Analysis
- max time kernel
158s - max time network
172s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
08/03/2024, 22:26
General
- Target 63geplik.ru.exe
- Size 261KB
- Sample240308-2cw1lsaa51
- SHA256 4a442ef8863e6589bc6fad1e20cb6ca3b96d3d5be3d720f9875e004039195d2d
Malware Config
Extracted
-
smokeloader
-
2022
-
http://selebration17io.io/index.php
-
http://vacantion18ffeu.cc/index.php
-
http://valarioulinity1.net/index.php
-
http://buriatiarutuhuob.net/index.php
-
http://cassiosssionunu.me/index.php
-
http://sulugilioiu19.net/index.php
-
http://goodfooggooftool.net/index.php
Extracted
-
amadey
-
4.17
-
http://185.215.113.32
-
install_dir
00c07260dc
-
install_file
explorgu.exe
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Extracted
-
redline
-
LiveTraffic
-
20.218.68.91:7690
Extracted
-
lumma
-
https://resergvearyinitiani.shop/api
-
https://technologyenterdo.shop/api
-
https://detectordiscusser.shop/api
-
https://turkeyunlikelyofw.shop/api
-
https://associationokeo.shop/api
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Lumma Stealer
An infostealer written in C++ first seen in August 2022.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
- Blocklisted process makes network request 2 IoCs
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Deletes itself 1 IoCs
- Executes dropped EXE 7 IoCs
- Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 4 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 18 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 29 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 63 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\63geplik.ru.exe"C:\Users\Admin\AppData\Local\Temp\63geplik.ru.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5068 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:81⤵
-
C:\Users\Admin\AppData\Local\Temp\BE3A.exeC:\Users\Admin\AppData\Local\Temp\BE3A.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\CA12.exeC:\Users\Admin\AppData\Local\Temp\CA12.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CA12.exeC:\Users\Admin\AppData\Local\Temp\CA12.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exeC:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000836001\osminog.exe"C:\Users\Admin\AppData\Local\Temp\1000836001\osminog.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\808065738166_Desktop.zip' -CompressionLevel Optimal4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000837001\goldprime123.exe"C:\Users\Admin\AppData\Local\Temp\1000837001\goldprime123.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main2⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Roaming\iwbgdssC:\Users\Admin\AppData\Roaming\iwbgdss1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\5B28.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\5B28.dll2⤵
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
explorgu.exe
explorgu.exe
osminog.exe
goldprime123.exe
cached-microdesc-consensus.tmp
cached-microdescs.new
5B28.dll
5B28.dll
BE3A.exe
CA12.exe
CA12.exe
__PSScriptPolicyTest_1l2kjgw1.03f.ps1
clip64.dll
cred64.dll
iwbgdss
memory/1168-41-0x0000000003F40000-0x00000000040F7000-memory.dmp
memory/1168-40-0x0000000003D80000-0x0000000003F3C000-memory.dmp
memory/1384-72-0x00000000052A0000-0x00000000052A1000-memory.dmp
memory/1384-74-0x0000000005280000-0x0000000005281000-memory.dmp
memory/1384-82-0x0000000005300000-0x0000000005301000-memory.dmp
memory/1384-81-0x00000000052F0000-0x00000000052F1000-memory.dmp
memory/1384-73-0x00000000052E0000-0x00000000052E1000-memory.dmp
memory/1384-75-0x0000000005290000-0x0000000005291000-memory.dmp
memory/1384-252-0x0000000000A30000-0x0000000000EEF000-memory.dmp
memory/1384-148-0x0000000000A30000-0x0000000000EEF000-memory.dmp
memory/1384-71-0x00000000052C0000-0x00000000052C1000-memory.dmp
memory/1384-70-0x00000000052B0000-0x00000000052B1000-memory.dmp
memory/1384-69-0x0000000000A30000-0x0000000000EEF000-memory.dmp
memory/1384-68-0x0000000000A30000-0x0000000000EEF000-memory.dmp
memory/1384-207-0x0000000000A30000-0x0000000000EEF000-memory.dmp
memory/1384-249-0x0000000000A30000-0x0000000000EEF000-memory.dmp
memory/1384-126-0x0000000000A30000-0x0000000000EEF000-memory.dmp
memory/1384-242-0x0000000000A30000-0x0000000000EEF000-memory.dmp
memory/1384-237-0x0000000000A30000-0x0000000000EEF000-memory.dmp
memory/1384-109-0x0000000000A30000-0x0000000000EEF000-memory.dmp
memory/1576-3-0x0000000000400000-0x0000000001A2E000-memory.dmp
memory/1576-9-0x0000000003770000-0x000000000377B000-memory.dmp
memory/1576-1-0x0000000001C60000-0x0000000001D60000-memory.dmp
memory/1576-5-0x0000000000400000-0x0000000001A2E000-memory.dmp
memory/1576-2-0x0000000003770000-0x000000000377B000-memory.dmp
memory/1624-80-0x0000000000400000-0x0000000001A2E000-memory.dmp
memory/1624-93-0x0000000000400000-0x0000000001A2E000-memory.dmp
memory/1624-79-0x0000000001C10000-0x0000000001D10000-memory.dmp
memory/1748-177-0x0000021E49010000-0x0000021E49020000-memory.dmp
memory/1748-155-0x0000021E61630000-0x0000021E61652000-memory.dmp
memory/1748-176-0x0000021E49010000-0x0000021E49020000-memory.dmp
memory/1748-199-0x0000021E619F0000-0x0000021E61A02000-memory.dmp
memory/1748-200-0x0000021E619D0000-0x0000021E619DA000-memory.dmp
memory/1748-174-0x00007FFE5E090000-0x00007FFE5EB51000-memory.dmp
memory/1748-175-0x0000021E49010000-0x0000021E49020000-memory.dmp
memory/1748-206-0x00007FFE5E090000-0x00007FFE5EB51000-memory.dmp
memory/2804-19-0x0000000000560000-0x0000000000A1F000-memory.dmp
memory/2804-22-0x0000000004F70000-0x0000000004F71000-memory.dmp
memory/2804-18-0x0000000077554000-0x0000000077556000-memory.dmp
memory/2804-27-0x0000000004F90000-0x0000000004F91000-memory.dmp
memory/2804-28-0x0000000004F80000-0x0000000004F81000-memory.dmp
memory/2804-20-0x0000000004F40000-0x0000000004F41000-memory.dmp
memory/2804-21-0x0000000004F20000-0x0000000004F21000-memory.dmp
memory/2804-38-0x0000000000560000-0x0000000000A1F000-memory.dmp
memory/2804-23-0x0000000004F00000-0x0000000004F01000-memory.dmp
memory/2804-26-0x0000000004F60000-0x0000000004F61000-memory.dmp
memory/2804-17-0x0000000000560000-0x0000000000A1F000-memory.dmp
memory/2804-25-0x0000000004F30000-0x0000000004F31000-memory.dmp
memory/2804-24-0x0000000004F10000-0x0000000004F11000-memory.dmp
memory/2896-227-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2896-45-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2896-86-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2896-121-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2896-54-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2896-49-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2896-48-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2896-47-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2896-46-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2896-63-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2896-254-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2896-64-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2896-153-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2896-42-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2896-65-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2896-239-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2896-243-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2896-250-0x0000000000400000-0x0000000000848000-memory.dmp
memory/3364-90-0x0000000002700000-0x0000000002716000-memory.dmp
memory/3364-4-0x0000000002960000-0x0000000002976000-memory.dmp
memory/3632-133-0x0000000002F40000-0x0000000004F40000-memory.dmp
memory/3632-122-0x0000000000960000-0x00000000009B6000-memory.dmp
memory/3632-123-0x0000000005340000-0x0000000005350000-memory.dmp
memory/3632-120-0x0000000073020000-0x00000000737D0000-memory.dmp
memory/3632-195-0x0000000002F40000-0x0000000004F40000-memory.dmp
memory/3632-132-0x0000000073020000-0x00000000737D0000-memory.dmp
memory/3980-127-0x0000000000400000-0x0000000000448000-memory.dmp
memory/3980-135-0x0000000000400000-0x0000000000448000-memory.dmp
memory/3980-131-0x0000000000400000-0x0000000000448000-memory.dmp
memory/3980-134-0x00000000005E0000-0x00000000005E1000-memory.dmp
memory/4092-94-0x0000000002D20000-0x0000000002E5E000-memory.dmp
memory/4092-99-0x0000000002E60000-0x0000000002F81000-memory.dmp
memory/4092-98-0x0000000002E60000-0x0000000002F81000-memory.dmp
memory/4092-95-0x0000000002E60000-0x0000000002F81000-memory.dmp
memory/4092-88-0x0000000000D10000-0x0000000000D16000-memory.dmp
memory/4092-87-0x0000000010000000-0x00000000102ED000-memory.dmp
memory/4760-196-0x0000000072E80000-0x0000000073630000-memory.dmp
memory/4760-223-0x0000000007BA0000-0x0000000007CAA000-memory.dmp
memory/4760-224-0x0000000007A90000-0x0000000007AA2000-memory.dmp
memory/4760-222-0x0000000006210000-0x0000000006828000-memory.dmp
memory/4760-209-0x0000000004D60000-0x0000000004D6A000-memory.dmp
memory/4760-208-0x0000000004F20000-0x0000000004F30000-memory.dmp
memory/4760-198-0x0000000004D70000-0x0000000004E02000-memory.dmp
memory/4760-197-0x0000000005280000-0x0000000005824000-memory.dmp
memory/4760-191-0x0000000000400000-0x0000000000450000-memory.dmp
memory/5036-194-0x0000000072E80000-0x0000000073630000-memory.dmp
memory/5036-188-0x0000000005660000-0x0000000005670000-memory.dmp
memory/5036-186-0x0000000072E80000-0x0000000073630000-memory.dmp
memory/5036-185-0x0000000000B90000-0x0000000000C22000-memory.dmp