Analysis
- max time kernel
150s - max time network
141s - platform
windows10_x64 - resource
win10v20210408 - submitted
17/07/2021, 18:02
General
- Target 1afd1322dc9b3c3c3a952da37cdfa645.exe
- Size 210KB
- Sample210717-13szf6mspn
- SHA256 884a1949638e54c76eb0ee548d3a23b4ecf29aba47408564d379fb2dc6cdef92
Malware Config
Extracted
-
smokeloader
-
2020
-
http://custom100.ru/
-
http://other191.com/
-
http://custom300.com/
-
http://600other.com/
Extracted
-
amadey
-
2.41
-
ama529.ru/gBcskbwWs/index.php
-
amaad100.com/gBcskbwWs/index.php
-
900ama.com/gBcskbwWs/index.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 5 IoCs
- Deletes itself 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 14 IoCs
- Suspicious use of AdjustPrivilegeToken 13 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 36 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1afd1322dc9b3c3c3a952da37cdfa645.exe"C:\Users\Admin\AppData\Local\Temp\1afd1322dc9b3c3c3a952da37cdfa645.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\E97B.exeC:\Users\Admin\AppData\Local\Temp\E97B.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\152c6d54a1\rgbux.exe"C:\Users\Admin\AppData\Local\Temp\152c6d54a1\rgbux.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\152c6d54a1\3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\152c6d54a1\4⤵
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rgbux.exe /TR "C:\Users\Admin\AppData\Local\Temp\152c6d54a1\rgbux.exe" /F3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1460 -s 6922⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\152c6d54a1\rgbux.exeC:\Users\Admin\AppData\Local\Temp\152c6d54a1\rgbux.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\152c6d54a1\rgbux.exeC:\Users\Admin\AppData\Local\Temp\152c6d54a1\rgbux.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\utjdhbsC:\Users\Admin\AppData\Roaming\utjdhbs1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/664-115-0x0000000000400000-0x0000000000994000-memory.dmp
memory/664-114-0x00000000009F0000-0x00000000009F9000-memory.dmp
memory/744-126-0x00000000008F0000-0x00000000008F7000-memory.dmp
memory/744-127-0x00000000008E0000-0x00000000008EC000-memory.dmp
memory/1180-138-0x0000000000400000-0x00000000009A7000-memory.dmp
memory/1460-139-0x0000000000DD0000-0x0000000000DD9000-memory.dmp
memory/1460-140-0x0000000000DC0000-0x0000000000DCF000-memory.dmp
memory/1680-155-0x00000000009B0000-0x0000000000AFA000-memory.dmp
memory/1680-156-0x0000000000400000-0x00000000009A7000-memory.dmp
memory/2084-132-0x0000000002A20000-0x0000000002A27000-memory.dmp
memory/2084-133-0x0000000002A10000-0x0000000002A1B000-memory.dmp
memory/2328-125-0x0000000000400000-0x00000000009A7000-memory.dmp
memory/2328-124-0x00000000025D0000-0x0000000002602000-memory.dmp
memory/3024-116-0x0000000000600000-0x0000000000615000-memory.dmp
memory/3024-158-0x0000000000760000-0x0000000000775000-memory.dmp
memory/3036-146-0x0000000000B70000-0x0000000000B77000-memory.dmp
memory/3036-147-0x0000000000B60000-0x0000000000B6D000-memory.dmp
memory/3268-150-0x0000000000400000-0x00000000009A7000-memory.dmp
memory/3544-123-0x0000000002B20000-0x0000000002B8B000-memory.dmp
memory/3544-122-0x0000000002E00000-0x0000000002E74000-memory.dmp
memory/3696-144-0x0000000002F60000-0x0000000002F6B000-memory.dmp
memory/3696-143-0x0000000002F70000-0x0000000002F76000-memory.dmp
memory/3844-157-0x0000000000400000-0x0000000000994000-memory.dmp