Analysis
- max time kernel
68s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
02/03/2024, 17:33
General
- Target 7826a4e8cd6e6f117eef43d8c28c5376.exe
- Size 241KB
- Sample240302-v4x9esfe3v
- SHA256 f7b3ea13abebeb99ddfd4319457ff2d8a8473b8a46963de047cce295abadd2eb
Malware Config
Extracted
-
smokeloader
-
2022
-
http://selebration17io.io/index.php
-
http://vacantion18ffeu.cc/index.php
-
http://valarioulinity1.net/index.php
-
http://buriatiarutuhuob.net/index.php
-
http://cassiosssionunu.me/index.php
-
http://sulugilioiu19.net/index.php
-
http://goodfooggooftool.net/index.php
-
http://kamsmad.com/tmp/index.php
-
http://souzhensil.ru/tmp/index.php
-
http://teplokub.com.ua/tmp/index.php
Extracted
-
amadey
-
4.17
-
http://185.215.113.32
-
install_dir
00c07260dc
-
install_file
explorgu.exe
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Extracted
-
risepro
-
193.233.132.62
Extracted
-
amadey
-
4.17
-
http://185.215.113.32
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Extracted
-
redline
-
LiveTraffic
-
20.218.68.91:7690
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Deletes itself 1 IoCs
- Executes dropped EXE 13 IoCs
- Identifies Wine through registry keys 2 TTPs 5 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 4 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\7826a4e8cd6e6f117eef43d8c28c5376.exe"C:\Users\Admin\AppData\Local\Temp\7826a4e8cd6e6f117eef43d8c28c5376.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\A8B3.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\A8B3.dll2⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\B15F.exeC:\Users\Admin\AppData\Local\Temp\B15F.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\B15F.exeC:\Users\Admin\AppData\Local\Temp\B15F.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\B79A.exeC:\Users\Admin\AppData\Local\Temp\B79A.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\BC4E.exeC:\Users\Admin\AppData\Local\Temp\BC4E.exe1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\AppData\Local\Temp\DC1C.exeC:\Users\Admin\AppData\Local\Temp\DC1C.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe"C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000805001\legun.exe"C:\Users\Admin\AppData\Local\Temp\1000805001\legun.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\AppData\Local\Temp\1000807001\osminog.exe"C:\Users\Admin\AppData\Local\Temp\1000807001\osminog.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh wlan show profiles5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\660967641992_Desktop.zip' -CompressionLevel Optimal5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000810001\goldprime123.exe"C:\Users\Admin\AppData\Local\Temp\1000810001\goldprime123.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000811001\lumma28282828.exe"C:\Users\Admin\AppData\Local\Temp\1000811001\lumma28282828.exe"3⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1000812001\juditttt.exe"C:\Users\Admin\AppData\Local\Temp\1000812001\juditttt.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\onefile_2248_133538744895667288\stub.exe"C:\Users\Admin\AppData\Local\Temp\1000812001\juditttt.exe"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "gdb --version"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000814001\daisy123.exe"C:\Users\Admin\AppData\Local\Temp\1000814001\daisy123.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1000815001\jokerpos.exe"C:\Users\Admin\AppData\Local\Temp\1000815001\jokerpos.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exeC:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\32B8.exeC:\Users\Admin\AppData\Local\Temp\32B8.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\5593.exeC:\Users\Admin\AppData\Local\Temp\5593.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup_four.exe"C:\Users\Admin\AppData\Local\Temp\InstallSetup_four.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\u3ow.0.exe"C:\Users\Admin\AppData\Local\Temp\u3ow.0.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\u3ow.1.exe"C:\Users\Admin\AppData\Local\Temp\u3ow.1.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "4⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12515⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F5⤵
- Creates scheduled task(s)
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 16843⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\5B70.exeC:\Users\Admin\AppData\Local\Temp\5B70.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\is-4NG8I.tmp\5B70.tmp"C:\Users\Admin\AppData\Local\Temp\is-4NG8I.tmp\5B70.tmp" /SL5="$A016E,2460127,56832,C:\Users\Admin\AppData\Local\Temp\5B70.exe"2⤵
-
C:\Users\Admin\AppData\Local\SMTP Proxy\smtpproxy32.exe"C:\Users\Admin\AppData\Local\SMTP Proxy\smtpproxy32.exe" -i3⤵
-
-
C:\Users\Admin\AppData\Local\SMTP Proxy\smtpproxy32.exe"C:\Users\Admin\AppData\Local\SMTP Proxy\smtpproxy32.exe" -s3⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4784 -ip 47841⤵
-
C:\Users\Admin\AppData\Local\Temp\C43D.exeC:\Users\Admin\AppData\Local\Temp\C43D.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
MailboxNotifier_65.exe
mozglue.dll
smtpproxy32.exe
smtpproxy32.exe
smtpproxy32.exe
explorgu.exe
legun.exe
legun.exe
osminog.exe
goldprime123.exe
lumma28282828.exe
juditttt.exe
juditttt.exe
daisy123.exe
jokerpos.exe
288c47bbc1871b439df19ff4df68f076.exe
288c47bbc1871b439df19ff4df68f076.exe
288c47bbc1871b439df19ff4df68f076.exe
32B8.exe
5593.exe
5593.exe
5B70.exe
5B70.exe
A8B3.dll
B15F.exe
B15F.exe
B79A.exe
BC4E.exe
DC1C.exe
DC1C.exe
InstallSetup_four.exe
_bz2.pyd
libffi-7.dll
__PSScriptPolicyTest_gy1obqzh.mkv.ps1
5B70.tmp
_iscrypt.dll
_isdecmp.dll
_ctypes.pyd
python310.dll
python310.dll
stub.exe
stub.exe
vcruntime140.dll
u3ow.0.exe
u3ow.1.exe
u3ow.1.exe
u3ow.1.exe
clip64.dll
cred64.dll
cred64.dll
cred64.dll
Task.bat
explorgu.job
memory/640-106-0x0000000002E80000-0x0000000002F99000-memory.dmp
memory/640-62-0x0000000000400000-0x0000000000848000-memory.dmp
memory/640-65-0x00000000009B0000-0x00000000009B6000-memory.dmp
memory/640-61-0x0000000000400000-0x0000000000848000-memory.dmp
memory/640-50-0x0000000000400000-0x0000000000848000-memory.dmp
memory/640-56-0x0000000000400000-0x0000000000848000-memory.dmp
memory/640-95-0x0000000002D40000-0x0000000002E77000-memory.dmp
memory/640-54-0x0000000000400000-0x0000000000848000-memory.dmp
memory/640-100-0x0000000002E80000-0x0000000002F99000-memory.dmp
memory/640-55-0x0000000000400000-0x0000000000848000-memory.dmp
memory/684-343-0x0000000000400000-0x0000000000447000-memory.dmp
memory/684-324-0x0000000000400000-0x0000000000447000-memory.dmp
memory/1576-148-0x0000000000610000-0x0000000000BBF000-memory.dmp
memory/1576-152-0x00000000053B0000-0x00000000053B1000-memory.dmp
memory/1576-149-0x0000000005370000-0x0000000005371000-memory.dmp
memory/1576-150-0x0000000005340000-0x0000000005341000-memory.dmp
memory/1576-154-0x0000000005320000-0x0000000005321000-memory.dmp
memory/1576-151-0x0000000005330000-0x0000000005331000-memory.dmp
memory/1576-153-0x0000000000610000-0x0000000000BBF000-memory.dmp
memory/1576-200-0x0000000000610000-0x0000000000BBF000-memory.dmp
memory/1576-380-0x0000000000610000-0x0000000000BBF000-memory.dmp
memory/1576-156-0x00000000053D0000-0x00000000053D1000-memory.dmp
memory/1576-155-0x0000000005380000-0x0000000005381000-memory.dmp
memory/1752-79-0x0000000000400000-0x0000000001A77000-memory.dmp
memory/1752-41-0x00000000036A0000-0x000000000370B000-memory.dmp
memory/1752-40-0x0000000001B30000-0x0000000001C30000-memory.dmp
memory/1752-78-0x00000000036A0000-0x000000000370B000-memory.dmp
memory/1752-43-0x0000000000400000-0x0000000001A77000-memory.dmp
memory/1752-86-0x0000000001B30000-0x0000000001C30000-memory.dmp
memory/1752-42-0x0000000000400000-0x0000000001A77000-memory.dmp
memory/1932-28-0x0000000005390000-0x0000000005391000-memory.dmp
memory/1932-27-0x0000000005380000-0x0000000005381000-memory.dmp
memory/1932-45-0x00000000053E0000-0x00000000053E1000-memory.dmp
memory/1932-35-0x0000000000410000-0x00000000008D3000-memory.dmp
memory/1932-32-0x0000000005360000-0x0000000005361000-memory.dmp
memory/1932-60-0x0000000000410000-0x00000000008D3000-memory.dmp
memory/1932-31-0x0000000005350000-0x0000000005351000-memory.dmp
memory/1932-25-0x0000000000410000-0x00000000008D3000-memory.dmp
memory/1932-26-0x00000000770A4000-0x00000000770A6000-memory.dmp
memory/1932-33-0x00000000053B0000-0x00000000053B1000-memory.dmp
memory/1932-29-0x0000000005370000-0x0000000005371000-memory.dmp
memory/1932-44-0x00000000053D0000-0x00000000053D1000-memory.dmp
memory/1932-30-0x00000000053C0000-0x00000000053C1000-memory.dmp
memory/2152-278-0x0000000000400000-0x0000000000450000-memory.dmp
memory/2612-5-0x0000000000400000-0x0000000001A29000-memory.dmp
memory/2612-1-0x0000000001D30000-0x0000000001E30000-memory.dmp
memory/2612-3-0x0000000000400000-0x0000000001A29000-memory.dmp
memory/2612-2-0x0000000001BB0000-0x0000000001BBB000-memory.dmp
memory/2768-107-0x00000000053A0000-0x00000000053A1000-memory.dmp
memory/2768-170-0x0000000000770000-0x0000000000C33000-memory.dmp
memory/2768-108-0x00000000053E0000-0x00000000053E1000-memory.dmp
memory/2768-109-0x0000000005380000-0x0000000005381000-memory.dmp
memory/2768-310-0x0000000000770000-0x0000000000C33000-memory.dmp
memory/2768-105-0x00000000053C0000-0x00000000053C1000-memory.dmp
memory/2768-110-0x0000000005390000-0x0000000005391000-memory.dmp
memory/2768-112-0x0000000005400000-0x0000000005401000-memory.dmp
memory/2768-111-0x0000000005410000-0x0000000005411000-memory.dmp
memory/2768-103-0x00000000053B0000-0x00000000053B1000-memory.dmp
memory/2768-146-0x0000000000770000-0x0000000000C33000-memory.dmp
memory/2768-97-0x0000000000770000-0x0000000000C33000-memory.dmp
memory/2768-101-0x0000000000770000-0x0000000000C33000-memory.dmp
memory/2856-377-0x0000000000400000-0x00000000007AB000-memory.dmp
memory/2856-367-0x0000000000400000-0x00000000007AB000-memory.dmp
memory/2912-178-0x0000000000400000-0x0000000001A29000-memory.dmp
memory/3084-121-0x00000000054C0000-0x00000000054C1000-memory.dmp
memory/3084-116-0x0000000000770000-0x0000000000C33000-memory.dmp
memory/3084-123-0x0000000000770000-0x0000000000C33000-memory.dmp
memory/3084-114-0x0000000000770000-0x0000000000C33000-memory.dmp
memory/3084-117-0x00000000054D0000-0x00000000054D1000-memory.dmp
memory/3084-119-0x0000000005500000-0x0000000005501000-memory.dmp
memory/3084-120-0x00000000054A0000-0x00000000054A1000-memory.dmp
memory/3084-122-0x00000000054B0000-0x00000000054B1000-memory.dmp
memory/3084-118-0x00000000054E0000-0x00000000054E1000-memory.dmp
memory/3448-175-0x0000000003320000-0x0000000003336000-memory.dmp
memory/3448-4-0x0000000003140000-0x0000000003156000-memory.dmp
memory/3972-82-0x00000000051C0000-0x00000000051C1000-memory.dmp
memory/3972-77-0x0000000000380000-0x0000000000843000-memory.dmp
memory/3972-87-0x0000000000380000-0x0000000000843000-memory.dmp
memory/3972-85-0x00000000051B0000-0x00000000051B1000-memory.dmp
memory/3972-84-0x00000000051A0000-0x00000000051A1000-memory.dmp
memory/3972-83-0x0000000005200000-0x0000000005201000-memory.dmp
memory/3972-89-0x0000000005220000-0x0000000005221000-memory.dmp
memory/3972-81-0x00000000051E0000-0x00000000051E1000-memory.dmp
memory/3972-80-0x00000000051D0000-0x00000000051D1000-memory.dmp
memory/3972-94-0x0000000000380000-0x0000000000843000-memory.dmp
memory/3972-90-0x0000000005210000-0x0000000005211000-memory.dmp
memory/4140-237-0x0000000000400000-0x0000000000448000-memory.dmp
memory/4140-226-0x0000000000400000-0x0000000000448000-memory.dmp
memory/4232-295-0x0000000000400000-0x0000000000414000-memory.dmp
memory/4876-49-0x0000000003F20000-0x00000000040D7000-memory.dmp
memory/4876-48-0x0000000003D60000-0x0000000003F1F000-memory.dmp
memory/4916-15-0x0000000010000000-0x0000000010268000-memory.dmp
memory/4916-76-0x0000000010000000-0x0000000010268000-memory.dmp
memory/4916-71-0x00000000029B0000-0x0000000002AC9000-memory.dmp
memory/4916-68-0x00000000029B0000-0x0000000002AC9000-memory.dmp
memory/4916-66-0x0000000002870000-0x00000000029A7000-memory.dmp
memory/4916-14-0x0000000000AD0000-0x0000000000AD6000-memory.dmp