Analysis
- max time kernel
288s - max time network
294s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
02/05/2024, 02:34
General
- Target ISetup5.exe
- Size 434KB
- Sample240502-c2hf3sef4x
- SHA256 6bea74bd9d96718e04955348bb175fc00018d7e19b94b764fb987702694e6a0f
Malware Config
Extracted
-
stealc
-
http://185.172.128.150
-
url_path
/c698e1bc8a2f5e6d.php
Signatures
- Detect ZGRat V1 3 IoCs
- Detects Arechclient2 RAT 1 IoCs
Arechclient2.
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Stealc
Stealc is an infostealer written in C++.
- ZGRat
ZGRat is remote access trojan written in C#.
- Downloads MZ/PE file
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 32 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 7 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ISetup5.exe"C:\Users\Admin\AppData\Local\Temp\ISetup5.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\u1wg.0.exe"C:\Users\Admin\AppData\Local\Temp\u1wg.0.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 23323⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\u1wg.2\run.exe"C:\Users\Admin\AppData\Local\Temp\u1wg.2\run.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\u1wg.3.exe"C:\Users\Admin\AppData\Local\Temp\u1wg.3.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 15922⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2464 -ip 24641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3600 -ip 36001⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Are.docx
mozglue.dll
nss3.dll
167a4b8d
ioloDMLog.txt
tmpE15.tmp
tmpE38.tmp
u1wg.0.exe
u1wg.1.zip
UIxMarketPlugin.dll
bunch.dat
relay.dll
run.exe
whale.dbf
u1wg.3.exe
memory/1264-229-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/1264-241-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/1540-227-0x00007FFA6A590000-0x00007FFA6A785000-memory.dmp
memory/1540-283-0x0000000072860000-0x00000000729DB000-memory.dmp
memory/1764-209-0x0000000072860000-0x00000000729DB000-memory.dmp
memory/1764-172-0x0000000072860000-0x00000000729DB000-memory.dmp
memory/1764-173-0x00007FFA6A590000-0x00007FFA6A785000-memory.dmp
memory/1884-256-0x00000245F7690000-0x00000245F76A4000-memory.dmp
memory/1884-273-0x00000245FD820000-0x00000245FD82E000-memory.dmp
memory/1884-284-0x00000245FD8D0000-0x00000245FD8EE000-memory.dmp
memory/1884-282-0x00000245FD8A0000-0x00000245FD8C2000-memory.dmp
memory/1884-280-0x00000245FDD20000-0x00000245FDD70000-memory.dmp
memory/1884-281-0x0000024598B20000-0x0000024598B2C000-memory.dmp
memory/1884-277-0x00000245992C0000-0x00000245997E8000-memory.dmp
memory/1884-275-0x0000024598B00000-0x0000024598B22000-memory.dmp
memory/1884-274-0x0000024598D80000-0x0000024598D8A000-memory.dmp
memory/1884-242-0x00000245F20B0000-0x00000245F59A8000-memory.dmp
memory/1884-272-0x00000245FD860000-0x00000245FD898000-memory.dmp
memory/1884-253-0x00000245F9120000-0x00000245F9230000-memory.dmp
memory/1884-255-0x00000245F7740000-0x00000245F774C000-memory.dmp
memory/1884-254-0x00000245F5F70000-0x00000245F5F80000-memory.dmp
memory/1884-271-0x00000245FD190000-0x00000245FD198000-memory.dmp
memory/1884-257-0x00000245F8EA0000-0x00000245F8EC4000-memory.dmp
memory/1884-258-0x00000245F7720000-0x00000245F772A000-memory.dmp
memory/1884-259-0x00000245F8F60000-0x00000245F8F8A000-memory.dmp
memory/1884-260-0x00000245F9370000-0x00000245F9422000-memory.dmp
memory/1884-261-0x00000245F8F90000-0x00000245F900A000-memory.dmp
memory/1884-263-0x00000245F9500000-0x00000245F9576000-memory.dmp
memory/1884-262-0x00000245F9420000-0x00000245F9482000-memory.dmp
memory/1884-264-0x00000245F7730000-0x00000245F773A000-memory.dmp
memory/1884-268-0x00000245F9580000-0x00000245F9880000-memory.dmp
memory/2464-203-0x0000000000400000-0x0000000000470000-memory.dmp
memory/2464-201-0x0000000000400000-0x0000000002B2A000-memory.dmp
memory/2464-1-0x0000000002D00000-0x0000000002E00000-memory.dmp
memory/2464-3-0x0000000000400000-0x0000000000470000-memory.dmp
memory/2464-2-0x0000000002F70000-0x0000000002FDD000-memory.dmp
memory/2464-15-0x0000000000400000-0x0000000002B2A000-memory.dmp
memory/2464-202-0x0000000002F70000-0x0000000002FDD000-memory.dmp
memory/3600-18-0x0000000000400000-0x0000000002B06000-memory.dmp
memory/3600-44-0x0000000000400000-0x0000000002B06000-memory.dmp
memory/3600-34-0x0000000000400000-0x0000000002B06000-memory.dmp
memory/3600-20-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/3600-208-0x0000000000400000-0x0000000002B06000-memory.dmp
memory/3600-276-0x0000000000400000-0x0000000002B06000-memory.dmp
memory/3600-17-0x0000000000400000-0x0000000002B06000-memory.dmp
memory/5036-287-0x0000000072CC0000-0x0000000073F14000-memory.dmp
memory/5036-292-0x0000000005780000-0x0000000005D24000-memory.dmp
memory/5036-293-0x0000000005560000-0x0000000005722000-memory.dmp
memory/5036-294-0x0000000005250000-0x00000000052C6000-memory.dmp
memory/5036-295-0x0000000005200000-0x0000000005250000-memory.dmp
memory/5036-296-0x00000000050F0000-0x00000000050FA000-memory.dmp
memory/5036-297-0x0000000006360000-0x000000000688C000-memory.dmp
memory/5036-298-0x0000000005E90000-0x0000000005EAE000-memory.dmp
memory/5036-299-0x0000000005F80000-0x0000000005FE6000-memory.dmp
memory/5036-291-0x0000000005130000-0x00000000051C2000-memory.dmp
memory/5036-290-0x0000000000A30000-0x0000000000AF6000-memory.dmp
memory/5036-318-0x0000000007860000-0x000000000786A000-memory.dmp