Analysis
-
max time kernel
40s -
max time network
77s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
16-09-2023 11:39
General
-
Target
file.exe
-
Size
277KB
-
MD5
5bfa29282fabb73dff1e459775ca7c3e
-
SHA1
3435e68516c3445dd9fcc0e062177594b5bf8308
-
SHA256
7259a84f7267377ff79bf5454a63261e3968f585f32f1dc7efdcebe3485eba73
-
SHA512
91e284341006c13eace4b28d28404284c11fb317a73125a2fbe584f290e52592d2f2da8b182441a034a3a2b3bc314e5a0b219ef8131a83a128387a71577c0eea
-
SSDEEP
3072:u6g0kPlK76IgZFKxfx2nF2wkFyVTaohKvKt:1UPlKeHmcF2wkY9azK
Malware Config
Extracted
smokeloader
2022
http://potunulit.org/
http://hutnilior.net/
http://bulimu55t.net/
http://soryytlic4.net/
http://novanosa5org.org/
http://nuljjjnuli.org/
http://tolilolihul.net/
http://somatoka51hub.net/
http://hujukui3.net/
http://bukubuka1.net/
http://golilopaster.org/
http://newzelannd66.org/
http://otriluyttn.org/
Extracted
redline
lux3
176.123.9.142:14845
-
auth_value
e94dff9a76da90d6b000642c4a52574b
Extracted
amadey
3.87
http://79.137.192.18/9bDc8sQ/index.php
-
install_dir
577f58beff
-
install_file
yiueea.exe
-
strings_key
a5085075a537f09dec81cc154ec0af4d
Signatures
-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Detects LgoogLoader payload 1 IoCs
-
LgoogLoader
A downloader capable of dropping and executing other malware families.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\1008.exeC:\Users\Admin\AppData\Local\Temp\1008.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\127A.exeC:\Users\Admin\AppData\Local\Temp\127A.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\13D3.exeC:\Users\Admin\AppData\Local\Temp\13D3.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\23C2.exeC:\Users\Admin\AppData\Local\Temp\23C2.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\2625.exeC:\Users\Admin\AppData\Local\Temp\2625.exe1⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2981.exeC:\Users\Admin\AppData\Local\Temp\2981.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
785KB
MD5f92f2eec85513885dd5862254be5f494
SHA120da4d8089afec4873cedf763007a222df721572
SHA2566249c6dfd60d61b7e10ddbe52f4be48a8cd6c26da6cf71611ba7fc64617ac424
SHA5120ca3146843808daa5a7fb8f243c7540c4e4b5cdf5463f903bc6b531a2fbc8fb2734ef8b102015a89a99e94b8f4e5f144ce2f527e377c5bde31605117723e3bea
-
Filesize
785KB
MD5f92f2eec85513885dd5862254be5f494
SHA120da4d8089afec4873cedf763007a222df721572
SHA2566249c6dfd60d61b7e10ddbe52f4be48a8cd6c26da6cf71611ba7fc64617ac424
SHA5120ca3146843808daa5a7fb8f243c7540c4e4b5cdf5463f903bc6b531a2fbc8fb2734ef8b102015a89a99e94b8f4e5f144ce2f527e377c5bde31605117723e3bea
-
Filesize
261KB
MD5eda1b6f6e01f038267413b3ae9d3eb23
SHA16e71d68c3496b513ba4f1b924fd46ddfdfb2c305
SHA2567c34d3d22db889dfe3f1ab7e5810a04436330824da5a8fdecc03a987876d66da
SHA512420b4cda1ab0ce3293a4954283cb12c53882f50b5aa5f0921b1bd915257694508d79420cb680ba36ef88636bc479e98e054549ca67d17f0e63d8f38d384b0c30
-
Filesize
261KB
MD5eda1b6f6e01f038267413b3ae9d3eb23
SHA16e71d68c3496b513ba4f1b924fd46ddfdfb2c305
SHA2567c34d3d22db889dfe3f1ab7e5810a04436330824da5a8fdecc03a987876d66da
SHA512420b4cda1ab0ce3293a4954283cb12c53882f50b5aa5f0921b1bd915257694508d79420cb680ba36ef88636bc479e98e054549ca67d17f0e63d8f38d384b0c30
-
Filesize
806KB
MD5d27125ae65af3a6ce086eeae8fa41521
SHA170209d54e90908fc10f99af3cb38620bd744f93b
SHA2564745aee336bf0a92efae4475d6a541fbd9cc91b65532a26a1810b49ad5f8dbea
SHA51293f941a68d8eaea98d146520f786773e688bf5673ab37110efe065e05f9af6f81c43e050e90b20348b92888abc519e2094bcce37e22ab9a4a0e439c8dd88b68e
-
Filesize
806KB
MD5d27125ae65af3a6ce086eeae8fa41521
SHA170209d54e90908fc10f99af3cb38620bd744f93b
SHA2564745aee336bf0a92efae4475d6a541fbd9cc91b65532a26a1810b49ad5f8dbea
SHA51293f941a68d8eaea98d146520f786773e688bf5673ab37110efe065e05f9af6f81c43e050e90b20348b92888abc519e2094bcce37e22ab9a4a0e439c8dd88b68e
-
Filesize
785KB
MD5f92f2eec85513885dd5862254be5f494
SHA120da4d8089afec4873cedf763007a222df721572
SHA2566249c6dfd60d61b7e10ddbe52f4be48a8cd6c26da6cf71611ba7fc64617ac424
SHA5120ca3146843808daa5a7fb8f243c7540c4e4b5cdf5463f903bc6b531a2fbc8fb2734ef8b102015a89a99e94b8f4e5f144ce2f527e377c5bde31605117723e3bea
-
Filesize
785KB
MD5f92f2eec85513885dd5862254be5f494
SHA120da4d8089afec4873cedf763007a222df721572
SHA2566249c6dfd60d61b7e10ddbe52f4be48a8cd6c26da6cf71611ba7fc64617ac424
SHA5120ca3146843808daa5a7fb8f243c7540c4e4b5cdf5463f903bc6b531a2fbc8fb2734ef8b102015a89a99e94b8f4e5f144ce2f527e377c5bde31605117723e3bea
-
Filesize
2.0MB
MD5ff7712b5d2dcafd6b9c775eecc8266a1
SHA1a11c9bd80f1c80f057517fc555fcf9b53c327302
SHA25651d0be1366d229621051abb5df81316256c997c46265be8c9fb6b6b01fd1ccb1
SHA512a8dbf46d54d80dd206c61007c668bd93a00a4d8b35937cfdf1b723d69484bc6230763a0cd73b602e58392a0b6814c8143877b479709fd6ab03ea98eda61c0edf
-
Filesize
1.8MB
MD59898bd601cf56a383b830b392a36e379
SHA12359e1cbb3a40f9ab49ebd82d94ea787b7a8b0ab
SHA2563b277cf38d325665e5b9318e5a6d4a0a943d0cc89d43a5742e5c741a285b8961
SHA512b7ee2fa5e86842e34e19289588e7b5adc451b4aa5a7da77bad6090748429c21c74657fd0b3d23f94755732c4156bccac1156fbd1addc24971cdbc4a653eccf4a
-
Filesize
307KB
MD555f845c433e637594aaf872e41fda207
SHA11188348ca7e52f075e7d1d0031918c2cea93362e
SHA256f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39
SHA5125a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4
-
Filesize
307KB
MD555f845c433e637594aaf872e41fda207
SHA11188348ca7e52f075e7d1d0031918c2cea93362e
SHA256f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39
SHA5125a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4
-
Filesize
252KB
-
Filesize
52KB
-
Filesize
36KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
88KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
36KB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
1024KB
-
Filesize
36KB
-
Filesize
276KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
192KB
-
Filesize
7.7MB
-
Filesize
24KB
-
Filesize
7.7MB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
304KB
-
Filesize
240KB
-
Filesize
72KB