Analysis
- max time kernel
36s - max time network
294s - platform
windows10-1703_x64 - resource
win10-20231220-en - resource tags
- submitted
22/01/2024, 04:47
General
- Target 176532323ed5e2b406422652af8360b621b93739016f06cb76aa7d9cc5965a3b.exe
- Size 216KB
- Sample240122-fe2szshba4
- SHA256 176532323ed5e2b406422652af8360b621b93739016f06cb76aa7d9cc5965a3b
Malware Config
Extracted
-
smokeloader
-
pub1
Extracted
-
smokeloader
-
2022
-
http://trad-einmyus.com/index.php
-
http://tradein-myus.com/index.php
-
http://trade-inmyus.com/index.php
Extracted
-
redline
-
LogsDiller Cloud (TG: @logsdillabot)
-
45.15.156.60:12050
Extracted
-
amadey
-
4.17
-
http://185.196.10.34
-
install_dir
eff1401c19
-
install_file
Dctooux.exe
-
strings_key
6e23b5eadc27bb0b2eaebdd4fed1beb2
-
url_paths
/b8sdjsdkS/index.php
Extracted
-
redline
-
ST12
-
185.172.128.33:38294
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Detect ZGRat V1 27 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 2 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- ZGRat
ZGRat is remote access trojan written in C#.
- Downloads MZ/PE file
- Deletes itself 1 IoCs
- Executes dropped EXE 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\176532323ed5e2b406422652af8360b621b93739016f06cb76aa7d9cc5965a3b.exe"C:\Users\Admin\AppData\Local\Temp\176532323ed5e2b406422652af8360b621b93739016f06cb76aa7d9cc5965a3b.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\D10B.exeC:\Users\Admin\AppData\Local\Temp\D10B.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\F389.exeC:\Users\Admin\AppData\Local\Temp\F389.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\6D3.exeC:\Users\Admin\AppData\Local\Temp\6D3.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\43F8.exeC:\Users\Admin\AppData\Local\Temp\43F8.exe1⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\4783.exeC:\Users\Admin\AppData\Local\Temp\4783.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\4783.exeC:\Users\Admin\AppData\Local\Temp\4783.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\wbrhadhC:\Users\Admin\AppData\Roaming\wbrhadh1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
C:\Users\Admin\AppData\Local\Temp\eff1401c19\Dctooux.exeC:\Users\Admin\AppData\Local\Temp\eff1401c19\Dctooux.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\eff1401c19\Dctooux.exeC:\Users\Admin\AppData\Local\Temp\eff1401c19\Dctooux.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\eff1401c19\Dctooux.exeC:\Users\Admin\AppData\Local\Temp\eff1401c19\Dctooux.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\eff1401c19\Dctooux.exeC:\Users\Admin\AppData\Local\Temp\eff1401c19\Dctooux.exe2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Dctooux.exe.log
43F8.exe
4783.exe
4783.exe
4783.exe
6D3.exe
6D3.exe
934047325409
D10B.exe
D10B.exe
F389.exe
F389.exe
Dctooux.exe
Dctooux.exe
Dctooux.exe
Dctooux.exe
Dctooux.exe
Dctooux.exe
wbrhadh
wbrhadh
wbrhadh
memory/368-3006-0x00000000012D0000-0x0000000001B84000-memory.dmp
memory/368-55-0x00000000012D0000-0x0000000001B84000-memory.dmp
memory/368-26-0x0000000000AF0000-0x0000000000AF1000-memory.dmp
memory/368-27-0x00000000012D0000-0x0000000001B84000-memory.dmp
memory/368-28-0x00000000012D0000-0x0000000001B84000-memory.dmp
memory/1160-93-0x00000000057B0000-0x0000000005873000-memory.dmp
memory/1160-105-0x00000000057B0000-0x0000000005873000-memory.dmp
memory/1160-1030-0x0000000073840000-0x0000000073F2E000-memory.dmp
memory/1160-1024-0x0000000005930000-0x0000000005990000-memory.dmp
memory/1160-1025-0x0000000005990000-0x00000000059DC000-memory.dmp
memory/1160-1023-0x00000000058A0000-0x00000000058A1000-memory.dmp
memory/1160-74-0x0000000073840000-0x0000000073F2E000-memory.dmp
memory/1160-75-0x0000000005660000-0x0000000005670000-memory.dmp
memory/1160-77-0x00000000057B0000-0x000000000587A000-memory.dmp
memory/1160-78-0x00000000057B0000-0x0000000005873000-memory.dmp
memory/1160-79-0x00000000057B0000-0x0000000005873000-memory.dmp
memory/1160-81-0x00000000057B0000-0x0000000005873000-memory.dmp
memory/1160-85-0x00000000057B0000-0x0000000005873000-memory.dmp
memory/1160-87-0x00000000057B0000-0x0000000005873000-memory.dmp
memory/1160-89-0x00000000057B0000-0x0000000005873000-memory.dmp
memory/1160-91-0x00000000057B0000-0x0000000005873000-memory.dmp
memory/1160-73-0x0000000000E30000-0x0000000000EF6000-memory.dmp
memory/1160-76-0x00000000056E0000-0x00000000057A8000-memory.dmp
memory/1160-83-0x00000000057B0000-0x0000000005873000-memory.dmp
memory/1160-97-0x00000000057B0000-0x0000000005873000-memory.dmp
memory/1160-109-0x00000000057B0000-0x0000000005873000-memory.dmp
memory/1160-117-0x00000000057B0000-0x0000000005873000-memory.dmp
memory/1160-127-0x00000000057B0000-0x0000000005873000-memory.dmp
memory/1160-125-0x00000000057B0000-0x0000000005873000-memory.dmp
memory/1160-123-0x00000000057B0000-0x0000000005873000-memory.dmp
memory/1160-121-0x00000000057B0000-0x0000000005873000-memory.dmp
memory/1160-119-0x00000000057B0000-0x0000000005873000-memory.dmp
memory/1160-115-0x00000000057B0000-0x0000000005873000-memory.dmp
memory/1160-113-0x00000000057B0000-0x0000000005873000-memory.dmp
memory/1160-111-0x00000000057B0000-0x0000000005873000-memory.dmp
memory/1160-107-0x00000000057B0000-0x0000000005873000-memory.dmp
memory/1160-95-0x00000000057B0000-0x0000000005873000-memory.dmp
memory/1160-103-0x00000000057B0000-0x0000000005873000-memory.dmp
memory/1160-101-0x00000000057B0000-0x0000000005873000-memory.dmp
memory/1160-99-0x00000000057B0000-0x0000000005873000-memory.dmp
memory/1836-3005-0x0000000000400000-0x000000000046D000-memory.dmp
memory/1836-3004-0x0000000000400000-0x000000000046D000-memory.dmp
memory/1868-2065-0x00000000050A0000-0x00000000050B0000-memory.dmp
memory/1868-2998-0x0000000004FF0000-0x0000000004FF1000-memory.dmp
memory/1868-2064-0x0000000072E70000-0x000000007355E000-memory.dmp
memory/1868-3002-0x0000000072E70000-0x000000007355E000-memory.dmp
memory/1884-2045-0x0000000073840000-0x0000000073F2E000-memory.dmp
memory/1884-1107-0x00000000055C0000-0x00000000055D0000-memory.dmp
memory/1884-1106-0x0000000073840000-0x0000000073F2E000-memory.dmp
memory/1884-2040-0x0000000005800000-0x0000000005801000-memory.dmp
memory/2332-1091-0x0000000001300000-0x0000000001354000-memory.dmp
memory/2332-1094-0x0000000005AC0000-0x0000000005B0B000-memory.dmp
memory/2332-1103-0x0000000073780000-0x0000000073E6E000-memory.dmp
memory/2332-1093-0x0000000005780000-0x0000000005790000-memory.dmp
memory/2332-1092-0x0000000073780000-0x0000000073E6E000-memory.dmp
memory/2868-19-0x0000000000400000-0x000000000043B000-memory.dmp
memory/2868-16-0x0000000000470000-0x0000000000570000-memory.dmp
memory/2868-17-0x0000000000400000-0x000000000043B000-memory.dmp
memory/2976-3-0x0000000000400000-0x000000000043B000-memory.dmp
memory/2976-1-0x0000000000440000-0x0000000000540000-memory.dmp
memory/2976-5-0x0000000000400000-0x000000000043B000-memory.dmp
memory/2976-2-0x0000000000880000-0x000000000088B000-memory.dmp
memory/3384-4-0x0000000000CD0000-0x0000000000CE6000-memory.dmp
memory/3384-18-0x0000000002AC0000-0x0000000002AD6000-memory.dmp
memory/4492-2047-0x0000000000400000-0x000000000046D000-memory.dmp
memory/4492-2061-0x0000000000400000-0x000000000046D000-memory.dmp
memory/4608-51-0x00000000052D0000-0x000000000530E000-memory.dmp
memory/4608-50-0x0000000005270000-0x0000000005282000-memory.dmp
memory/4608-39-0x0000000000400000-0x0000000000454000-memory.dmp
memory/4608-44-0x0000000005430000-0x000000000592E000-memory.dmp
memory/4608-46-0x0000000005010000-0x00000000050A2000-memory.dmp
memory/4608-45-0x0000000073850000-0x0000000073F3E000-memory.dmp
memory/4608-47-0x0000000005190000-0x000000000519A000-memory.dmp
memory/4608-62-0x0000000073850000-0x0000000073F3E000-memory.dmp
memory/4608-60-0x00000000072C0000-0x00000000077EC000-memory.dmp
memory/4608-59-0x0000000006BC0000-0x0000000006D82000-memory.dmp
memory/4608-57-0x00000000068A0000-0x00000000068F0000-memory.dmp
memory/4608-56-0x0000000005AD0000-0x0000000005B36000-memory.dmp
memory/4608-49-0x0000000005930000-0x0000000005A3A000-memory.dmp
memory/4608-48-0x0000000005F40000-0x0000000006546000-memory.dmp
memory/4608-52-0x0000000005310000-0x000000000535B000-memory.dmp
memory/4904-1035-0x0000000000680000-0x0000000000780000-memory.dmp
memory/4904-1101-0x0000000000400000-0x000000000043B000-memory.dmp
memory/4904-1034-0x0000000000400000-0x000000000043B000-memory.dmp
memory/5036-42-0x0000000003230000-0x0000000005230000-memory.dmp
memory/5036-63-0x0000000003230000-0x0000000005230000-memory.dmp
memory/5036-43-0x0000000073850000-0x0000000073F3E000-memory.dmp
memory/5036-37-0x00000000057E0000-0x00000000057F0000-memory.dmp
memory/5036-35-0x0000000073850000-0x0000000073F3E000-memory.dmp
memory/5036-34-0x0000000000F00000-0x0000000000F64000-memory.dmp
memory/5096-1081-0x0000000000400000-0x000000000046D000-memory.dmp
memory/5096-1032-0x0000000000400000-0x000000000046D000-memory.dmp