Overview
overview
10Static
static
1015becbaa36...1f.exe
windows7_x64
715becbaa36...1f.exe
windows10_x64
7Nuovo ordine .exe
windows7_x64
10Nuovo ordine .exe
windows10_x64
10189d5314ce...6e2b44
linux_amd64
189d5314ce...6e2b44
linux_mipsel
189d5314ce...6e2b44
linux_mips
18ccb7df2f...2a.exe
windows7_x64
1018ccb7df2f...2a.exe
windows10_x64
101b11ae98b8...4f.dll
windows7_x64
101b11ae98b8...4f.dll
windows10_x64
10204591aa6d...b8.exe
windows7_x64
10204591aa6d...b8.exe
windows10_x64
102c7540c6d0...ff.exe
windows7_x64
102c7540c6d0...ff.exe
windows10_x64
102cb4d62827...d9.dll
windows7_x64
102cb4d62827...d9.dll
windows10_x64
104fd784c26d...49.exe
windows7_x64
104fd784c26d...49.exe
windows10_x64
10553dc4c06c...5f.exe
windows7_x64
10553dc4c06c...5f.exe
windows10_x64
105afed1cccc...2d.dll
windows7_x64
105afed1cccc...2d.dll
windows10_x64
1062742e4698...10.exe
windows7_x64
1062742e4698...10.exe
windows10_x64
106707289e11...1b.exe
windows7_x64
106707289e11...1b.exe
windows10_x64
1069a43a40f0...e5.exe
windows7_x64
1069a43a40f0...e5.exe
windows10_x64
106ca42fe27f...b7.exe
windows7_x64
106ca42fe27f...b7.exe
windows10_x64
106db4bb653b...97.jar
windows7_x64
3Analysis
-
max time kernel
153s -
max time network
157s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
30-07-2021 15:25
Static task
static1
Behavioral task
behavioral1
Sample
15becbaa3657b788030771ccb6072e63f14728533aac9f1dcfe2cf89ebdac51f.exe
Resource
win7v20210410
windows7_x64
Behavioral task
behavioral2
Sample
15becbaa3657b788030771ccb6072e63f14728533aac9f1dcfe2cf89ebdac51f.exe
Resource
win10v20210410
windows10_x64
Behavioral task
behavioral3
Sample
Nuovo ordine .exe
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral4
Sample
Nuovo ordine .exe
Resource
win10v20210410
windows10_x64
Behavioral task
behavioral5
Sample
189d5314ce773d4497cd2c8aacc99f939bbc32c188d9db8a09e12005ae6e2b44
Resource
ubuntu-amd64
linux_amd64
Behavioral task
behavioral6
Sample
189d5314ce773d4497cd2c8aacc99f939bbc32c188d9db8a09e12005ae6e2b44
Resource
debian9-mipsel
linux_mipsel
Behavioral task
behavioral7
Sample
189d5314ce773d4497cd2c8aacc99f939bbc32c188d9db8a09e12005ae6e2b44
Resource
debian9-mipsbe
linux_mips
Behavioral task
behavioral8
Sample
18ccb7df2f91787a9392bf60d2f7019c86af65584c8a9c4846dee62e3240912a.exe
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral9
Sample
18ccb7df2f91787a9392bf60d2f7019c86af65584c8a9c4846dee62e3240912a.exe
Resource
win10v20210410
windows10_x64
Behavioral task
behavioral10
Sample
1b11ae98b85bb0645abe36adcd852e6e84b51c6b5c811729f3c19f14f32d4e4f.dll
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral11
Sample
1b11ae98b85bb0645abe36adcd852e6e84b51c6b5c811729f3c19f14f32d4e4f.dll
Resource
win10v20210410
windows10_x64
Behavioral task
behavioral12
Sample
204591aa6d44da7eef69d7ee3d32a9b4cb8e405a575fc3cbcf2d5e0217879cb8.exe
Resource
win7v20210410
windows7_x64
Behavioral task
behavioral13
Sample
204591aa6d44da7eef69d7ee3d32a9b4cb8e405a575fc3cbcf2d5e0217879cb8.exe
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral14
Sample
2c7540c6d066510b73a1a5c668dc74ec6d0d3f0716bb3adb6cd83afdd07f35ff.exe
Resource
win7v20210410
windows7_x64
Behavioral task
behavioral15
Sample
2c7540c6d066510b73a1a5c668dc74ec6d0d3f0716bb3adb6cd83afdd07f35ff.exe
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral16
Sample
2cb4d628278053eba42c82d58fb894c230451ffe70d519ff79c5f1cc76f32fd9.dll
Resource
win7v20210410
windows7_x64
Behavioral task
behavioral17
Sample
2cb4d628278053eba42c82d58fb894c230451ffe70d519ff79c5f1cc76f32fd9.dll
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral18
Sample
4fd784c26daf0b1877d7ffd53710b7312d89c8af0f3e640c1584d238e7e68949.exe
Resource
win7v20210410
windows7_x64
Behavioral task
behavioral19
Sample
4fd784c26daf0b1877d7ffd53710b7312d89c8af0f3e640c1584d238e7e68949.exe
Resource
win10v20210410
windows10_x64
Behavioral task
behavioral20
Sample
553dc4c06cd2a8a13eebb90e6c2a9e7fc09a81858d7233199f0f03d2051bfb5f.exe
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral21
Sample
553dc4c06cd2a8a13eebb90e6c2a9e7fc09a81858d7233199f0f03d2051bfb5f.exe
Resource
win10v20210410
windows10_x64
Behavioral task
behavioral22
Sample
5afed1ccccb12db0f6da9f25c43d10b4e63995881b65526004cd6f6a390c792d.dll
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral23
Sample
5afed1ccccb12db0f6da9f25c43d10b4e63995881b65526004cd6f6a390c792d.dll
Resource
win10v20210410
windows10_x64
Behavioral task
behavioral24
Sample
62742e4698b352658390b6b4f5088ddebb673503d5a4151f19c2face25932210.exe
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral25
Sample
62742e4698b352658390b6b4f5088ddebb673503d5a4151f19c2face25932210.exe
Resource
win10v20210410
windows10_x64
Behavioral task
behavioral26
Sample
6707289e11e16158e605882cdd2ce2fc9574428dd0114c6d6246146cb6ba7b1b.exe
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral27
Sample
6707289e11e16158e605882cdd2ce2fc9574428dd0114c6d6246146cb6ba7b1b.exe
Resource
win10v20210410
windows10_x64
Behavioral task
behavioral28
Sample
69a43a40f02660c2065fe3b76861dab28cc292301c180f1eafbf6c3f7b57afe5.exe
Resource
win7v20210410
windows7_x64
Behavioral task
behavioral29
Sample
69a43a40f02660c2065fe3b76861dab28cc292301c180f1eafbf6c3f7b57afe5.exe
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral30
Sample
6ca42fe27fbffcc87eb0995f36e945d8e62e0c06ea606be6a32382eb557970b7.exe
Resource
win7v20210410
windows7_x64
Behavioral task
behavioral31
Sample
6ca42fe27fbffcc87eb0995f36e945d8e62e0c06ea606be6a32382eb557970b7.exe
Resource
win10v20210410
windows10_x64
Behavioral task
behavioral32
Sample
6db4bb653b7dc11b7cda176c18697d9b2a758b2e1de9b83e3804dce2fbc8ba97.jar
Resource
win7v20210410
windows7_x64
General
-
Target
553dc4c06cd2a8a13eebb90e6c2a9e7fc09a81858d7233199f0f03d2051bfb5f.exe
-
Size
158KB
-
MD5
7456214bc55be7cc872f065ebe8af1b1
-
SHA1
94fcad942bc030f7c8e0f7665ab995a47db7a06c
-
SHA256
553dc4c06cd2a8a13eebb90e6c2a9e7fc09a81858d7233199f0f03d2051bfb5f
-
SHA512
5b0afcb86716c3e487a2351a118e0ef6f4944715a8e862054a30e588ed5029cd50a3b58c2c9331e72cf5ba47ca781fe87b26c3699958b283f1638e7b4cfa8128
Malware Config
Extracted
smokeloader
2020
http://custom100.ru/
http://other191.com/
http://custom300.com/
http://600other.com/
Extracted
amadey
2.41
ama529.ru/gBcskbwWs/index.php
amaad100.com/gBcskbwWs/index.php
900ama.com/gBcskbwWs/index.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 3900 created 1252 3900 WerFault.exe 83 -
suricata: ET MALWARE Amadey CnC Check-In
-
Downloads MZ/PE file
-
Executes dropped EXE 5 IoCs
pid Process 188 9475.exe 2720 rgbux.exe 500 jtccjti 2744 rgbux.exe 200 rgbux.exe -
Deletes itself 1 IoCs
pid Process 2756 Process not Found -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 3900 1252 WerFault.exe 83 -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jtccjti Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 553dc4c06cd2a8a13eebb90e6c2a9e7fc09a81858d7233199f0f03d2051bfb5f.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 553dc4c06cd2a8a13eebb90e6c2a9e7fc09a81858d7233199f0f03d2051bfb5f.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 553dc4c06cd2a8a13eebb90e6c2a9e7fc09a81858d7233199f0f03d2051bfb5f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jtccjti Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jtccjti -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3788 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3236 553dc4c06cd2a8a13eebb90e6c2a9e7fc09a81858d7233199f0f03d2051bfb5f.exe 3236 553dc4c06cd2a8a13eebb90e6c2a9e7fc09a81858d7233199f0f03d2051bfb5f.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2756 Process not Found -
Suspicious behavior: MapViewOfSection 14 IoCs
pid Process 3236 553dc4c06cd2a8a13eebb90e6c2a9e7fc09a81858d7233199f0f03d2051bfb5f.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 500 jtccjti -
Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeShutdownPrivilege 2756 Process not Found Token: SeCreatePagefilePrivilege 2756 Process not Found Token: SeShutdownPrivilege 2756 Process not Found Token: SeCreatePagefilePrivilege 2756 Process not Found Token: SeShutdownPrivilege 2756 Process not Found Token: SeCreatePagefilePrivilege 2756 Process not Found Token: SeShutdownPrivilege 2756 Process not Found Token: SeCreatePagefilePrivilege 2756 Process not Found Token: SeDebugPrivilege 3900 WerFault.exe Token: SeShutdownPrivilege 2756 Process not Found Token: SeCreatePagefilePrivilege 2756 Process not Found Token: SeShutdownPrivilege 2756 Process not Found Token: SeCreatePagefilePrivilege 2756 Process not Found Token: SeShutdownPrivilege 2756 Process not Found Token: SeCreatePagefilePrivilege 2756 Process not Found Token: SeShutdownPrivilege 2756 Process not Found Token: SeCreatePagefilePrivilege 2756 Process not Found -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2756 Process not Found -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 2756 wrote to memory of 188 2756 Process not Found 78 PID 2756 wrote to memory of 188 2756 Process not Found 78 PID 2756 wrote to memory of 188 2756 Process not Found 78 PID 2756 wrote to memory of 1112 2756 Process not Found 79 PID 2756 wrote to memory of 1112 2756 Process not Found 79 PID 2756 wrote to memory of 1112 2756 Process not Found 79 PID 2756 wrote to memory of 1112 2756 Process not Found 79 PID 2756 wrote to memory of 2284 2756 Process not Found 80 PID 2756 wrote to memory of 2284 2756 Process not Found 80 PID 2756 wrote to memory of 2284 2756 Process not Found 80 PID 188 wrote to memory of 2720 188 9475.exe 81 PID 188 wrote to memory of 2720 188 9475.exe 81 PID 188 wrote to memory of 2720 188 9475.exe 81 PID 2756 wrote to memory of 3768 2756 Process not Found 82 PID 2756 wrote to memory of 3768 2756 Process not Found 82 PID 2756 wrote to memory of 3768 2756 Process not Found 82 PID 2756 wrote to memory of 3768 2756 Process not Found 82 PID 2756 wrote to memory of 1252 2756 Process not Found 83 PID 2756 wrote to memory of 1252 2756 Process not Found 83 PID 2756 wrote to memory of 1252 2756 Process not Found 83 PID 2720 wrote to memory of 1648 2720 rgbux.exe 84 PID 2720 wrote to memory of 1648 2720 rgbux.exe 84 PID 2720 wrote to memory of 1648 2720 rgbux.exe 84 PID 2720 wrote to memory of 3788 2720 rgbux.exe 86 PID 2720 wrote to memory of 3788 2720 rgbux.exe 86 PID 2720 wrote to memory of 3788 2720 rgbux.exe 86 PID 1648 wrote to memory of 2316 1648 cmd.exe 88 PID 1648 wrote to memory of 2316 1648 cmd.exe 88 PID 1648 wrote to memory of 2316 1648 cmd.exe 88 PID 2756 wrote to memory of 3968 2756 Process not Found 89 PID 2756 wrote to memory of 3968 2756 Process not Found 89 PID 2756 wrote to memory of 3968 2756 Process not Found 89 PID 2756 wrote to memory of 3968 2756 Process not Found 89 PID 2756 wrote to memory of 3464 2756 Process not Found 92 PID 2756 wrote to memory of 3464 2756 Process not Found 92 PID 2756 wrote to memory of 3464 2756 Process not Found 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\553dc4c06cd2a8a13eebb90e6c2a9e7fc09a81858d7233199f0f03d2051bfb5f.exe"C:\Users\Admin\AppData\Local\Temp\553dc4c06cd2a8a13eebb90e6c2a9e7fc09a81858d7233199f0f03d2051bfb5f.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3236
-
C:\Users\Admin\AppData\Local\Temp\9475.exeC:\Users\Admin\AppData\Local\Temp\9475.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:188 -
C:\Users\Admin\AppData\Local\Temp\152c6d54a1\rgbux.exe"C:\Users\Admin\AppData\Local\Temp\152c6d54a1\rgbux.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\152c6d54a1\3⤵
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\152c6d54a1\4⤵PID:2316
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rgbux.exe /TR "C:\Users\Admin\AppData\Local\Temp\152c6d54a1\rgbux.exe" /F3⤵
- Creates scheduled task(s)
PID:3788
-
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1112
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2284
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3768
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1252
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1252 -s 6722⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3900
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3968
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3464
-
C:\Users\Admin\AppData\Roaming\jtccjtiC:\Users\Admin\AppData\Roaming\jtccjti1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:500
-
C:\Users\Admin\AppData\Local\Temp\152c6d54a1\rgbux.exeC:\Users\Admin\AppData\Local\Temp\152c6d54a1\rgbux.exe1⤵
- Executes dropped EXE
PID:2744
-
C:\Users\Admin\AppData\Local\Temp\152c6d54a1\rgbux.exeC:\Users\Admin\AppData\Local\Temp\152c6d54a1\rgbux.exe1⤵
- Executes dropped EXE
PID:200