Resubmissions
11/04/2024, 09:38
240411-ll3lragg451011/04/2024, 09:38
240411-ll3azsbh8z1011/04/2024, 09:38
240411-ll2pfsgg441011/04/2024, 09:38
240411-ll2dpabh8x1011/04/2024, 09:37
240411-llsrjsbh8v1009/04/2024, 03:24
240409-dx2vlage811009/04/2024, 03:23
240409-dxjn1sda441016/01/2024, 16:35
240116-t3vapsehak10Analysis
- max time kernel
88s - max time network
140s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
- submitted
16/01/2024, 16:35
General
- Target file.exe
- Size 234KB
- Sample240116-t3vapsehak
- SHA256 b4d9bc9471648ef8d072e524b4c6e3f5793e29b663bc85a9809912e7fad320c2
Malware Config
Extracted
-
smokeloader
-
2022
-
http://selebration17io.io/index.php
-
http://vacantion18ffeu.cc/index.php
-
http://valarioulinity1.net/index.php
-
http://buriatiarutuhuob.net/index.php
-
http://cassiosssionunu.me/index.php
-
http://sulugilioiu19.net/index.php
-
http://goodfooggooftool.net/index.php
Signatures
- Detect ZGRat V1 2 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- ZGRat
ZGRat is remote access trojan written in C#.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Downloads MZ/PE file
- Modifies Windows Firewall 1 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Deletes itself 1 IoCs
- Drops startup file 1 IoCs
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Themida packer 3 IoCs
Detects Themida, an advanced Windows software protection system.
- UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 31 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\DB13.exeC:\Users\Admin\AppData\Local\Temp\DB13.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops startup file
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\E9A5.exeC:\Users\Admin\AppData\Local\Temp\E9A5.exe1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\AppData\Local\Temp\2D0.exeC:\Users\Admin\AppData\Local\Temp\2D0.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\1D53.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\1D53.dll2⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\825D.exeC:\Users\Admin\AppData\Local\Temp\825D.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\B9C3.exeC:\Users\Admin\AppData\Local\Temp\B9C3.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\B9C3.exeC:\Users\Admin\AppData\Local\Temp\B9C3.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BF9D.exeC:\Users\Admin\AppData\Local\Temp\BF9D.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\289D.exeC:\Users\Admin\AppData\Local\Temp\289D.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\BroomSetup.exeC:\Users\Admin\AppData\Local\Temp\BroomSetup.exe3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\nsu33B0.tmpC:\Users\Admin\AppData\Local\Temp\nsu33B0.tmp3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"4⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes5⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe4⤵
-
C:\Windows\system32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f5⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F5⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll5⤵
-
-
-
-
-
C:\Windows\system32\makecab.exe"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240116163736.log C:\Windows\Logs\CBS\CbsPersist_20240116163736.cab1⤵
-
C:\Users\Admin\AppData\Local\Temp\4C06.exeC:\Users\Admin\AppData\Local\Temp\4C06.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\is-J3HJ4.tmp\is-G82E4.tmp"C:\Users\Admin\AppData\Local\Temp\is-J3HJ4.tmp\is-G82E4.tmp" /SL4 $C0126 "C:\Users\Admin\AppData\Local\Temp\4C06.exe" 9508382 522242⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Delete /F /TN "UCR1163"3⤵
-
-
C:\Users\Admin\AppData\Local\HramSoft\Ree Audio Converter\UdioConverterRipper.exe"C:\Users\Admin\AppData\Local\HramSoft\Ree Audio Converter\UdioConverterRipper.exe" -i3⤵
-
-
C:\Users\Admin\AppData\Local\HramSoft\Ree Audio Converter\UdioConverterRipper.exe"C:\Users\Admin\AppData\Local\HramSoft\Ree Audio Converter\UdioConverterRipper.exe" -s3⤵
-
-
-
C:\Windows\SysWOW64\chcp.comchcp 12511⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F1⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
UdioConverterRipper.exe
UdioConverterRipper.exe
is-VB33C.tmp
1D53.dll
288c47bbc1871b439df19ff4df68f076.exe
288c47bbc1871b439df19ff4df68f076.exe
288c47bbc1871b439df19ff4df68f076.exe
288c47bbc1871b439df19ff4df68f076.exe
289D.exe
289D.exe
2D0.exe
2D0.exe
4C06.exe
4C06.exe
cached-microdesc-consensus.tmp
825D.exe
825D.exe
B9C3.exe
B9C3.exe
B9C3.exe
B9C3.exe
BF9D.exe
BroomSetup.exe
Cab77B1.tmp
DB13.exe
E9A5.exe
E9A5.exe
InstallSetup9.exe
InstallSetup9.exe
Tar788F.tmp
injector.exe
patch.exe
is-G82E4.tmp
is-G82E4.tmp
nsu33B0.tmp
nsu33B0.tmp
INetC.dll
ntkrnlmp.exe
qemu-ga.exe
Task.bat
csrss.exe
csrss.exe
2d0.exe
UdioConverterRipper.exe
UdioConverterRipper.exe
UdioConverterRipper.exe
1D53.dll
1D53.dll
288c47bbc1871b439df19ff4df68f076.exe
288c47bbc1871b439df19ff4df68f076.exe
4C06.exe
4C06.exe
4C06.exe
B9C3.exe
BroomSetup.exe
InstallSetup9.exe
injector.exe
patch.exe
dbghelp.dll
is-G82E4.tmp
_iscrypt.dll
_shfoldr.dll
nsu33B0.tmp
nsu33B0.tmp
INetC.dll
ntkrnlmp.exe
ntkrnlmp.exe
ntkrnlmp.exe
symsrv.dll
csrss.exe
csrss.exe
memory/320-76-0x00000000022B0000-0x00000000023DD000-memory.dmp
memory/320-71-0x0000000010000000-0x0000000010236000-memory.dmp
memory/320-74-0x0000000000100000-0x0000000000106000-memory.dmp
memory/320-77-0x0000000000A10000-0x0000000000B20000-memory.dmp
memory/320-80-0x0000000000A10000-0x0000000000B20000-memory.dmp
memory/320-82-0x0000000000A10000-0x0000000000B20000-memory.dmp
memory/320-83-0x0000000000A10000-0x0000000000B20000-memory.dmp
memory/400-131-0x000007FEF5FE0000-0x000007FEF69CC000-memory.dmp
memory/400-124-0x0000000001000000-0x0000000001008000-memory.dmp
memory/400-164-0x000007FEF5FE0000-0x000007FEF69CC000-memory.dmp
memory/576-555-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/1052-60-0x00000000011F0000-0x0000000001706000-memory.dmp
memory/1052-79-0x00000000011F0000-0x0000000001706000-memory.dmp
memory/1052-65-0x0000000000170000-0x0000000000171000-memory.dmp
memory/1360-4-0x00000000025B0000-0x00000000025C6000-memory.dmp
memory/1444-85-0x00000000002D0000-0x00000000003D0000-memory.dmp
memory/1444-49-0x00000000002D0000-0x00000000003D0000-memory.dmp
memory/1444-51-0x0000000000400000-0x0000000000491000-memory.dmp
memory/1444-52-0x0000000000400000-0x0000000000491000-memory.dmp
memory/1444-50-0x0000000000510000-0x000000000057B000-memory.dmp
memory/1444-67-0x0000000000400000-0x0000000000491000-memory.dmp
memory/1824-139-0x0000000002240000-0x00000000023F8000-memory.dmp
memory/1824-153-0x0000000002400000-0x00000000025B7000-memory.dmp
memory/1824-151-0x0000000002240000-0x00000000023F8000-memory.dmp
memory/2000-167-0x0000000002B50000-0x0000000002C7D000-memory.dmp
memory/2000-239-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2000-160-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2000-152-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2000-159-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2000-158-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2000-157-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2000-156-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2000-149-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2000-168-0x0000000002C80000-0x0000000002D90000-memory.dmp
memory/2000-169-0x0000000002C80000-0x0000000002D90000-memory.dmp
memory/2000-171-0x0000000002C80000-0x0000000002D90000-memory.dmp
memory/2000-172-0x0000000002C80000-0x0000000002D90000-memory.dmp
memory/2000-178-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2052-262-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2052-97-0x0000000000090000-0x0000000000091000-memory.dmp
memory/2052-102-0x0000000000090000-0x0000000000091000-memory.dmp
memory/2052-106-0x0000000000E80000-0x0000000001734000-memory.dmp
memory/2052-99-0x0000000000E80000-0x0000000001734000-memory.dmp
memory/2052-103-0x0000000000E80000-0x0000000001734000-memory.dmp
memory/2052-104-0x0000000077E40000-0x0000000077E41000-memory.dmp
memory/2052-100-0x0000000000090000-0x0000000000091000-memory.dmp
memory/2320-219-0x0000000002640000-0x0000000002A38000-memory.dmp
memory/2320-244-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/2352-332-0x0000000002560000-0x0000000002958000-memory.dmp
memory/2380-245-0x0000000002810000-0x0000000002C08000-memory.dmp
memory/2380-280-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/2400-549-0x0000000000400000-0x00000000008E2000-memory.dmp
memory/2408-1-0x0000000000250000-0x0000000000350000-memory.dmp
memory/2408-5-0x0000000000400000-0x0000000000440000-memory.dmp
memory/2408-3-0x0000000000400000-0x0000000000440000-memory.dmp
memory/2408-2-0x00000000001B0000-0x00000000001BB000-memory.dmp
memory/2728-66-0x0000000077910000-0x0000000077A20000-memory.dmp
memory/2728-63-0x0000000075C50000-0x0000000075C97000-memory.dmp
memory/2728-64-0x0000000077910000-0x0000000077A20000-memory.dmp
memory/2728-73-0x0000000074D40000-0x000000007542E000-memory.dmp
memory/2728-75-0x0000000000E80000-0x0000000000EC0000-memory.dmp
memory/2728-62-0x00000000011C0000-0x00000000019DA000-memory.dmp
memory/2728-115-0x00000000011C0000-0x00000000019DA000-memory.dmp
memory/2728-114-0x0000000077910000-0x0000000077A20000-memory.dmp
memory/2728-117-0x0000000077910000-0x0000000077A20000-memory.dmp
memory/2728-118-0x0000000077910000-0x0000000077A20000-memory.dmp
memory/2728-116-0x0000000077910000-0x0000000077A20000-memory.dmp
memory/2728-120-0x0000000077910000-0x0000000077A20000-memory.dmp
memory/2728-41-0x0000000000E80000-0x0000000000EC0000-memory.dmp
memory/2728-39-0x00000000011C0000-0x00000000019DA000-memory.dmp
memory/2728-119-0x0000000075C50000-0x0000000075C97000-memory.dmp
memory/2728-40-0x0000000074D40000-0x000000007542E000-memory.dmp
memory/2728-36-0x0000000077910000-0x0000000077A20000-memory.dmp
memory/2728-121-0x0000000077910000-0x0000000077A20000-memory.dmp
memory/2728-37-0x0000000077910000-0x0000000077A20000-memory.dmp
memory/2728-38-0x0000000077E30000-0x0000000077E32000-memory.dmp
memory/2728-34-0x0000000077910000-0x0000000077A20000-memory.dmp
memory/2728-35-0x0000000077910000-0x0000000077A20000-memory.dmp
memory/2728-33-0x0000000077910000-0x0000000077A20000-memory.dmp
memory/2728-29-0x0000000077910000-0x0000000077A20000-memory.dmp
memory/2728-31-0x0000000075C50000-0x0000000075C97000-memory.dmp
memory/2728-32-0x0000000077910000-0x0000000077A20000-memory.dmp
memory/2728-30-0x0000000077910000-0x0000000077A20000-memory.dmp
memory/2728-123-0x0000000074D40000-0x000000007542E000-memory.dmp
memory/2728-122-0x0000000077910000-0x0000000077A20000-memory.dmp
memory/2728-28-0x0000000077910000-0x0000000077A20000-memory.dmp
memory/2728-27-0x0000000077910000-0x0000000077A20000-memory.dmp
memory/2728-24-0x0000000077910000-0x0000000077A20000-memory.dmp
memory/2728-23-0x0000000077910000-0x0000000077A20000-memory.dmp
memory/2728-21-0x0000000077910000-0x0000000077A20000-memory.dmp
memory/2728-20-0x0000000075C50000-0x0000000075C97000-memory.dmp
memory/2728-19-0x0000000077910000-0x0000000077A20000-memory.dmp
memory/2728-18-0x0000000077910000-0x0000000077A20000-memory.dmp
memory/2728-17-0x0000000077910000-0x0000000077A20000-memory.dmp
memory/2728-16-0x0000000077910000-0x0000000077A20000-memory.dmp
memory/2728-15-0x00000000011C0000-0x00000000019DA000-memory.dmp
memory/2728-130-0x0000000077910000-0x0000000077A20000-memory.dmp
memory/2728-129-0x0000000077910000-0x0000000077A20000-memory.dmp
memory/2728-128-0x0000000077910000-0x0000000077A20000-memory.dmp
memory/2728-127-0x0000000077910000-0x0000000077A20000-memory.dmp