Overview

overview

10

Static

static

3

3982986ebc...50.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e538a13d55d116777c2766732b2511c2.bin

  • Size

    1.4MB

  • Sample

    231105-dzpm2scc59

  • MD5

    3c1c732f15849354b6f85f2ff2391a20

  • SHA1

    6e02808096983a561b01891bfff515c460e67618

  • SHA256

    2929a545b949a6c9656a4031043fb4fd0ef9521e18a10ebb1164159961bef77b

  • SHA512

    32e0f9bcc5e7052773f7e5f0fb3d3b2d41882d02e968d03c864026e2f5bd083fab167388315b45c16d919ca97f019f12f76975801493fc90f5481021d15b41bd

  • SSDEEP

    24576:oiz0hABSAfv0PvBQLeXDe3MnaL2iQCJ3Fq0DXwob5T2FZsmALB6lcMoK+KVFa:POABSAkP2cn033Jo0Dgob5O0LBacN0m

Score
10/10
amadeyredlinesmokeloadergromebackdoorevasioninfostealerpersistencetrojan

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://77.91.68.29/fks/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

grome

C2

77.91.124.86:19084

Extracted

Family

amadey

Version

3.89

C2

http://77.91.124.1/theme/index.php

Attributes
  • install_dir

    fefffe8cea

  • install_file

    explothe.exe

  • strings_key

    36a96139c1118a354edf72b1080d4b2f

rc4.plain

Targets

    • Target

      3982986ebc039ab0e704c819d657c2d1014109b45aa86f058c81ff04771dcb50.exe

    • Size

      1.4MB

    • MD5

      e538a13d55d116777c2766732b2511c2

    • SHA1

      45feafdb23b355d9e1530b16e7c1bc819997ff3f

    • SHA256

      3982986ebc039ab0e704c819d657c2d1014109b45aa86f058c81ff04771dcb50

    • SHA512

      884b0669685dbc5584497f79bea4e7e620f67224292992908a589cc047b2c96858f48f9f5ce036336f49c59bb7bb156f2d9d6088bb0550a5e5168f5451fb3730

    • SSDEEP

      24576:wyO81yRBuAsoFsmFYkQkNexHOLIwsZ8IZssi2ZrjbDMLyCDPk:3WRBPxbFYqeRuIwsZjZDZr3IDD

    Score
    10/10
    amadeyredlinesmokeloadergromebackdoorevasioninfostealerpersistencetrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Defense Evasion

Modify Registry

2
T1112

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks