Analysis

  • max time kernel
    154s
  • max time network
    176s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-03-2024 19:44

General

  • Target

    1b9cb6ae126f7fb5bbbb0ffa6a7ec47cfc6eed1de4b091e1ac2443cf037ca90e.exe

  • Size

    132KB

  • MD5

    f1936ac59e253c71f5b2b415c69c0495

  • SHA1

    e19e764f60167f8afd6ea09ac57b623fd6feeaff

  • SHA256

    1b9cb6ae126f7fb5bbbb0ffa6a7ec47cfc6eed1de4b091e1ac2443cf037ca90e

  • SHA512

    0e5fdfd91ee16bddcbd85111c5815c644123aaab39ad076b04ef32bfded1083a7fd3b6ec417dc617d4e65be26266f61018ce12c6d71ba3822880da8a375e4f1b

  • SSDEEP

    1536:LENr7zNlkFPoZgXg0rgA8k3Cs3cVFkm+j/3DuZE5sGGVXgrNpQNq1Wgl2:LENrXNCiitt0p+nuosGGiNpbXl2

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php

rc4.i32
rc4.i32

Extracted

Family

djvu

C2

http://sajdfue.com/test1/get.php

Attributes
  • extension

    .wisz

  • offline_id

    4p0Nzrg1q0ND5of5Gtp2UBjthSXuE8VxnMrd4vt1

  • payload_url

    http://sdfjhuz.com/dl/build2.exe

    http://sajdfue.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/a832401adcd58098c699f768ffea4f1720240305114308/7e601a Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0853PsawqS

rsa_pubkey.plain

Extracted

Family

lumma

C2

https://wisemassiveharmonious.shop/api

https://colorfulequalugliess.shop/api

https://relevantvoicelesskw.shop/api

https://associationokeo.shop/api

https://resergvearyinitiani.shop/api

Signatures

  • Detect ZGRat V1 2 IoCs
  • Detected Djvu ransomware 10 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 7 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\1b9cb6ae126f7fb5bbbb0ffa6a7ec47cfc6eed1de4b091e1ac2443cf037ca90e.exe
    "C:\Users\Admin\AppData\Local\Temp\1b9cb6ae126f7fb5bbbb0ffa6a7ec47cfc6eed1de4b091e1ac2443cf037ca90e.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:800
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BF73.bat" "
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:392
    • C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
      2⤵
        PID:4404
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5084 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:4012
      • C:\Users\Admin\AppData\Local\Temp\DBF5.exe
        C:\Users\Admin\AppData\Local\Temp\DBF5.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3940
        • C:\Users\Admin\AppData\Local\Temp\DBF5.exe
          C:\Users\Admin\AppData\Local\Temp\DBF5.exe
          2⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:4376
          • C:\Windows\SysWOW64\icacls.exe
            icacls "C:\Users\Admin\AppData\Local\21f12759-31e3-4760-a46e-0a933afd6000" /deny *S-1-1-0:(OI)(CI)(DE,DC)
            3⤵
            • Modifies file permissions
            PID:4216
          • C:\Users\Admin\AppData\Local\Temp\DBF5.exe
            "C:\Users\Admin\AppData\Local\Temp\DBF5.exe" --Admin IsNotAutoStart IsNotTask
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2544
            • C:\Users\Admin\AppData\Local\Temp\DBF5.exe
              "C:\Users\Admin\AppData\Local\Temp\DBF5.exe" --Admin IsNotAutoStart IsNotTask
              4⤵
              • Executes dropped EXE
              PID:3324
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 568
                5⤵
                • Program crash
                PID:1124
      • C:\Users\Admin\AppData\Local\Temp\EDC8.exe
        C:\Users\Admin\AppData\Local\Temp\EDC8.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2020
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          2⤵
            PID:2760
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            2⤵
              PID:3964
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3324 -ip 3324
            1⤵
              PID:2468
            • C:\Users\Admin\AppData\Local\Temp\19B6.exe
              C:\Users\Admin\AppData\Local\Temp\19B6.exe
              1⤵
              • Executes dropped EXE
              PID:2496
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\237B.bat" "
              1⤵
              • Suspicious use of WriteProcessMemory
              PID:4196
              • C:\Windows\system32\reg.exe
                reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
                2⤵
                  PID:3488
              • C:\Users\Admin\AppData\Local\Temp\5450.exe
                C:\Users\Admin\AppData\Local\Temp\5450.exe
                1⤵
                • Executes dropped EXE
                PID:3080

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\19B6.exe

                Filesize

                6.5MB

                MD5

                9e52aa572f0afc888c098db4c0f687ff

                SHA1

                ef7c2bb222e69ad0e10c8686eb03dcbee7933c2b

                SHA256

                4a40f9d491f09521f4b0c6076a0eb488f6d8e1cf4b67aa6569c2ccce13556443

                SHA512

                d0991e682ae8c954721e905753b56c01f91b85313beb9996331793c3efa8acc13d574ef5ba44853ecc3e05822931ed655bad1924fa11b774a43e015f42185f62

              • C:\Users\Admin\AppData\Local\Temp\5450.exe

                Filesize

                4.5MB

                MD5

                859a09d58d1c5e2e82dfb047151e8653

                SHA1

                1971adde3e3535f7d7db24a8ef22284b45062437

                SHA256

                6e214982f41ce44d7e768bf8f01484120101afefaddb8b66a7d332709d40294b

                SHA512

                b040ad6c65dfb1da2d9abbdd99a4adf1abbf357d913780e214938af0d6f7a1b7778fb6ad763d8abfea71f2902fffa7b75d5d14272d248bad8ba07243787c8693

              • C:\Users\Admin\AppData\Local\Temp\5450.exe

                Filesize

                5.5MB

                MD5

                8550a2827ea5838ec8df7ff6fd10e6ce

                SHA1

                c8ce1f265d516f063f7db92e341a59a4568cc484

                SHA256

                02147ca0fdeec2804183385003397b5b10145d2027327a3b928acc0d2c00d527

                SHA512

                d1d6b8ce2411a8c5191bfb948bbfe455846fa2e6357bd5c7aeb78722776abc6ae529b4701439d1389b9de51b6ba00e8bba0fe39f17f39e423563b463bd61b9c9

              • C:\Users\Admin\AppData\Local\Temp\BF73.bat

                Filesize

                77B

                MD5

                55cc761bf3429324e5a0095cab002113

                SHA1

                2cc1ef4542a4e92d4158ab3978425d517fafd16d

                SHA256

                d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a

                SHA512

                33f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155

              • C:\Users\Admin\AppData\Local\Temp\DBF5.exe

                Filesize

                696KB

                MD5

                34fde9d03541c0ed5419a5f836e484c6

                SHA1

                06b08899348a41347284ca56cefd02783a2e4e90

                SHA256

                419b2e437adbe8a00d794e190d387ce91a24243227418c33b5a556adcda46bd1

                SHA512

                880c0a3f1b47aeac1b96f6e775e693921803dfcf5fb99352ec92f7cc9d89e1a05cdb01408e7de6580818c2431df022ba953b555711a7e5e4de85de01113a1488

              • C:\Users\Admin\AppData\Local\Temp\EDC8.exe

                Filesize

                530KB

                MD5

                756931963ef47d8261e3090770710355

                SHA1

                074e49a53dc0dea819a2ce9b487982f0ac114d86

                SHA256

                6a103e31e7c1990a5f21e6ad483805b01fdbabe9fd9454f42aab0eda9b5d67cf

                SHA512

                231458212051567f7549a7d24d0d956219e33480fbba3428b2259d571265802aa9b8727998f6c5bf62e30c1ec673619506b5cb9d1220c738af0685be2ec397ce

              • memory/800-8-0x00000000005D0000-0x00000000005DB000-memory.dmp

                Filesize

                44KB

              • memory/800-5-0x0000000000400000-0x000000000046B000-memory.dmp

                Filesize

                428KB

              • memory/800-1-0x0000000000610000-0x0000000000710000-memory.dmp

                Filesize

                1024KB

              • memory/800-3-0x0000000000400000-0x000000000046B000-memory.dmp

                Filesize

                428KB

              • memory/800-2-0x00000000005D0000-0x00000000005DB000-memory.dmp

                Filesize

                44KB

              • memory/2020-73-0x00000000032F0000-0x00000000052F0000-memory.dmp

                Filesize

                32.0MB

              • memory/2020-51-0x00000000032F0000-0x00000000052F0000-memory.dmp

                Filesize

                32.0MB

              • memory/2020-35-0x0000000003250000-0x0000000003260000-memory.dmp

                Filesize

                64KB

              • memory/2020-50-0x0000000074810000-0x0000000074FC0000-memory.dmp

                Filesize

                7.7MB

              • memory/2020-33-0x0000000074810000-0x0000000074FC0000-memory.dmp

                Filesize

                7.7MB

              • memory/2020-34-0x0000000000D10000-0x0000000000D96000-memory.dmp

                Filesize

                536KB

              • memory/2496-88-0x0000000000400000-0x00000000010E5000-memory.dmp

                Filesize

                12.9MB

              • memory/2496-99-0x0000000003280000-0x00000000032B2000-memory.dmp

                Filesize

                200KB

              • memory/2496-97-0x0000000003280000-0x00000000032B2000-memory.dmp

                Filesize

                200KB

              • memory/2496-100-0x0000000000400000-0x00000000010E5000-memory.dmp

                Filesize

                12.9MB

              • memory/2496-78-0x0000000000400000-0x00000000010E5000-memory.dmp

                Filesize

                12.9MB

              • memory/2496-98-0x0000000003280000-0x00000000032B2000-memory.dmp

                Filesize

                200KB

              • memory/2496-96-0x0000000003280000-0x00000000032B2000-memory.dmp

                Filesize

                200KB

              • memory/2496-95-0x0000000003280000-0x0000000003281000-memory.dmp

                Filesize

                4KB

              • memory/2496-94-0x0000000000400000-0x00000000010E5000-memory.dmp

                Filesize

                12.9MB

              • memory/2496-86-0x0000000001640000-0x0000000001641000-memory.dmp

                Filesize

                4KB

              • memory/2496-92-0x0000000003270000-0x0000000003271000-memory.dmp

                Filesize

                4KB

              • memory/2496-91-0x00000000017B0000-0x00000000017B1000-memory.dmp

                Filesize

                4KB

              • memory/2496-90-0x00000000017A0000-0x00000000017A1000-memory.dmp

                Filesize

                4KB

              • memory/2496-87-0x0000000001760000-0x0000000001761000-memory.dmp

                Filesize

                4KB

              • memory/2496-89-0x0000000001790000-0x0000000001791000-memory.dmp

                Filesize

                4KB

              • memory/2544-64-0x0000000000590000-0x0000000000630000-memory.dmp

                Filesize

                640KB

              • memory/3080-105-0x00007FF6D2F40000-0x00007FF6D3BA2000-memory.dmp

                Filesize

                12.4MB

              • memory/3324-70-0x0000000000400000-0x0000000000537000-memory.dmp

                Filesize

                1.2MB

              • memory/3324-67-0x0000000000400000-0x0000000000537000-memory.dmp

                Filesize

                1.2MB

              • memory/3324-68-0x0000000000400000-0x0000000000537000-memory.dmp

                Filesize

                1.2MB

              • memory/3332-4-0x0000000002A30000-0x0000000002A46000-memory.dmp

                Filesize

                88KB

              • memory/3940-22-0x0000000002200000-0x000000000231B000-memory.dmp

                Filesize

                1.1MB

              • memory/3940-21-0x00000000004C0000-0x0000000000560000-memory.dmp

                Filesize

                640KB

              • memory/3964-56-0x0000000000DB0000-0x0000000000DE2000-memory.dmp

                Filesize

                200KB

              • memory/3964-53-0x0000000000400000-0x0000000000448000-memory.dmp

                Filesize

                288KB

              • memory/3964-59-0x0000000000DB0000-0x0000000000DE2000-memory.dmp

                Filesize

                200KB

              • memory/3964-58-0x0000000000DB0000-0x0000000000DE2000-memory.dmp

                Filesize

                200KB

              • memory/3964-57-0x0000000000DB0000-0x0000000000DE2000-memory.dmp

                Filesize

                200KB

              • memory/3964-54-0x0000000000400000-0x0000000000448000-memory.dmp

                Filesize

                288KB

              • memory/3964-55-0x0000000000DB0000-0x0000000000DE2000-memory.dmp

                Filesize

                200KB

              • memory/3964-47-0x0000000000400000-0x0000000000448000-memory.dmp

                Filesize

                288KB

              • memory/4376-61-0x0000000000400000-0x0000000000537000-memory.dmp

                Filesize

                1.2MB

              • memory/4376-46-0x0000000000400000-0x0000000000537000-memory.dmp

                Filesize

                1.2MB

              • memory/4376-32-0x0000000000400000-0x0000000000537000-memory.dmp

                Filesize

                1.2MB

              • memory/4376-30-0x0000000000400000-0x0000000000537000-memory.dmp

                Filesize

                1.2MB

              • memory/4376-25-0x0000000000400000-0x0000000000537000-memory.dmp

                Filesize

                1.2MB

              • memory/4376-23-0x0000000000400000-0x0000000000537000-memory.dmp

                Filesize

                1.2MB