Analysis
- max time kernel
168s - max time network
176s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
08/03/2024, 22:26
General
- Target 63geplik.ru.exe
- Size 261KB
- Sample240308-2cw1lsaa51
- SHA256 4a442ef8863e6589bc6fad1e20cb6ca3b96d3d5be3d720f9875e004039195d2d
Malware Config
Extracted
-
smokeloader
-
2022
-
http://selebration17io.io/index.php
-
http://vacantion18ffeu.cc/index.php
-
http://valarioulinity1.net/index.php
-
http://buriatiarutuhuob.net/index.php
-
http://cassiosssionunu.me/index.php
-
http://sulugilioiu19.net/index.php
-
http://goodfooggooftool.net/index.php
Extracted
-
amadey
-
4.17
-
http://185.215.113.32
-
install_dir
00c07260dc
-
install_file
explorgu.exe
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Deletes itself 1 IoCs
- Executes dropped EXE 4 IoCs
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 2 IoCs
- UPX packed file 13 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 33 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\63geplik.ru.exe"C:\Users\Admin\AppData\Local\Temp\63geplik.ru.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\4E7E.exeC:\Users\Admin\AppData\Local\Temp\4E7E.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\taskeng.exetaskeng.exe {EBAF12CF-BF03-4D01-960E-5DC8B009F834} S-1-5-21-1658372521-4246568289-2509113762-1000:PIRBKNPS\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\vvtfiauC:\Users\Admin\AppData\Roaming\vvtfiau2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\BC8C.exeC:\Users\Admin\AppData\Local\Temp\BC8C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BC8C.exeC:\Users\Admin\AppData\Local\Temp\BC8C.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\B147.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\B147.dll2⤵
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
4E7E.exe
cached-microdesc-consensus.tmp
cached-microdescs.new
B147.dll
BC8C.exe
vvtfiau
BC8C.exe
memory/440-45-0x0000000001BE0000-0x0000000001CE0000-memory.dmp
memory/440-46-0x0000000000400000-0x0000000001A2E000-memory.dmp
memory/440-48-0x0000000000400000-0x0000000001A2E000-memory.dmp
memory/1252-4-0x00000000029A0000-0x00000000029B6000-memory.dmp
memory/1252-47-0x00000000029F0000-0x0000000002A06000-memory.dmp
memory/1632-96-0x0000000010000000-0x00000000102ED000-memory.dmp
memory/1632-95-0x0000000000170000-0x0000000000176000-memory.dmp
memory/1632-103-0x0000000002290000-0x00000000023CE000-memory.dmp
memory/1632-106-0x00000000023D0000-0x00000000024F1000-memory.dmp
memory/1632-112-0x00000000023D0000-0x00000000024F1000-memory.dmp
memory/1632-113-0x00000000023D0000-0x00000000024F1000-memory.dmp
memory/1668-59-0x0000000003AD0000-0x0000000003C87000-memory.dmp
memory/1668-58-0x0000000003910000-0x0000000003AC8000-memory.dmp
memory/1668-57-0x0000000003910000-0x0000000003AC8000-memory.dmp
memory/2520-71-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2520-91-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2520-116-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2520-89-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2520-88-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2520-79-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2520-78-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2520-77-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2520-70-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2520-69-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2520-67-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2520-68-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2520-64-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2520-62-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2964-41-0x0000000000B40000-0x0000000000FFF000-memory.dmp
memory/2964-28-0x0000000002750000-0x0000000002751000-memory.dmp
memory/2964-25-0x0000000002630000-0x0000000002631000-memory.dmp
memory/2964-27-0x0000000002580000-0x0000000002581000-memory.dmp
memory/2964-23-0x00000000025D0000-0x00000000025D1000-memory.dmp
memory/2964-29-0x0000000002400000-0x0000000002401000-memory.dmp
memory/2964-21-0x0000000002680000-0x0000000002681000-memory.dmp
memory/2964-35-0x00000000009E0000-0x00000000009E1000-memory.dmp
memory/2964-30-0x0000000002560000-0x0000000002561000-memory.dmp
memory/2964-31-0x00000000009D0000-0x00000000009D1000-memory.dmp
memory/2964-26-0x0000000002450000-0x0000000002451000-memory.dmp
memory/2964-32-0x0000000002570000-0x0000000002571000-memory.dmp
memory/2964-20-0x0000000000B40000-0x0000000000FFF000-memory.dmp
memory/2964-36-0x0000000002AC0000-0x0000000002AC1000-memory.dmp
memory/2964-33-0x00000000027F0000-0x00000000027F1000-memory.dmp
memory/2964-22-0x00000000026E0000-0x00000000026E1000-memory.dmp
memory/2964-24-0x0000000002760000-0x0000000002761000-memory.dmp
memory/2964-19-0x0000000077BC0000-0x0000000077BC2000-memory.dmp
memory/2964-18-0x0000000000B40000-0x0000000000FFF000-memory.dmp
memory/2988-8-0x0000000000220000-0x000000000022B000-memory.dmp
memory/2988-5-0x0000000000400000-0x0000000001A2E000-memory.dmp
memory/2988-3-0x0000000000400000-0x0000000001A2E000-memory.dmp
memory/2988-1-0x0000000001B80000-0x0000000001C80000-memory.dmp
memory/2988-2-0x0000000000220000-0x000000000022B000-memory.dmp