Analysis

  • max time kernel
    151s
  • max time network
    124s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    24-12-2021 15:37

General

  • Target

    92f4947a55cb2be277eaddbf19961d1d740ec923e3ad092c04022a509882c904.exe

  • Size

    292KB

  • MD5

    c510cd7a298c2a8b3776f6d4c6e9bfb4

  • SHA1

    90a41745ceb34199a6ef116c380ff1125930db28

  • SHA256

    92f4947a55cb2be277eaddbf19961d1d740ec923e3ad092c04022a509882c904

  • SHA512

    c60ebee8d575202a304ca07f86ec5c6ffe3d7222cac097f19708c0f1500caa7126245e0293a183f042f06e95f66dd52bec2116fee0a84100f4f6225d4a8c1fb5

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://rcacademy.at/upload/

http://e-lanpengeonline.com/upload/

http://vjcmvz.cn/upload/

http://galala.ru/upload/

http://witra.ru/upload/

rc4.i32
rc4.i32

Extracted

Family

amadey

Version

2.86

C2

2.56.56.210/notAnoob/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detect Neshta Payload ⋅ 16 IoCs
  • Modifies system executable filetype association ⋅ 2 TTPs 1 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Downloads MZ/PE file
  • Executes dropped EXE ⋅ 5 IoCs
  • Deletes itself ⋅ 1 IoCs
  • Reads user/profile data of web browsers ⋅ 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory ⋅ 64 IoCs
  • Drops file in Windows directory ⋅ 3 IoCs
  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) ⋅ 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class ⋅ 2 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam ⋅ 1 IoCs
  • Suspicious behavior: MapViewOfSection ⋅ 1 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 1 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\92f4947a55cb2be277eaddbf19961d1d740ec923e3ad092c04022a509882c904.exe
    "C:\Users\Admin\AppData\Local\Temp\92f4947a55cb2be277eaddbf19961d1d740ec923e3ad092c04022a509882c904.exe"
    Checks SCSI registry key(s)
    Suspicious behavior: EnumeratesProcesses
    Suspicious behavior: MapViewOfSection
    PID:912
  • C:\Users\Admin\AppData\Local\Temp\A688.exe
    C:\Users\Admin\AppData\Local\Temp\A688.exe
    Executes dropped EXE
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:3996
    • C:\ProgramData\5954_1640339821_5793.exe
      "C:\ProgramData\5954_1640339821_5793.exe"
      Modifies system executable filetype association
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2616
      • C:\Users\Admin\AppData\Local\Temp\3582-490\5954_1640339821_5793.exe
        "C:\Users\Admin\AppData\Local\Temp\3582-490\5954_1640339821_5793.exe"
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        PID:1016
        • C:\Windows\svchost.com
          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\A0383E~1\tkools.exe"
          Executes dropped EXE
          Drops file in Program Files directory
          Drops file in Windows directory
          Suspicious use of WriteProcessMemory
          PID:1388
          • C:\Users\Admin\AppData\Local\Temp\A0383E~1\tkools.exe
            C:\Users\Admin\AppData\Local\Temp\A0383E~1\tkools.exe
            Executes dropped EXE
            PID:496

Network

MITRE ATT&CK Matrix

Command and Control

    Credential Access

    Defense Evasion

    Execution

      Exfiltration

        Impact

          Initial Access

            Lateral Movement

              Privilege Escalation

                Replay Monitor

                00:00 00:00

                Downloads

                • C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE
                  MD5

                  3ad3461ef1d630f38ed3749838bbedc3

                  SHA1

                  8d85b0b392ae75c5d0b004ee9cf5a7b80b1b79e6

                  SHA256

                  32be2bca2b848da78c02140a288f1bb771cb66757f90d20126b1bcfd5bb40e62

                  SHA512

                  0e95e5181eab14d5820a3a4952018ac9b290fa3b17add8a5e13d893052f1d2a90a2323c62843f6a9e9af00f27e00108b60e0bce2f848e0a4d8ce0cce153db1ba

                • C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe
                  MD5

                  522c12509a9fde92565e673f2f47a0b9

                  SHA1

                  3cb06efb8b369eb72c55a83f2e89732a924a96f8

                  SHA256

                  5cbea72c5565c342e07edfc8902eeea7cfb450362f2ce0cb7b1b184dbf72ef64

                  SHA512

                  b112b9d568cf9c14cd289b1dc9dc173d800b0b70c63221cbcc326f6727d56027dcc7355599a0bc9a4c6d9abb39281456cc5a138f625147efef9819ebee9fea35

                • C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE
                  MD5

                  f1e707e6e6a6bd544e1f4c04dae68f0b

                  SHA1

                  7328d139b7378264796838c9b7ffedc233589cde

                  SHA256

                  98764ffe0366a01ae235033054556e52d6061633dfb6fba210940c89500809d2

                  SHA512

                  18a16bdb76f2749ed318873122b6e6374449d20cec4ae6a9fa1368a830a17064be266840dc89fe587ee0667b1d5b2942e32947a6e429109900816179ecdfe9cf

                • C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE
                  MD5

                  fafb18b930b2b05ac8c5ddb988e9062f

                  SHA1

                  825ea5069601fb875f8d050aa01300eac03d3826

                  SHA256

                  c17785fe7e6b5e08fe5a4ca3679fee85ba6f2e5efcce0fb9807727cf8aa25265

                  SHA512

                  be034e7377bd27092aad02e13a152fb80ff74c1ba2fb63ccb344cd55315d115ee47e46727cbe55ca808efafa58d7924e3eed965e9a2fd3b9ae2dff7834383e54

                • C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE
                  MD5

                  8e7b72380cc9ee9bf35c0de5fde4ab3a

                  SHA1

                  c19151c331ab274bbf5f6792ca707eb8a7017dba

                  SHA256

                  d82ca304cf64be3922b12111c962e09a6ddb2b8477e25b6c3f0400eddc38c80b

                  SHA512

                  acff1c08f9c8443d0b0589f5a7d7cab532462788406feba64825fdd2addf5b6cc8e773713e93c98991afbc7e364233fe7cf0659574cebe2200f8f7f818bfe927

                • C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE
                  MD5

                  fa982a173f9d3628c2b3ff62bd8a2f87

                  SHA1

                  2cfb18d542ae6b6cf5a1223f1a77defd9b91fa56

                  SHA256

                  bc5d80d05a1bd474cb5160782765bf973ba34ea25dedf7e96dfaf932b9935032

                  SHA512

                  95ca9066a2e5272494b8e234220b6028c14892679023ca70801475c38d341032363589375ec6ffc4cde3416dd88d0e3082d315f7beddccdf014122ddd0a90644

                • C:\ProgramData\5954_1640339821_5793.exe
                  MD5

                  05ac7818089aaed02ed5320d50f47132

                  SHA1

                  f9dfd169342637416bdc47d3d6ac6a31f062577f

                  SHA256

                  bd5a15ce7b5a16bde1c0a182285da7d47d64e2b1542d57947a139d5bd0a31e70

                  SHA512

                  1a32853839ca5b0cc1fbc45cbda944cc3681ff0c1e6bbe7e37cbeb60a2e7d400c214b85fd29c8fae72cd098e0bd312256a70d230e2404e2202b8d63c236fc53d

                • C:\ProgramData\5954_1640339821_5793.exe
                  MD5

                  05ac7818089aaed02ed5320d50f47132

                  SHA1

                  f9dfd169342637416bdc47d3d6ac6a31f062577f

                  SHA256

                  bd5a15ce7b5a16bde1c0a182285da7d47d64e2b1542d57947a139d5bd0a31e70

                  SHA512

                  1a32853839ca5b0cc1fbc45cbda944cc3681ff0c1e6bbe7e37cbeb60a2e7d400c214b85fd29c8fae72cd098e0bd312256a70d230e2404e2202b8d63c236fc53d

                • C:\Users\ALLUSE~1\Adobe\Setup\{AC76B~1\setup.exe
                  MD5

                  8a403bc371b84920c641afa3cf9fef2f

                  SHA1

                  d6c9d38f3e571b54132dd7ee31a169c683abfd63

                  SHA256

                  614a701b90739e7dbf66b14fbdb6854394290030cc87bbcb3f47e1c45d1f06c3

                  SHA512

                  b376ef1f49b793a8cd8b7af587f538cf87cb2fffa70fc144e1d1b7e2e8e365ba4ad0568321a0b1c04e69b4b8b694d77e812597a66be1c59eda626cbf132e2c72

                • C:\Users\ALLUSE~1\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE
                  MD5

                  63dc05e27a0b43bf25f151751b481b8c

                  SHA1

                  b20321483dac62bce0aa0cef1d193d247747e189

                  SHA256

                  7d607fb69c69a72a5bf4305599279f46318312ce1082b6a34ac9100b8c7762ce

                  SHA512

                  374d705704d456cc5f9f79b7f465f6ec7c775dc43001c840e9d6efbbdef20926ed1fa97f8a9b1e73161e17f72520b96c05fa58ac86b3945208b405f9166e7ba3

                • C:\Users\ALLUSE~1\PACKAG~1\{CA675~1\VCREDI~1.EXE
                  MD5

                  87f15006aea3b4433e226882a56f188d

                  SHA1

                  e3ad6beb8229af62b0824151dbf546c0506d4f65

                  SHA256

                  8d0045c74270281c705009d49441167c8a51ac70b720f84ff941b39fad220919

                  SHA512

                  b01a8af6dc836044d2adc6828654fa7a187c3f7ffe2a4db4c73021be6d121f9c1c47b1643513c3f25c0e1b5123b8ce2dc78b2ca8ce638a09c2171f158762c7c1

                • C:\Users\ALLUSE~1\PACKAG~1\{EF6B0~1\VCREDI~1.EXE
                  MD5

                  8e7b72380cc9ee9bf35c0de5fde4ab3a

                  SHA1

                  c19151c331ab274bbf5f6792ca707eb8a7017dba

                  SHA256

                  d82ca304cf64be3922b12111c962e09a6ddb2b8477e25b6c3f0400eddc38c80b

                  SHA512

                  acff1c08f9c8443d0b0589f5a7d7cab532462788406feba64825fdd2addf5b6cc8e773713e93c98991afbc7e364233fe7cf0659574cebe2200f8f7f818bfe927

                • C:\Users\ALLUSE~1\PACKAG~1\{F4220~1\VC_RED~1.EXE
                  MD5

                  fa982a173f9d3628c2b3ff62bd8a2f87

                  SHA1

                  2cfb18d542ae6b6cf5a1223f1a77defd9b91fa56

                  SHA256

                  bc5d80d05a1bd474cb5160782765bf973ba34ea25dedf7e96dfaf932b9935032

                  SHA512

                  95ca9066a2e5272494b8e234220b6028c14892679023ca70801475c38d341032363589375ec6ffc4cde3416dd88d0e3082d315f7beddccdf014122ddd0a90644

                • C:\Users\Admin\AppData\Local\Temp\3582-490\5954_1640339821_5793.exe
                  MD5

                  47d324d0398317af1f842dd2a271c3f0

                  SHA1

                  045937d0083abe615ce4780684f500dfde4c550b

                  SHA256

                  0247ed2604b2aea96511a96de88d6925040d26bc7239ab05968caf64210b1b50

                  SHA512

                  ecfffe8d7eab4e627adc71ddc13cc9aaaf814fb76f9eaf9cfc11f9ecb6c4d3a653a7be67b803f47859bb0f475cf5eced2e9491c660bed4cc7cf6c7210c210823

                • C:\Users\Admin\AppData\Local\Temp\3582-490\5954_1640339821_5793.exe
                  MD5

                  47d324d0398317af1f842dd2a271c3f0

                  SHA1

                  045937d0083abe615ce4780684f500dfde4c550b

                  SHA256

                  0247ed2604b2aea96511a96de88d6925040d26bc7239ab05968caf64210b1b50

                  SHA512

                  ecfffe8d7eab4e627adc71ddc13cc9aaaf814fb76f9eaf9cfc11f9ecb6c4d3a653a7be67b803f47859bb0f475cf5eced2e9491c660bed4cc7cf6c7210c210823

                • C:\Users\Admin\AppData\Local\Temp\A0383E~1\tkools.exe
                  MD5

                  47d324d0398317af1f842dd2a271c3f0

                  SHA1

                  045937d0083abe615ce4780684f500dfde4c550b

                  SHA256

                  0247ed2604b2aea96511a96de88d6925040d26bc7239ab05968caf64210b1b50

                  SHA512

                  ecfffe8d7eab4e627adc71ddc13cc9aaaf814fb76f9eaf9cfc11f9ecb6c4d3a653a7be67b803f47859bb0f475cf5eced2e9491c660bed4cc7cf6c7210c210823

                • C:\Users\Admin\AppData\Local\Temp\A0383E~1\tkools.exe
                  MD5

                  47d324d0398317af1f842dd2a271c3f0

                  SHA1

                  045937d0083abe615ce4780684f500dfde4c550b

                  SHA256

                  0247ed2604b2aea96511a96de88d6925040d26bc7239ab05968caf64210b1b50

                  SHA512

                  ecfffe8d7eab4e627adc71ddc13cc9aaaf814fb76f9eaf9cfc11f9ecb6c4d3a653a7be67b803f47859bb0f475cf5eced2e9491c660bed4cc7cf6c7210c210823

                • C:\Users\Admin\AppData\Local\Temp\A688.exe
                  MD5

                  ac696ff26dae3d008a7f1a8a33a6c067

                  SHA1

                  0e450582db291be053ac6a4ccf722dc4441b1f2e

                  SHA256

                  44e08debeddf1bf932fd76e0fd0088eb196c036c92d662601ac8b55fe10528b9

                  SHA512

                  1e049cc4cdd0e6dc4f38771f271a8021ad5c771024ed9cc3aea787d184a976f84778fc127ff2ab67cb79e0621ddc60b4b872393f4fabb0dfceb977409f66c0c6

                • C:\Users\Admin\AppData\Local\Temp\A688.exe
                  MD5

                  ac696ff26dae3d008a7f1a8a33a6c067

                  SHA1

                  0e450582db291be053ac6a4ccf722dc4441b1f2e

                  SHA256

                  44e08debeddf1bf932fd76e0fd0088eb196c036c92d662601ac8b55fe10528b9

                  SHA512

                  1e049cc4cdd0e6dc4f38771f271a8021ad5c771024ed9cc3aea787d184a976f84778fc127ff2ab67cb79e0621ddc60b4b872393f4fabb0dfceb977409f66c0c6

                • C:\Windows\svchost.com
                  MD5

                  36fd5e09c417c767a952b4609d73a54b

                  SHA1

                  299399c5a2403080a5bf67fb46faec210025b36d

                  SHA256

                  980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2

                  SHA512

                  1813a6a5b47a9b2cd3958cf4556714ae240f2aa19d0a241b596830f0f2b89a33ec864d00ce6a791d323a58dfbff42a0fded65eefbf980c92685e25c0ec415d92

                • C:\Windows\svchost.com
                  MD5

                  36fd5e09c417c767a952b4609d73a54b

                  SHA1

                  299399c5a2403080a5bf67fb46faec210025b36d

                  SHA256

                  980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2

                  SHA512

                  1813a6a5b47a9b2cd3958cf4556714ae240f2aa19d0a241b596830f0f2b89a33ec864d00ce6a791d323a58dfbff42a0fded65eefbf980c92685e25c0ec415d92

                • C:\odt\OFFICE~1.EXE
                  MD5

                  02c3d242fe142b0eabec69211b34bc55

                  SHA1

                  ea0a4a6d6078b362f7b3a4ad1505ce49957dc16e

                  SHA256

                  2a1ed24be7e3859b46ec3ebc316789ead5f12055853f86a9656e04b4bb771842

                  SHA512

                  0efb08492eaaa2e923beddc21566e98fbbef3a102f9415ff310ec616f5c84fd2ba3a7025b05e01c0bdf37e5e2f64dfd845f9254a376144cc7d827e7577dbb099

                • memory/496-136-0x0000000000000000-mapping.dmp
                • memory/912-116-0x0000000000630000-0x0000000000639000-memory.dmp
                • memory/912-117-0x0000000000400000-0x00000000004CA000-memory.dmp
                • memory/912-115-0x00000000007E6000-0x00000000007F7000-memory.dmp
                • memory/1016-129-0x0000000000000000-mapping.dmp
                • memory/1388-132-0x0000000000000000-mapping.dmp
                • memory/2616-126-0x0000000000000000-mapping.dmp
                • memory/3056-118-0x00000000005A0000-0x00000000005B6000-memory.dmp
                • memory/3996-122-0x0000020C44D60000-0x0000020C44E08000-memory.dmp
                • memory/3996-123-0x0000020C44D60000-0x0000020C44E08000-memory.dmp
                • memory/3996-119-0x0000000000000000-mapping.dmp
                • memory/3996-124-0x0000020C450F0000-0x0000020C45114000-memory.dmp
                • memory/3996-125-0x0000020C451E0000-0x0000020C451E2000-memory.dmp