Analysis
- max time kernel
47s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
16/01/2024, 07:43
General
- Target 331bffe2f372fb71367f9cd6312ed2df.exe
- Size 229KB
- Sample240116-jj8zmsgfa8
- SHA256 aa339bd1440cf0f7a5faae531ab035233cf357baa7295af69239a9f2bb572996
Malware Config
Extracted
-
smokeloader
-
up3
Extracted
-
smokeloader
-
2022
-
http://trad-einmyus.com/index.php
-
http://tradein-myus.com/index.php
-
http://trade-inmyus.com/index.php
Signatures
- Detect ZGRat V1 30 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- ZGRat
ZGRat is remote access trojan written in C#.
- Downloads MZ/PE file
- Deletes itself 1 IoCs
- Executes dropped EXE 2 IoCs
- Program crash 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\331bffe2f372fb71367f9cd6312ed2df.exe"C:\Users\Admin\AppData\Local\Temp\331bffe2f372fb71367f9cd6312ed2df.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\EE86.exeC:\Users\Admin\AppData\Local\Temp\EE86.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 10642⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 10402⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\338.exeC:\Users\Admin\AppData\Local\Temp\338.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1436 -ip 14361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1436 -ip 14361⤵
-
C:\Users\Admin\AppData\Local\Temp\79F0.exeC:\Users\Admin\AppData\Local\Temp\79F0.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\79F0.exeC:\Users\Admin\AppData\Local\Temp\79F0.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\TypeId\Tags.exeC:\Users\Admin\AppData\Roaming\TypeId\Tags.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
79F0.exe.log
338.exe
338.exe
79F0.exe
79F0.exe
79F0.exe
EE86.exe
EE86.exe
Tags.exe
Tags.exe
Tags.exe
memory/1436-14-0x0000000000790000-0x0000000001207000-memory.dmp
memory/1436-18-0x0000000000790000-0x0000000001207000-memory.dmp
memory/1436-23-0x0000000000400000-0x000000000043E000-memory.dmp
memory/1436-20-0x0000000000400000-0x000000000043E000-memory.dmp
memory/1436-22-0x0000000000400000-0x000000000043E000-memory.dmp
memory/1436-35-0x0000000000400000-0x000000000043E000-memory.dmp
memory/1436-33-0x0000000000400000-0x000000000043E000-memory.dmp
memory/1436-34-0x0000000000400000-0x000000000043E000-memory.dmp
memory/1436-21-0x0000000000400000-0x000000000043E000-memory.dmp
memory/1436-36-0x0000000000400000-0x000000000043E000-memory.dmp
memory/1568-1-0x0000000000560000-0x0000000000660000-memory.dmp
memory/1568-3-0x0000000000400000-0x000000000043E000-memory.dmp
memory/1568-2-0x0000000002180000-0x000000000218B000-memory.dmp
memory/1568-5-0x0000000000400000-0x000000000043E000-memory.dmp
memory/2032-998-0x00007FFBE8BC0000-0x00007FFBE9681000-memory.dmp
memory/2032-994-0x000001C8D4A70000-0x000001C8D4AC6000-memory.dmp
memory/2032-991-0x000001C8EEB40000-0x000001C8EEC42000-memory.dmp
memory/2032-993-0x000001C8EEC40000-0x000001C8EEC50000-memory.dmp
memory/2032-992-0x00007FFBE8BC0000-0x00007FFBE9681000-memory.dmp
memory/2032-989-0x0000000140000000-0x00000001400A2000-memory.dmp
memory/2032-995-0x000001C8EECA0000-0x000001C8EECF4000-memory.dmp
memory/2584-82-0x0000025E6F680000-0x0000025E6F710000-memory.dmp
memory/2584-43-0x0000025E6F440000-0x0000025E6F4DC000-memory.dmp
memory/2584-94-0x0000025E6F680000-0x0000025E6F710000-memory.dmp
memory/2584-92-0x0000025E6F680000-0x0000025E6F710000-memory.dmp
memory/2584-90-0x0000025E6F680000-0x0000025E6F710000-memory.dmp
memory/2584-88-0x0000025E6F680000-0x0000025E6F710000-memory.dmp
memory/2584-86-0x0000025E6F680000-0x0000025E6F710000-memory.dmp
memory/2584-84-0x0000025E6F680000-0x0000025E6F710000-memory.dmp
memory/2584-100-0x0000025E6F680000-0x0000025E6F710000-memory.dmp
memory/2584-80-0x0000025E6F680000-0x0000025E6F710000-memory.dmp
memory/2584-76-0x0000025E6F680000-0x0000025E6F710000-memory.dmp
memory/2584-74-0x0000025E6F680000-0x0000025E6F710000-memory.dmp
memory/2584-72-0x0000025E6F680000-0x0000025E6F710000-memory.dmp
memory/2584-70-0x0000025E6F680000-0x0000025E6F710000-memory.dmp
memory/2584-68-0x0000025E6F680000-0x0000025E6F710000-memory.dmp
memory/2584-66-0x0000025E6F680000-0x0000025E6F710000-memory.dmp
memory/2584-64-0x0000025E6F680000-0x0000025E6F710000-memory.dmp
memory/2584-60-0x0000025E6F680000-0x0000025E6F710000-memory.dmp
memory/2584-58-0x0000025E6F680000-0x0000025E6F710000-memory.dmp
memory/2584-56-0x0000025E6F680000-0x0000025E6F710000-memory.dmp
memory/2584-52-0x0000025E6F680000-0x0000025E6F710000-memory.dmp
memory/2584-50-0x0000025E6F680000-0x0000025E6F710000-memory.dmp
memory/2584-48-0x0000025E6F680000-0x0000025E6F710000-memory.dmp
memory/2584-47-0x0000025E6F680000-0x0000025E6F710000-memory.dmp
memory/2584-44-0x0000025E6D3C0000-0x0000025E6D3D0000-memory.dmp
memory/2584-96-0x0000025E6F680000-0x0000025E6F710000-memory.dmp
memory/2584-42-0x00007FFBE8BC0000-0x00007FFBE9681000-memory.dmp
memory/2584-98-0x0000025E6F680000-0x0000025E6F710000-memory.dmp
memory/2584-979-0x0000025E6D420000-0x0000025E6D421000-memory.dmp
memory/2584-981-0x0000025E6F740000-0x0000025E6F78C000-memory.dmp
memory/2584-980-0x0000025E6F710000-0x0000025E6F73C000-memory.dmp
memory/2584-982-0x00007FFBE8BC0000-0x00007FFBE9681000-memory.dmp
memory/2584-983-0x0000025E6D3C0000-0x0000025E6D3D0000-memory.dmp
memory/2584-78-0x0000025E6F680000-0x0000025E6F710000-memory.dmp
memory/2584-62-0x0000025E6F680000-0x0000025E6F710000-memory.dmp
memory/2584-54-0x0000025E6F680000-0x0000025E6F710000-memory.dmp
memory/2584-46-0x0000025E6F680000-0x0000025E6F716000-memory.dmp
memory/2584-990-0x00007FFBE8BC0000-0x00007FFBE9681000-memory.dmp
memory/2584-45-0x0000025E6F5E0000-0x0000025E6F67C000-memory.dmp
memory/2584-41-0x0000025E6CE50000-0x0000025E6D010000-memory.dmp
memory/3492-4-0x0000000007D00000-0x0000000007D16000-memory.dmp
memory/4568-32-0x00007FFBE8BC0000-0x00007FFBE9681000-memory.dmp
memory/4568-31-0x000001C410770000-0x000001C410780000-memory.dmp
memory/4568-29-0x000001C4290A0000-0x000001C4291D2000-memory.dmp
memory/4568-30-0x00007FFBE8BC0000-0x00007FFBE9681000-memory.dmp
memory/4568-28-0x000001C40EA90000-0x000001C40EBBE000-memory.dmp
memory/4920-1002-0x0000023276780000-0x0000023276790000-memory.dmp
memory/4920-1001-0x00007FFBE8BC0000-0x00007FFBE9681000-memory.dmp
memory/4920-1935-0x00000232745F0000-0x00000232745F1000-memory.dmp
memory/4920-1936-0x00007FFBE8BC0000-0x00007FFBE9681000-memory.dmp