Analysis

  • max time kernel
    150s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    16-02-2024 00:53

General

  • Target

    75797f5c19efd1cbecae73491e2fb1f1026ce435a01f402d67124778110b239f.exe

  • Size

    240KB

  • MD5

    a05efaf63385624a9a6f4cb71e3034f2

  • SHA1

    00921d3aa2c3cb750b0b2799001eaee1023c6e97

  • SHA256

    75797f5c19efd1cbecae73491e2fb1f1026ce435a01f402d67124778110b239f

  • SHA512

    c181aedf600a55843aaaacbefc585b9f7b0bad26e87bdc7b00c63d1c908f7d5994f89ef116847a201ec91a89fe869523ac5bcbe331203ccf85923e9ff44281e5

  • SSDEEP

    3072:i0omm42dpvxmiFdS4wgtKO48l2Bq3PWdkkooNymbkgeJt3hxfdU5fl6Mud:FVmvvMiptwE3PWdkk1wg2tbfo

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

smokeloader

Version

2022

C2

http://sjyey.com/tmp/index.php

http://babonwo.ru/tmp/index.php

http://mth.com.ua/tmp/index.php

http://piratia.pw/tmp/index.php

http://go-piratia.ru/tmp/index.php

rc4.i32
rc4.i32

Extracted

Family

amadey

Version

4.14

C2

http://anfesq.com

http://cbinr.com

http://rimakc.ru

Attributes
  • install_dir

    68fd3d7ade

  • install_file

    Utsysc.exe

  • strings_key

    27ec7fd6f50f63b8af0c1d3deefcc8fe

  • url_paths

    /forum/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Downloads MZ/PE file
  • Deletes itself 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 44 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\75797f5c19efd1cbecae73491e2fb1f1026ce435a01f402d67124778110b239f.exe
    "C:\Users\Admin\AppData\Local\Temp\75797f5c19efd1cbecae73491e2fb1f1026ce435a01f402d67124778110b239f.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:2932
  • C:\Users\Admin\AppData\Local\Temp\B413.exe
    C:\Users\Admin\AppData\Local\Temp\B413.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2708
    • C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe
      "C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2432
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe" /F
        3⤵
        • Creates scheduled task(s)
        PID:2716
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1180
        • C:\Windows\system32\rundll32.exe
          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main
          4⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:568
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 568 -s 312
            5⤵
            • Loads dropped DLL
            PID:1324
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2452
        • C:\Windows\system32\rundll32.exe
          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main
          4⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2300
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 2300 -s 312
            5⤵
            • Loads dropped DLL
            PID:2996
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2412
        • C:\Windows\system32\rundll32.exe
          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main
          4⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1984
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 1984 -s 312
            5⤵
            • Loads dropped DLL
            PID:1144
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\clip64.dll, Main
        3⤵
        • Loads dropped DLL
        PID:1912
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\clip64.dll, Main
        3⤵
        • Loads dropped DLL
        PID:2296
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\clip64.dll, Main
        3⤵
        • Loads dropped DLL
        PID:2184
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {771EE358-D2D3-4BBD-8120-82D206D41C88} S-1-5-21-1603059206-2004189698-4139800220-1000:AILVMYUM\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1592
    • C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe
      C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe
      2⤵
      • Executes dropped EXE
      PID:2812
    • C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe
      C:\Users\Admin\AppData\Local\Temp\68fd3d7ade\Utsysc.exe
      2⤵
      • Executes dropped EXE
      PID:988

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\603059206200

    Filesize

    68KB

    MD5

    f51d96c6c0a3e6b986d671c03407cfd2

    SHA1

    e0b0c6779108c6e818264c8589af38bf96df99f2

    SHA256

    b4324e22222736f62dfe8b7e5ed1ccebbccfb8eb2c358309884600f0aeefe042

    SHA512

    2ae59232fabbdc2231fc479589bd5eb353aba3c8c856355fca939defb81cab86c78e1926896b1267dbd2310988ff47c30f4ac20af18841f6089ad05f00602b3c

  • C:\Users\Admin\AppData\Local\Temp\B413.exe

    Filesize

    388KB

    MD5

    4bb6852748ac936523f68322f1bae54a

    SHA1

    846ee2c620e655903aaa8e3f4ee0f9f27aec18f7

    SHA256

    f77d971f56a9101640c5fffc0121ba5f2f3c33e6f074e9d2b91c9af10da9c43d

    SHA512

    c13fe3c437d26caf9d4504f624d8e3ff7f5e370c476a047040d2f57a6e7905bbbd5c8023d304b2165fea2bb5ac24c5261c050a7dce39d4e79c8c2d360ddef74e

  • C:\Users\Admin\AppData\Roaming\2eed656dd58e95\clip64.dll

    Filesize

    102KB

    MD5

    4194e9b8b694b1e9b672c36f0d868e32

    SHA1

    252f27fe313c7bf8e9f36aef0c7b676383872efb

    SHA256

    97e342fb4dbfe474ab2674682a816931bb9f56814bf13b20ff11ac1939775125

    SHA512

    f956acdec4c0255030f784d27210d59e30c3377e0a5abec915818bde8545afc3ef04a06395a2bfa5946f86cdf1088c9089bfc5064d9fd71b8137eae14f64e5c7

  • C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll

    Filesize

    1.1MB

    MD5

    f01f5bc76b9596e0cfeab8a272cba3a5

    SHA1

    19cab1291e4e518ae636f2fb3d41567e4e6e4722

    SHA256

    83ef6d2414a5c0c9cb6cfe502cb40cdda5c425ee7408a4075e32891f4599d938

    SHA512

    ccfa16f0bbcdb909446fc4d47c1732e0b1baa759d78866fcce9ac7c5c12f1299e74df03b23881f3e37627b358bc6ddd2941c9110e030f6d68dd79f67c9e39f63

  • memory/988-133-0x0000000000230000-0x0000000000330000-memory.dmp

    Filesize

    1024KB

  • memory/988-132-0x0000000000400000-0x0000000000471000-memory.dmp

    Filesize

    452KB

  • memory/1244-4-0x0000000002960000-0x0000000002976000-memory.dmp

    Filesize

    88KB

  • memory/2432-92-0x0000000000400000-0x0000000000471000-memory.dmp

    Filesize

    452KB

  • memory/2432-70-0x0000000000400000-0x0000000000471000-memory.dmp

    Filesize

    452KB

  • memory/2432-128-0x0000000000400000-0x0000000000471000-memory.dmp

    Filesize

    452KB

  • memory/2432-123-0x0000000000400000-0x0000000000471000-memory.dmp

    Filesize

    452KB

  • memory/2432-118-0x0000000000400000-0x0000000000471000-memory.dmp

    Filesize

    452KB

  • memory/2432-38-0x0000000000400000-0x0000000000471000-memory.dmp

    Filesize

    452KB

  • memory/2432-37-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2432-103-0x0000000000400000-0x0000000000471000-memory.dmp

    Filesize

    452KB

  • memory/2432-48-0x0000000000400000-0x0000000000471000-memory.dmp

    Filesize

    452KB

  • memory/2432-69-0x0000000000530000-0x0000000000630000-memory.dmp

    Filesize

    1024KB

  • memory/2708-20-0x00000000002F0000-0x000000000035F000-memory.dmp

    Filesize

    444KB

  • memory/2708-19-0x0000000000540000-0x0000000000640000-memory.dmp

    Filesize

    1024KB

  • memory/2708-34-0x0000000000400000-0x0000000000471000-memory.dmp

    Filesize

    452KB

  • memory/2708-22-0x00000000007F0000-0x00000000007F1000-memory.dmp

    Filesize

    4KB

  • memory/2708-21-0x0000000000400000-0x0000000000471000-memory.dmp

    Filesize

    452KB

  • memory/2812-73-0x0000000000570000-0x0000000000670000-memory.dmp

    Filesize

    1024KB

  • memory/2812-74-0x0000000000400000-0x0000000000471000-memory.dmp

    Filesize

    452KB

  • memory/2932-7-0x00000000001C0000-0x00000000001CB000-memory.dmp

    Filesize

    44KB

  • memory/2932-1-0x0000000000290000-0x0000000000390000-memory.dmp

    Filesize

    1024KB

  • memory/2932-5-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2932-3-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2932-2-0x00000000001C0000-0x00000000001CB000-memory.dmp

    Filesize

    44KB