Analysis
- max time kernel
142s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
27/04/2024, 00:18
General
- Target fcac04fb67b3dec2db923867c5cb0701.exe
- Size 431KB
- Sample240427-all38afa39
- SHA256 df620b823687fa8371cb9e5a0dc17c483d804ef601757968b8666de2608d8ebb
Malware Config
Signatures
- Detect ZGRat V1 3 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Downloads MZ/PE file
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 35 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 7 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fcac04fb67b3dec2db923867c5cb0701.exe"C:\Users\Admin\AppData\Local\Temp\fcac04fb67b3dec2db923867c5cb0701.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\u3xc.0.exe"C:\Users\Admin\AppData\Local\Temp\u3xc.0.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 10363⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\u3xc.2\run.exe"C:\Users\Admin\AppData\Local\Temp\u3xc.2\run.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\u3xc.3.exe"C:\Users\Admin\AppData\Local\Temp\u3xc.3.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 11522⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5032 -ip 50321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5088 -ip 50881⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:81⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3408 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:31⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2256 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
SCT Auditing Pending Reports
Sdch Dictionaries
335f67e8
tmpDF51.tmp
tmpF6B5.tmp
u3xc.0.exe
u3xc.1.zip
UIxMarketPlugin.dll
bunch.dat
relay.dll
run.exe
whale.dbf
u3xc.3.exe
memory/1080-99-0x0000000072970000-0x0000000072AEB000-memory.dmp
memory/1080-101-0x00007FFD07D10000-0x00007FFD07F05000-memory.dmp
memory/1080-128-0x0000000072970000-0x0000000072AEB000-memory.dmp
memory/1136-160-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/1136-159-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/1748-194-0x0000025B7E230000-0x0000025B7E252000-memory.dmp
memory/1748-184-0x0000025B7E170000-0x0000025B7E192000-memory.dmp
memory/1748-195-0x0000025B7E260000-0x0000025B7E27E000-memory.dmp
memory/1748-189-0x0000025B7E190000-0x0000025B7E19C000-memory.dmp
memory/1748-161-0x0000025B5A920000-0x0000025B5E218000-memory.dmp
memory/1748-162-0x0000025B78A30000-0x0000025B78B40000-memory.dmp
memory/1748-163-0x0000025B5FE00000-0x0000025B5FE10000-memory.dmp
memory/1748-164-0x0000025B789A0000-0x0000025B789AC000-memory.dmp
memory/1748-165-0x0000025B78990000-0x0000025B789A4000-memory.dmp
memory/1748-166-0x0000025B78A00000-0x0000025B78A24000-memory.dmp
memory/1748-167-0x0000025B78C90000-0x0000025B78C9A000-memory.dmp
memory/1748-169-0x0000025B78D00000-0x0000025B78DB2000-memory.dmp
memory/1748-168-0x0000025B78CD0000-0x0000025B78CFA000-memory.dmp
memory/1748-170-0x0000025B78DB0000-0x0000025B78E2A000-memory.dmp
memory/1748-171-0x0000025B78E30000-0x0000025B78E92000-memory.dmp
memory/1748-172-0x0000025B78F10000-0x0000025B78F86000-memory.dmp
memory/1748-173-0x0000025B78670000-0x0000025B7867A000-memory.dmp
memory/1748-177-0x0000025B78F90000-0x0000025B79290000-memory.dmp
memory/1748-188-0x0000025B7E1E0000-0x0000025B7E230000-memory.dmp
memory/1748-180-0x0000025B7D950000-0x0000025B7D958000-memory.dmp
memory/1748-181-0x0000025B7D290000-0x0000025B7D2C8000-memory.dmp
memory/1748-182-0x0000025B7D260000-0x0000025B7D26E000-memory.dmp
memory/1748-183-0x0000025B7E3F0000-0x0000025B7E3FA000-memory.dmp
memory/1748-185-0x0000025B7E930000-0x0000025B7EE58000-memory.dmp
memory/1988-206-0x00000000060E0000-0x0000000006146000-memory.dmp
memory/1988-202-0x00000000054D0000-0x0000000005520000-memory.dmp
memory/1988-231-0x00000000079D0000-0x00000000079DA000-memory.dmp
memory/1988-191-0x0000000071710000-0x0000000072964000-memory.dmp
memory/1988-205-0x0000000006060000-0x000000000607E000-memory.dmp
memory/1988-204-0x0000000006560000-0x0000000006A8C000-memory.dmp
memory/1988-197-0x0000000000C00000-0x0000000000CC6000-memory.dmp
memory/1988-198-0x0000000005330000-0x00000000053C2000-memory.dmp
memory/1988-199-0x0000000005980000-0x0000000005F24000-memory.dmp
memory/1988-200-0x00000000055A0000-0x0000000005762000-memory.dmp
memory/1988-201-0x0000000005450000-0x00000000054C6000-memory.dmp
memory/1988-203-0x00000000052D0000-0x00000000052DA000-memory.dmp
memory/4804-179-0x0000000072970000-0x0000000072AEB000-memory.dmp
memory/4804-146-0x00007FFD07D10000-0x00007FFD07F05000-memory.dmp
memory/5032-100-0x0000000000400000-0x0000000004038000-memory.dmp
memory/5088-122-0x0000000000400000-0x000000000405C000-memory.dmp
memory/5088-1-0x0000000004180000-0x0000000004280000-memory.dmp
memory/5088-13-0x0000000000400000-0x000000000405C000-memory.dmp
memory/5088-3-0x0000000000400000-0x000000000405C000-memory.dmp
memory/5088-123-0x0000000005CF0000-0x0000000005D5D000-memory.dmp
memory/5088-2-0x0000000005CF0000-0x0000000005D5D000-memory.dmp