Analysis
- max time kernel
150s - max time network
135s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
- submitted
08/02/2024, 18:07
General
- Target 704cc92bd17776d68f70d51ed4e9caf7.exe
- Size 244KB
- Sample240208-wqa3eaaf22
- SHA256 d8a85eb69da59b65f537a2467f32089f08c527a73b2abf8dbc7d315f85a651e9
Malware Config
Extracted
-
smokeloader
-
pub3
Extracted
-
smokeloader
-
2022
-
http://sjyey.com/tmp/index.php
-
http://babonwo.ru/tmp/index.php
-
http://mth.com.ua/tmp/index.php
-
http://piratia.pw/tmp/index.php
-
http://go-piratia.ru/tmp/index.php
Extracted
-
amadey
-
4.14
-
http://anfesq.com
-
http://cbinr.com
-
http://rimakc.ru
-
install_dir
68fd3d7ade
-
install_file
Utsysc.exe
-
strings_key
27ec7fd6f50f63b8af0c1d3deefcc8fe
-
url_paths
/forum/index.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Deletes itself 1 IoCs
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 14 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 55 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\704cc92bd17776d68f70d51ed4e9caf7.exe"C:\Users\Admin\AppData\Local\Temp\704cc92bd17776d68f70d51ed4e9caf7.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\8A45.exeC:\Users\Admin\AppData\Local\Temp\8A45.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe"C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe" /F3⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main3⤵
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main3⤵
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\clip64.dll, Main3⤵
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\clip64.dll, Main3⤵
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\clip64.dll, Main3⤵
- Loads dropped DLL
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {3E3B9417-346A-48EE-B72B-C5CD0F896DC7} S-1-5-21-3470981204-343661084-3367201002-1000:GLTGRJAG\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exeC:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exeC:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
470981204343
8A45.exe
clip64.dll
cred64.dll
memory/1276-4-0x0000000002DA0000-0x0000000002DB6000-memory.dmp
memory/2488-73-0x0000000000400000-0x0000000002C04000-memory.dmp
memory/2488-54-0x0000000000400000-0x0000000002C04000-memory.dmp
memory/2488-103-0x0000000000400000-0x0000000002C04000-memory.dmp
memory/2488-93-0x0000000000400000-0x0000000002C04000-memory.dmp
memory/2488-88-0x0000000000400000-0x0000000002C04000-memory.dmp
memory/2488-71-0x0000000000400000-0x0000000002C04000-memory.dmp
memory/2488-36-0x0000000000400000-0x0000000002C04000-memory.dmp
memory/2488-37-0x00000000002B0000-0x00000000003B0000-memory.dmp
memory/2488-60-0x00000000002B0000-0x00000000003B0000-memory.dmp
memory/2724-1-0x00000000002B0000-0x00000000003B0000-memory.dmp
memory/2724-3-0x0000000000400000-0x0000000000449000-memory.dmp
memory/2724-2-0x00000000001B0000-0x00000000001BB000-memory.dmp
memory/2724-5-0x0000000000400000-0x0000000000449000-memory.dmp
memory/2740-18-0x0000000000250000-0x0000000000350000-memory.dmp
memory/2740-32-0x0000000000400000-0x0000000002C04000-memory.dmp
memory/2740-35-0x0000000000250000-0x0000000000350000-memory.dmp
memory/2740-33-0x0000000000400000-0x0000000002C04000-memory.dmp
memory/2740-19-0x0000000004390000-0x00000000043FF000-memory.dmp
memory/2796-72-0x0000000000400000-0x0000000002C04000-memory.dmp
memory/2796-58-0x0000000002CE0000-0x0000000002DE0000-memory.dmp
memory/2796-57-0x0000000000400000-0x0000000002C04000-memory.dmp
memory/3064-97-0x0000000002D30000-0x0000000002E30000-memory.dmp
memory/3064-96-0x0000000000400000-0x0000000002C04000-memory.dmp
memory/3064-105-0x0000000000400000-0x0000000002C04000-memory.dmp