Analysis
- max time kernel
150s - max time network
146s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
- submitted
10/02/2024, 03:31
General
- Target 583f62a690bd63683e6cb37537087fe5.exe
- Size 232KB
- Sample240210-d2216aac64
- SHA256 9054b3a8ccbd32166bd31d65a1998b83a0d3c8f080ac70db2c50cfee3b9f4ae1
Malware Config
Extracted
-
smokeloader
-
pub1
Extracted
-
smokeloader
-
2022
-
http://trad-einmyus.com/index.php
-
http://tradein-myus.com/index.php
-
http://trade-inmyus.com/index.php
Extracted
-
djvu
-
http://habrafa.com/test1/get.php
-
extension
.ldhy
-
offline_id
pIGzEr0bxHiTz7xnvNidWeqzKkxMfVdHTyCkzwt1
-
payload_url
http://brusuax.com/dl/build2.exe
http://habrafa.com/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://we.tl/t-hPAqznkJKD Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0849ASdw
Extracted
-
vidar
-
7.7
-
655507914130aa0fe72362726c206a7c
-
https://t.me/newagev
-
https://steamcommunity.com/profiles/76561199631487327
-
profile_id_v2
655507914130aa0fe72362726c206a7c
Extracted
-
amadey
-
4.17
-
http://185.215.113.32
-
install_dir
00c07260dc
-
install_file
explorgu.exe
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Extracted
-
redline
-
EmpressLogs
-
91.92.244.55:13002
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Detect Vidar Stealer 6 IoCs
- Detect ZGRat V1 1 IoCs
- Detected Djvu ransomware 15 IoCs
- Djvu Ransomware
Ransomware which is a variant of the STOP family.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Vidar
Vidar is an infostealer based on Arkei stealer.
- ZGRat
ZGRat is remote access trojan written in C#.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Deletes itself 1 IoCs
- Executes dropped EXE 18 IoCs
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 26 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Uses the VBS compiler for execution 1 TTPs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 8 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 3 IoCs
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\583f62a690bd63683e6cb37537087fe5.exe"C:\Users\Admin\AppData\Local\Temp\583f62a690bd63683e6cb37537087fe5.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\B6A2.exeC:\Users\Admin\AppData\Local\Temp\B6A2.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\C64C.exeC:\Users\Admin\AppData\Local\Temp\C64C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\C64C.exeC:\Users\Admin\AppData\Local\Temp\C64C.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\a39b1b53-feea-4596-a0f5-df96b8466fb6" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
-
-
C:\Users\Admin\AppData\Local\Temp\C64C.exe"C:\Users\Admin\AppData\Local\Temp\C64C.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\C64C.exe"C:\Users\Admin\AppData\Local\Temp\C64C.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\1bcfd4f3-9013-4679-b8bd-14394b4f4d57\build2.exe"C:\Users\Admin\AppData\Local\1bcfd4f3-9013-4679-b8bd-14394b4f4d57\build2.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\1bcfd4f3-9013-4679-b8bd-14394b4f4d57\build2.exe"C:\Users\Admin\AppData\Local\1bcfd4f3-9013-4679-b8bd-14394b4f4d57\build2.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 14007⤵
- Loads dropped DLL
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\1bcfd4f3-9013-4679-b8bd-14394b4f4d57\build3.exe"C:\Users\Admin\AppData\Local\1bcfd4f3-9013-4679-b8bd-14394b4f4d57\build3.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\1bcfd4f3-9013-4679-b8bd-14394b4f4d57\build3.exe"C:\Users\Admin\AppData\Local\1bcfd4f3-9013-4679-b8bd-14394b4f4d57\build3.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"7⤵
- Creates scheduled task(s)
-
-
-
-
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {AB1D6A6D-7DBD-47F3-89C7-C5AA427004CC} S-1-5-21-1603059206-2004189698-4139800220-1000:AILVMYUM\Admin:Interactive:[1]1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"4⤵
- Creates scheduled task(s)
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\65C7.exeC:\Users\Admin\AppData\Local\Temp\65C7.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 962⤵
- Loads dropped DLL
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\6B92.exeC:\Users\Admin\AppData\Local\Temp\6B92.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\8604.exeC:\Users\Admin\AppData\Local\Temp\8604.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\8604.exeC:\Users\Admin\AppData\Local\Temp\8604.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 923⤵
- Loads dropped DLL
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\9300.exeC:\Users\Admin\AppData\Local\Temp\9300.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
File and Directory Permissions Modification
1Modify Registry
1Scripting
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
F0ACCF77CDCBFF39F6191887F6D2D357
24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
94308059B57B3142E455B38A6EB92015
94308059B57B3142E455B38A6EB92015
94308059B57B3142E455B38A6EB92015
CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
F0ACCF77CDCBFF39F6191887F6D2D357
build2.exe
build3.exe
65C7.exe
6B92.exe
8604.exe
9300.exe
B6A2.exe
C64C.exe
CabD578.tmp
TarE9D3.tmp
65C7.exe
65C7.exe
65C7.exe
65C7.exe
65C7.exe
memory/1204-4-0x00000000029A0000-0x00000000029B6000-memory.dmp
memory/1204-39-0x0000000002A50000-0x0000000002A66000-memory.dmp
memory/1336-177-0x00000000003B0000-0x00000000003B4000-memory.dmp
memory/1336-174-0x0000000000C30000-0x0000000000D30000-memory.dmp
memory/1608-1505-0x0000000072AB0000-0x000000007319E000-memory.dmp
memory/1608-670-0x00000000009B0000-0x0000000000A0E000-memory.dmp
memory/1608-692-0x0000000004A10000-0x0000000004A50000-memory.dmp
memory/1608-671-0x0000000072AB0000-0x000000007319E000-memory.dmp
memory/1680-1534-0x00000000008F0000-0x00000000009F0000-memory.dmp
memory/2056-1572-0x00000000000F0000-0x00000000000F1000-memory.dmp
memory/2056-1571-0x0000000000400000-0x0000000000497000-memory.dmp
memory/2116-193-0x0000000000940000-0x0000000000A40000-memory.dmp
memory/2260-179-0x0000000000400000-0x0000000000406000-memory.dmp
memory/2260-182-0x0000000000400000-0x0000000000406000-memory.dmp
memory/2260-185-0x0000000000400000-0x0000000000406000-memory.dmp
memory/2368-117-0x0000000000400000-0x0000000000644000-memory.dmp
memory/2368-111-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2368-187-0x0000000000400000-0x0000000000644000-memory.dmp
memory/2368-113-0x0000000000400000-0x0000000000644000-memory.dmp
memory/2368-116-0x0000000000400000-0x0000000000644000-memory.dmp
memory/2396-1518-0x0000000002240000-0x000000000228C000-memory.dmp
memory/2396-1530-0x00000000048C0000-0x0000000004900000-memory.dmp
memory/2396-368-0x00000000047D0000-0x00000000048C0000-memory.dmp
memory/2396-367-0x0000000072AB0000-0x000000007319E000-memory.dmp
memory/2396-366-0x00000000008F0000-0x00000000009E2000-memory.dmp
memory/2396-1526-0x0000000072AB0000-0x000000007319E000-memory.dmp
memory/2396-1495-0x00000000048C0000-0x0000000004900000-memory.dmp
memory/2396-1516-0x0000000002160000-0x00000000021DA000-memory.dmp
memory/2396-1569-0x0000000072AB0000-0x000000007319E000-memory.dmp
memory/2396-1496-0x00000000001C0000-0x00000000001C1000-memory.dmp
memory/2488-108-0x0000000000240000-0x0000000000340000-memory.dmp
memory/2488-109-0x00000000003C0000-0x00000000003F1000-memory.dmp
memory/2596-32-0x0000000001D60000-0x0000000001E7B000-memory.dmp
memory/2596-27-0x0000000000340000-0x00000000003D2000-memory.dmp
memory/2596-28-0x0000000000340000-0x00000000003D2000-memory.dmp
memory/2688-40-0x0000000000400000-0x000000000044A000-memory.dmp
memory/2688-19-0x0000000000610000-0x0000000000710000-memory.dmp
memory/2688-20-0x0000000000400000-0x000000000044A000-memory.dmp
memory/2700-31-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2700-63-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2700-38-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2700-37-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2700-34-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2708-1515-0x0000000072AB0000-0x000000007319E000-memory.dmp
memory/2708-1525-0x0000000072AB0000-0x000000007319E000-memory.dmp
memory/2708-1517-0x0000000005060000-0x00000000050A0000-memory.dmp
memory/2708-1514-0x0000000000100000-0x0000000000154000-memory.dmp
memory/2836-67-0x0000000000220000-0x00000000002B2000-memory.dmp
memory/2836-64-0x0000000000220000-0x00000000002B2000-memory.dmp
memory/2856-214-0x0000000000100000-0x0000000000101000-memory.dmp
memory/2856-208-0x00000000000F0000-0x00000000000F1000-memory.dmp
memory/2856-216-0x0000000000100000-0x0000000000101000-memory.dmp
memory/2856-210-0x00000000000F0000-0x00000000000F1000-memory.dmp
memory/2856-264-0x0000000000150000-0x0000000000151000-memory.dmp
memory/2856-218-0x0000000000100000-0x0000000000101000-memory.dmp
memory/2856-689-0x0000000000B50000-0x00000000016AB000-memory.dmp
memory/2856-211-0x0000000000B50000-0x00000000016AB000-memory.dmp
memory/2856-213-0x00000000000F0000-0x00000000000F1000-memory.dmp
memory/2904-87-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2904-118-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2904-154-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2904-106-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2904-96-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2904-107-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2904-88-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2904-74-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2904-73-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2908-275-0x0000000002850000-0x0000000002851000-memory.dmp
memory/2908-259-0x0000000000940000-0x0000000000941000-memory.dmp
memory/2908-250-0x00000000770C0000-0x00000000770C2000-memory.dmp
memory/2908-236-0x0000000000A60000-0x0000000000F0E000-memory.dmp
memory/2908-253-0x00000000023C0000-0x00000000023C1000-memory.dmp
memory/2908-254-0x0000000000A50000-0x0000000000A51000-memory.dmp
memory/2908-265-0x0000000000A60000-0x0000000000F0E000-memory.dmp
memory/2908-258-0x00000000008D0000-0x00000000008D1000-memory.dmp
memory/2908-255-0x0000000002480000-0x0000000002481000-memory.dmp
memory/2908-283-0x0000000000A60000-0x0000000000F0E000-memory.dmp
memory/2908-281-0x0000000002AE0000-0x0000000002AE1000-memory.dmp
memory/2908-276-0x0000000000700000-0x0000000000701000-memory.dmp
memory/2908-263-0x0000000000920000-0x0000000000921000-memory.dmp
memory/2908-252-0x00000000023A0000-0x00000000023A2000-memory.dmp
memory/2908-273-0x0000000002860000-0x0000000002861000-memory.dmp
memory/2908-271-0x0000000000930000-0x0000000000931000-memory.dmp
memory/2908-260-0x0000000002310000-0x0000000002311000-memory.dmp
memory/2908-261-0x0000000002470000-0x0000000002471000-memory.dmp
memory/2908-262-0x00000000008C0000-0x00000000008C1000-memory.dmp
memory/2908-266-0x00000000006B0000-0x00000000006B1000-memory.dmp
memory/3020-1-0x0000000000230000-0x0000000000330000-memory.dmp
memory/3020-5-0x0000000000400000-0x000000000044A000-memory.dmp
memory/3020-8-0x00000000003A0000-0x00000000003AB000-memory.dmp
memory/3020-3-0x0000000000400000-0x000000000044A000-memory.dmp
memory/3020-2-0x00000000003A0000-0x00000000003AB000-memory.dmp