Analysis
- max time kernel
131s - max time network
138s - platform
windows11-21h2_x64 - resource
win11-20240426-en - resource tags
- submitted
02/05/2024, 12:32
General
- Target b9d3be63963c5f10e21c35b01345f931f441e3e1d40680348c5c7e5ad45d1159.exe
- Size 417KB
- Sample240502-pqrxlaba73
- SHA256 b9d3be63963c5f10e21c35b01345f931f441e3e1d40680348c5c7e5ad45d1159
Malware Config
Extracted
-
stealc
-
http://185.172.128.150
-
url_path
/c698e1bc8a2f5e6d.php
Signatures
- Detect ZGRat V1 3 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Stealc
Stealc is an infostealer written in C++.
- ZGRat
ZGRat is remote access trojan written in C#.
- Downloads MZ/PE file
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 27 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 7 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9d3be63963c5f10e21c35b01345f931f441e3e1d40680348c5c7e5ad45d1159.exe"C:\Users\Admin\AppData\Local\Temp\b9d3be63963c5f10e21c35b01345f931f441e3e1d40680348c5c7e5ad45d1159.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\u28w.0.exe"C:\Users\Admin\AppData\Local\Temp\u28w.0.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 23923⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\u28w.2\run.exe"C:\Users\Admin\AppData\Local\Temp\u28w.2\run.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\u28w.3.exe"C:\Users\Admin\AppData\Local\Temp\u28w.3.exe"2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 11642⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2912 -ip 29121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1488 -ip 14881⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Are.docx
mozglue.dll
nss3.dll
9c3ff6ae
ioloDMLog.txt
ioloDMLog.txt
u28w.0.exe
u28w.1.zip
UIxMarketPlugin.dll
bunch.dat
relay.dll
run.exe
whale.dbf
u28w.3.exe
memory/1444-149-0x0000000072A20000-0x0000000072B9D000-memory.dmp
memory/1444-153-0x00007FFF51EA0000-0x00007FFF520A9000-memory.dmp
memory/1444-210-0x0000000072A20000-0x0000000072B9D000-memory.dmp
memory/1488-17-0x0000000000400000-0x0000000001A0F000-memory.dmp
memory/1488-235-0x0000000000400000-0x0000000001A0F000-memory.dmp
memory/1488-18-0x0000000000400000-0x0000000001A0F000-memory.dmp
memory/1488-16-0x0000000000400000-0x0000000001A0F000-memory.dmp
memory/1488-19-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/1488-209-0x0000000000400000-0x0000000001A0F000-memory.dmp
memory/2516-236-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/2516-248-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/2912-3-0x0000000000400000-0x0000000000470000-memory.dmp
memory/2912-1-0x0000000001CA0000-0x0000000001DA0000-memory.dmp
memory/2912-195-0x0000000000400000-0x0000000001A33000-memory.dmp
memory/2912-184-0x0000000000400000-0x0000000001A33000-memory.dmp
memory/2912-196-0x0000000000400000-0x0000000000470000-memory.dmp
memory/2912-2-0x0000000003780000-0x00000000037ED000-memory.dmp
memory/2972-282-0x00000000731B0000-0x00000000744C7000-memory.dmp
memory/2972-291-0x0000000005250000-0x000000000525A000-memory.dmp
memory/2972-290-0x00000000054E0000-0x0000000005530000-memory.dmp
memory/2972-289-0x0000000005450000-0x00000000054C6000-memory.dmp
memory/2972-288-0x00000000057D0000-0x0000000005992000-memory.dmp
memory/2972-287-0x0000000005A00000-0x0000000005FA6000-memory.dmp
memory/2972-286-0x00000000053B0000-0x0000000005442000-memory.dmp
memory/2972-285-0x0000000000B00000-0x0000000000BC6000-memory.dmp
memory/3008-249-0x0000026FE4530000-0x0000026FE7E28000-memory.dmp
memory/3008-255-0x0000026FEA360000-0x0000026FEA36A000-memory.dmp
memory/3008-258-0x0000026FEA930000-0x0000026FEA9AA000-memory.dmp
memory/3008-259-0x0000026FEA9B0000-0x0000026FEAA12000-memory.dmp
memory/3008-260-0x0000026FEAA90000-0x0000026FEAB06000-memory.dmp
memory/3008-261-0x0000026FEA5A0000-0x0000026FEA5AA000-memory.dmp
memory/3008-265-0x0000026FEAB10000-0x0000026FEAE10000-memory.dmp
memory/3008-267-0x0000026FEEEE0000-0x0000026FEEEE8000-memory.dmp
memory/3008-269-0x0000026FEEE30000-0x0000026FEEE3E000-memory.dmp
memory/3008-268-0x0000026FEEE60000-0x0000026FEEE98000-memory.dmp
memory/3008-271-0x0000026FEF7D0000-0x0000026FEF7F2000-memory.dmp
memory/3008-270-0x0000026FEF7C0000-0x0000026FEF7CA000-memory.dmp
memory/3008-273-0x0000026FEFD20000-0x0000026FF0248000-memory.dmp
memory/3008-250-0x0000026FEA5C0000-0x0000026FEA6D0000-memory.dmp
memory/3008-277-0x0000026FEF540000-0x0000026FEF54C000-memory.dmp
memory/3008-276-0x0000026FEF590000-0x0000026FEF5E0000-memory.dmp
memory/3008-278-0x0000026FEF5E0000-0x0000026FEF602000-memory.dmp
memory/3008-279-0x0000026FEF610000-0x0000026FEF62E000-memory.dmp
memory/3008-256-0x0000026FEA6E0000-0x0000026FEA70A000-memory.dmp
memory/3008-257-0x0000026FEA880000-0x0000026FEA932000-memory.dmp
memory/3008-254-0x0000026FEA330000-0x0000026FEA354000-memory.dmp
memory/3008-253-0x0000026FEA2C0000-0x0000026FEA2D4000-memory.dmp
memory/3008-251-0x0000026FEA2B0000-0x0000026FEA2C0000-memory.dmp
memory/3008-252-0x0000026FEA2D0000-0x0000026FEA2DC000-memory.dmp
memory/3588-272-0x0000000072A20000-0x0000000072B9D000-memory.dmp
memory/3588-228-0x00007FFF51EA0000-0x00007FFF520A9000-memory.dmp