0x0000000004061000-memory.dmp
memory/2256-2-0x0000000004200000-0x000000000426D000-memory.dmp
memory/2256-121-0x0000000004200000-0x000000000426D000-memory.dmp
memory/2256-3-0x0000000000400000-0x0000000004061000-memory.dmp
memory/2256-1-0x00000000042D0000-0x00000000043D0000-memory.dmp
memory/3340-126-0x0000000072DA0000-0x0000000072F1B000-memory.dmp
memory/3340-100-0x00007FFA6B430000-0x00007FFA6B625000-memory.dmp
memory/3340-99-0x0000000072DA0000-0x0000000072F1B000-memory.dmp
memory/3452-167-0x0000019F2AF80000-0x0000019F2B032000-memory.dmp
memory/3452-186-0x0000019F306E0000-0x0000019F306EC000-memory.dmp
memory/3452-161-0x0000019F10DA0000-0x0000019F10DB0000-memory.dmp
memory/3452-163-0x0000019F294D0000-0x0000019F294E4000-memory.dmp
memory/3452-164-0x0000019F2AD40000-0x0000019F2AD64000-memory.dmp
memory/3452-165-0x0000019F2AD60000-0x0000019F2AD6A000-memory.dmp
memory/3452-166-0x0000019F2AD80000-0x0000019F2ADAA000-memory.dmp
memory/3452-160-0x0000019F2B140000-0x0000019F2B250000-memory.dmp
memory/3452-168-0x0000019F2AEF0000-0x0000019F2AF6A000-memory.dmp
memory/3452-169-0x0000019F2B390000-0x0000019F2B3F2000-memory.dmp
memory/3452-170-0x0000019F2B470000-0x0000019F2B4E6000-memory.dmp
memory/3452-171-0x0000019F2AD70000-0x0000019F2AD7A000-memory.dmp
memory/3452-175-0x0000019F2B4F0000-0x0000019F2B7F0000-memory.dmp
memory/3452-177-0x0000019F2F140000-0x0000019F2F148000-memory.dmp
memory/3452-178-0x0000019F2F840000-0x0000019F2F878000-memory.dmp
memory/3452-179-0x0000019F2F810000-0x0000019F2F81E000-memory.dmp
memory/3452-180-0x0000019F2F8C0000-0x0000019F2F8CA000-memory.dmp
memory/3452-181-0x0000019F30960000-0x0000019F30982000-memory.dmp
memory/3452-182-0x0000019F30EB0000-0x0000019F313D8000-memory.dmp
memory/3452-162-0x0000019F294E0000-0x0000019F294EC000-memory.dmp
memory/3452-185-0x0000019F30730000-0x0000019F30780000-memory.dmp
memory/3452-187-0x0000019F30780000-0x0000019F307A2000-memory.dmp
memory/3452-159-0x0000019F0B770000-0x0000019F0F068000-memory.dmp
memory/3452-189-0x0000019F307B0000-0x0000019F307CE000-memory.dmp
memory/3676-188-0x0000000072DA0000-0x0000000072F1B000-memory.dmp
memory/3676-144-0x00007FFA6B430000-0x00007FFA6B625000-memory.dmp
memory/4376-200-0x0000000005880000-0x00000000058D0000-memory.dmp
memory/4376-197-0x0000000005D90000-0x0000000006334000-memory.dmp
memory/4376-198-0x0000000005A20000-0x0000000005BE2000-memory.dmp
memory/4376-199-0x00000000058D0000-0x0000000005946000-memory.dmp
memory/4376-192-0x00000000734D0000-0x0000000074724000-memory.dmp
memory/4376-201-0x0000000005810000-0x000000000581A000-memory.dmp
memory/4376-202-0x00000000069B0000-0x0000000006EDC000-memory.dmp
memory/4376-203-0x0000000006500000-0x000000000651E000-memory.dmp
memory/4376-204-0x00000000065F0000-0x0000000006656000-memory.dmp
memory/4376-196-0x0000000005740000-0x00000000057D2000-memory.dmp
memory/4376-195-0x0000000001200000-0x00000000012C6000-memory.dmp
memory/4376-223-0x0000000007DD0000-0x0000000007DDA000-memory.dmp