Overview
overview
10Static
static
1015becbaa36...1f.exe
windows7_x64
715becbaa36...1f.exe
windows10_x64
7Nuovo ordine .exe
windows7_x64
10Nuovo ordine .exe
windows10_x64
10189d5314ce...6e2b44
linux_amd64
189d5314ce...6e2b44
linux_mipsel
189d5314ce...6e2b44
linux_mips
18ccb7df2f...2a.exe
windows7_x64
1018ccb7df2f...2a.exe
windows10_x64
101b11ae98b8...4f.dll
windows7_x64
101b11ae98b8...4f.dll
windows10_x64
10204591aa6d...b8.exe
windows7_x64
10204591aa6d...b8.exe
windows10_x64
102c7540c6d0...ff.exe
windows7_x64
102c7540c6d0...ff.exe
windows10_x64
102cb4d62827...d9.dll
windows7_x64
102cb4d62827...d9.dll
windows10_x64
104fd784c26d...49.exe
windows7_x64
104fd784c26d...49.exe
windows10_x64
10553dc4c06c...5f.exe
windows7_x64
10553dc4c06c...5f.exe
windows10_x64
105afed1cccc...2d.dll
windows7_x64
105afed1cccc...2d.dll
windows10_x64
1062742e4698...10.exe
windows7_x64
1062742e4698...10.exe
windows10_x64
106707289e11...1b.exe
windows7_x64
106707289e11...1b.exe
windows10_x64
1069a43a40f0...e5.exe
windows7_x64
1069a43a40f0...e5.exe
windows10_x64
106ca42fe27f...b7.exe
windows7_x64
106ca42fe27f...b7.exe
windows10_x64
106db4bb653b...97.jar
windows7_x64
3Analysis
-
max time kernel
151s -
max time network
161s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
30-07-2021 15:25
Static task
static1
Behavioral task
behavioral1
Sample
15becbaa3657b788030771ccb6072e63f14728533aac9f1dcfe2cf89ebdac51f.exe
Resource
win7v20210410
windows7_x64
Behavioral task
behavioral2
Sample
15becbaa3657b788030771ccb6072e63f14728533aac9f1dcfe2cf89ebdac51f.exe
Resource
win10v20210410
windows10_x64
Behavioral task
behavioral3
Sample
Nuovo ordine .exe
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral4
Sample
Nuovo ordine .exe
Resource
win10v20210410
windows10_x64
Behavioral task
behavioral5
Sample
189d5314ce773d4497cd2c8aacc99f939bbc32c188d9db8a09e12005ae6e2b44
Resource
ubuntu-amd64
linux_amd64
Behavioral task
behavioral6
Sample
189d5314ce773d4497cd2c8aacc99f939bbc32c188d9db8a09e12005ae6e2b44
Resource
debian9-mipsel
linux_mipsel
Behavioral task
behavioral7
Sample
189d5314ce773d4497cd2c8aacc99f939bbc32c188d9db8a09e12005ae6e2b44
Resource
debian9-mipsbe
linux_mips
Behavioral task
behavioral8
Sample
18ccb7df2f91787a9392bf60d2f7019c86af65584c8a9c4846dee62e3240912a.exe
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral9
Sample
18ccb7df2f91787a9392bf60d2f7019c86af65584c8a9c4846dee62e3240912a.exe
Resource
win10v20210410
windows10_x64
Behavioral task
behavioral10
Sample
1b11ae98b85bb0645abe36adcd852e6e84b51c6b5c811729f3c19f14f32d4e4f.dll
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral11
Sample
1b11ae98b85bb0645abe36adcd852e6e84b51c6b5c811729f3c19f14f32d4e4f.dll
Resource
win10v20210410
windows10_x64
Behavioral task
behavioral12
Sample
204591aa6d44da7eef69d7ee3d32a9b4cb8e405a575fc3cbcf2d5e0217879cb8.exe
Resource
win7v20210410
windows7_x64
Behavioral task
behavioral13
Sample
204591aa6d44da7eef69d7ee3d32a9b4cb8e405a575fc3cbcf2d5e0217879cb8.exe
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral14
Sample
2c7540c6d066510b73a1a5c668dc74ec6d0d3f0716bb3adb6cd83afdd07f35ff.exe
Resource
win7v20210410
windows7_x64
Behavioral task
behavioral15
Sample
2c7540c6d066510b73a1a5c668dc74ec6d0d3f0716bb3adb6cd83afdd07f35ff.exe
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral16
Sample
2cb4d628278053eba42c82d58fb894c230451ffe70d519ff79c5f1cc76f32fd9.dll
Resource
win7v20210410
windows7_x64
Behavioral task
behavioral17
Sample
2cb4d628278053eba42c82d58fb894c230451ffe70d519ff79c5f1cc76f32fd9.dll
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral18
Sample
4fd784c26daf0b1877d7ffd53710b7312d89c8af0f3e640c1584d238e7e68949.exe
Resource
win7v20210410
windows7_x64
Behavioral task
behavioral19
Sample
4fd784c26daf0b1877d7ffd53710b7312d89c8af0f3e640c1584d238e7e68949.exe
Resource
win10v20210410
windows10_x64
Behavioral task
behavioral20
Sample
553dc4c06cd2a8a13eebb90e6c2a9e7fc09a81858d7233199f0f03d2051bfb5f.exe
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral21
Sample
553dc4c06cd2a8a13eebb90e6c2a9e7fc09a81858d7233199f0f03d2051bfb5f.exe
Resource
win10v20210410
windows10_x64
Behavioral task
behavioral22
Sample
5afed1ccccb12db0f6da9f25c43d10b4e63995881b65526004cd6f6a390c792d.dll
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral23
Sample
5afed1ccccb12db0f6da9f25c43d10b4e63995881b65526004cd6f6a390c792d.dll
Resource
win10v20210410
windows10_x64
Behavioral task
behavioral24
Sample
62742e4698b352658390b6b4f5088ddebb673503d5a4151f19c2face25932210.exe
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral25
Sample
62742e4698b352658390b6b4f5088ddebb673503d5a4151f19c2face25932210.exe
Resource
win10v20210410
windows10_x64
Behavioral task
behavioral26
Sample
6707289e11e16158e605882cdd2ce2fc9574428dd0114c6d6246146cb6ba7b1b.exe
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral27
Sample
6707289e11e16158e605882cdd2ce2fc9574428dd0114c6d6246146cb6ba7b1b.exe
Resource
win10v20210410
windows10_x64
Behavioral task
behavioral28
Sample
69a43a40f02660c2065fe3b76861dab28cc292301c180f1eafbf6c3f7b57afe5.exe
Resource
win7v20210410
windows7_x64
Behavioral task
behavioral29
Sample
69a43a40f02660c2065fe3b76861dab28cc292301c180f1eafbf6c3f7b57afe5.exe
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral30
Sample
6ca42fe27fbffcc87eb0995f36e945d8e62e0c06ea606be6a32382eb557970b7.exe
Resource
win7v20210410
windows7_x64
Behavioral task
behavioral31
Sample
6ca42fe27fbffcc87eb0995f36e945d8e62e0c06ea606be6a32382eb557970b7.exe
Resource
win10v20210410
windows10_x64
Behavioral task
behavioral32
Sample
6db4bb653b7dc11b7cda176c18697d9b2a758b2e1de9b83e3804dce2fbc8ba97.jar
Resource
win7v20210410
windows7_x64
General
-
Target
553dc4c06cd2a8a13eebb90e6c2a9e7fc09a81858d7233199f0f03d2051bfb5f.exe
-
Size
158KB
-
MD5
7456214bc55be7cc872f065ebe8af1b1
-
SHA1
94fcad942bc030f7c8e0f7665ab995a47db7a06c
-
SHA256
553dc4c06cd2a8a13eebb90e6c2a9e7fc09a81858d7233199f0f03d2051bfb5f
-
SHA512
5b0afcb86716c3e487a2351a118e0ef6f4944715a8e862054a30e588ed5029cd50a3b58c2c9331e72cf5ba47ca781fe87b26c3699958b283f1638e7b4cfa8128
Malware Config
Extracted
smokeloader
2020
http://custom100.ru/
http://other191.com/
http://custom300.com/
http://600other.com/
Extracted
amadey
2.41
ama529.ru/gBcskbwWs/index.php
amaad100.com/gBcskbwWs/index.php
900ama.com/gBcskbwWs/index.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
suricata: ET MALWARE Amadey CnC Check-In
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
pid Process 476 84AA.exe 1928 rgbux.exe -
Deletes itself 1 IoCs
pid Process 1272 Process not Found -
Loads dropped DLL 2 IoCs
pid Process 476 84AA.exe 476 84AA.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 553dc4c06cd2a8a13eebb90e6c2a9e7fc09a81858d7233199f0f03d2051bfb5f.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 553dc4c06cd2a8a13eebb90e6c2a9e7fc09a81858d7233199f0f03d2051bfb5f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 553dc4c06cd2a8a13eebb90e6c2a9e7fc09a81858d7233199f0f03d2051bfb5f.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1812 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1892 553dc4c06cd2a8a13eebb90e6c2a9e7fc09a81858d7233199f0f03d2051bfb5f.exe 1892 553dc4c06cd2a8a13eebb90e6c2a9e7fc09a81858d7233199f0f03d2051bfb5f.exe 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1272 Process not Found -
Suspicious behavior: MapViewOfSection 13 IoCs
pid Process 1892 553dc4c06cd2a8a13eebb90e6c2a9e7fc09a81858d7233199f0f03d2051bfb5f.exe 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 1272 wrote to memory of 476 1272 Process not Found 29 PID 1272 wrote to memory of 476 1272 Process not Found 29 PID 1272 wrote to memory of 476 1272 Process not Found 29 PID 1272 wrote to memory of 476 1272 Process not Found 29 PID 1272 wrote to memory of 684 1272 Process not Found 30 PID 1272 wrote to memory of 684 1272 Process not Found 30 PID 1272 wrote to memory of 684 1272 Process not Found 30 PID 1272 wrote to memory of 684 1272 Process not Found 30 PID 1272 wrote to memory of 684 1272 Process not Found 30 PID 1272 wrote to memory of 1484 1272 Process not Found 31 PID 1272 wrote to memory of 1484 1272 Process not Found 31 PID 1272 wrote to memory of 1484 1272 Process not Found 31 PID 1272 wrote to memory of 1484 1272 Process not Found 31 PID 476 wrote to memory of 1928 476 84AA.exe 32 PID 476 wrote to memory of 1928 476 84AA.exe 32 PID 476 wrote to memory of 1928 476 84AA.exe 32 PID 476 wrote to memory of 1928 476 84AA.exe 32 PID 1272 wrote to memory of 1120 1272 Process not Found 33 PID 1272 wrote to memory of 1120 1272 Process not Found 33 PID 1272 wrote to memory of 1120 1272 Process not Found 33 PID 1272 wrote to memory of 1120 1272 Process not Found 33 PID 1272 wrote to memory of 1120 1272 Process not Found 33 PID 1272 wrote to memory of 792 1272 Process not Found 34 PID 1272 wrote to memory of 792 1272 Process not Found 34 PID 1272 wrote to memory of 792 1272 Process not Found 34 PID 1272 wrote to memory of 792 1272 Process not Found 34 PID 1928 wrote to memory of 628 1928 rgbux.exe 35 PID 1928 wrote to memory of 628 1928 rgbux.exe 35 PID 1928 wrote to memory of 628 1928 rgbux.exe 35 PID 1928 wrote to memory of 628 1928 rgbux.exe 35 PID 1928 wrote to memory of 1812 1928 rgbux.exe 37 PID 1928 wrote to memory of 1812 1928 rgbux.exe 37 PID 1928 wrote to memory of 1812 1928 rgbux.exe 37 PID 1928 wrote to memory of 1812 1928 rgbux.exe 37 PID 628 wrote to memory of 1528 628 cmd.exe 39 PID 628 wrote to memory of 1528 628 cmd.exe 39 PID 628 wrote to memory of 1528 628 cmd.exe 39 PID 628 wrote to memory of 1528 628 cmd.exe 39 PID 1272 wrote to memory of 1112 1272 Process not Found 41 PID 1272 wrote to memory of 1112 1272 Process not Found 41 PID 1272 wrote to memory of 1112 1272 Process not Found 41 PID 1272 wrote to memory of 1112 1272 Process not Found 41 PID 1272 wrote to memory of 1112 1272 Process not Found 41 PID 1272 wrote to memory of 2044 1272 Process not Found 42 PID 1272 wrote to memory of 2044 1272 Process not Found 42 PID 1272 wrote to memory of 2044 1272 Process not Found 42 PID 1272 wrote to memory of 2044 1272 Process not Found 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\553dc4c06cd2a8a13eebb90e6c2a9e7fc09a81858d7233199f0f03d2051bfb5f.exe"C:\Users\Admin\AppData\Local\Temp\553dc4c06cd2a8a13eebb90e6c2a9e7fc09a81858d7233199f0f03d2051bfb5f.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1892
-
C:\Users\Admin\AppData\Local\Temp\84AA.exeC:\Users\Admin\AppData\Local\Temp\84AA.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:476 -
C:\Users\Admin\AppData\Local\Temp\152c6d54a1\rgbux.exe"C:\Users\Admin\AppData\Local\Temp\152c6d54a1\rgbux.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\152c6d54a1\3⤵
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\152c6d54a1\4⤵PID:1528
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rgbux.exe /TR "C:\Users\Admin\AppData\Local\Temp\152c6d54a1\rgbux.exe" /F3⤵
- Creates scheduled task(s)
PID:1812
-
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:684
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1484
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1120
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:792
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1112
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2044