Analysis
- max time kernel
121s - max time network
150s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
- submitted
12/03/2024, 04:27
General
- Target 987123.exe
- Size 282KB
- Sample240312-e3gbhsac83
- SHA256 68120a16380509e3cd084aa1b5c0bc59103883f23b0763b779c1ab5975f8f4b5
Malware Config
Extracted
-
smokeloader
-
2022
-
http://selebration17io.io/index.php
-
http://vacantion18ffeu.cc/index.php
-
http://valarioulinity1.net/index.php
-
http://buriatiarutuhuob.net/index.php
-
http://cassiosssionunu.me/index.php
-
http://sulugilioiu19.net/index.php
-
http://goodfooggooftool.net/index.php
-
http://nidoe.org/tmp/index.php
-
http://sodez.ru/tmp/index.php
-
http://uama.com.ua/tmp/index.php
-
http://talesofpirates.net/tmp/index.php
Extracted
-
amadey
-
4.17
-
http://185.215.113.32
-
install_dir
00c07260dc
-
install_file
explorgu.exe
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Extracted
-
smokeloader
-
pub1
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Detect ZGRat V1 2 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- ZGRat
ZGRat is remote access trojan written in C#.
- Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
- UPX dump on OEP (original entry point) 11 IoCs
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Deletes itself 1 IoCs
- Executes dropped EXE 16 IoCs
- Identifies Wine through registry keys 2 TTPs 3 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 21 IoCs
- UPX packed file 11 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of FindShellTrayWindow 5 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\987123.exe"C:\Users\Admin\AppData\Local\Temp\987123.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\C1B9.exeC:\Users\Admin\AppData\Local\Temp\C1B9.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\D692.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\D692.dll2⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\FE6D.exeC:\Users\Admin\AppData\Local\Temp\FE6D.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FE6D.exeC:\Users\Admin\AppData\Local\Temp\FE6D.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\8E00.exeC:\Users\Admin\AppData\Local\Temp\8E00.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\9E17.exeC:\Users\Admin\AppData\Local\Temp\9E17.exe1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\AppData\Local\Temp\D761.exeC:\Users\Admin\AppData\Local\Temp\D761.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup_four.exe"C:\Users\Admin\AppData\Local\Temp\InstallSetup_four.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\u28w.0.exe"C:\Users\Admin\AppData\Local\Temp\u28w.0.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\u28w.1.exe"C:\Users\Admin\AppData\Local\Temp\u28w.1.exe"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "4⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12515⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F5⤵
- Creates scheduled task(s)
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\april.exe"C:\Users\Admin\AppData\Local\Temp\april.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-5AAKJ.tmp\april.tmp"C:\Users\Admin\AppData\Local\Temp\is-5AAKJ.tmp\april.tmp" /SL5="$201F2,1697899,56832,C:\Users\Admin\AppData\Local\Temp\april.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Users\Admin\AppData\Local\Temp\F750.exeC:\Users\Admin\AppData\Local\Temp\F750.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-GVAU2.tmp\F750.tmp"C:\Users\Admin\AppData\Local\Temp\is-GVAU2.tmp\F750.tmp" /SL5="$301BE,1639144,56832,C:\Users\Admin\AppData\Local\Temp\F750.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Local\Temp\1221.exeC:\Users\Admin\AppData\Local\Temp\1221.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe"C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\1000836001\osminog.exe"C:\Users\Admin\AppData\Local\Temp\1000836001\osminog.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 2565⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main3⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main4⤵
-
C:\Windows\system32\netsh.exenetsh wlan show profiles5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\627615824406_Desktop.zip' -CompressionLevel Optimal5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000837001\goldprime123mm.exe"C:\Users\Admin\AppData\Local\Temp\1000837001\goldprime123mm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\3960.exeC:\Users\Admin\AppData\Local\Temp\3960.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {47118415-92DD-4B70-9872-1DD6B180DCA5} S-1-5-21-3627615824-4061627003-3019543961-1000:SCFGBRBT\Admin:Interactive:[1]1⤵
-
C:\Users\Admin\AppData\Roaming\htwcugjC:\Users\Admin\AppData\Roaming\htwcugj2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\8A00.exeC:\Users\Admin\AppData\Local\Temp\8A00.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
is-TEE7J.tmp
explorgu.exe
explorgu.exe
osminog.exe
goldprime123mm.exe
1221.exe
288c47bbc1871b439df19ff4df68f076.exe
288c47bbc1871b439df19ff4df68f076.exe
3960.exe
8E00.exe
9E17.exe
C1B9.exe
C1B9.exe
D692.dll
D761.exe
D761.exe
F750.exe
FE6D.exe
FE6D.exe
FE6D.exe
april.exe
april.exe
april.exe
april.tmp
u28w.0.exe
u28w.1.exe
clip64.dll
cred64.dll
Task.bat
explorgu.job
f750.tmp
explorgu.exe
explorgu.exe
288c47bbc1871b439df19ff4df68f076.exe
288c47bbc1871b439df19ff4df68f076.exe
D692.dll
FE6D.exe
InstallSetup_four.exe
april.exe
F750.tmp
_iscrypt.dll
_shfoldr.dll
u28w.1.exe
u28w.1.exe
u28w.1.exe
u28w.1.exe
memory/864-422-0x0000000001D80000-0x0000000001D88000-memory.dmp
memory/864-421-0x000000001B620000-0x000000001B902000-memory.dmp
memory/864-429-0x000007FEF4D30000-0x000007FEF56CD000-memory.dmp
memory/864-431-0x0000000002D3B000-0x0000000002DA2000-memory.dmp
memory/864-430-0x0000000002D34000-0x0000000002D37000-memory.dmp
memory/904-201-0x0000000000D40000-0x00000000011E8000-memory.dmp
memory/1112-48-0x00000000028F0000-0x00000000029FF000-memory.dmp
memory/1112-44-0x0000000000130000-0x0000000000136000-memory.dmp
memory/1112-51-0x00000000028F0000-0x00000000029FF000-memory.dmp
memory/1112-59-0x0000000010000000-0x00000000102CE000-memory.dmp
memory/1112-45-0x0000000010000000-0x00000000102CE000-memory.dmp
memory/1112-47-0x00000000027C0000-0x00000000028EB000-memory.dmp
memory/1204-4-0x0000000002D30000-0x0000000002D46000-memory.dmp
memory/1204-276-0x0000000002EE0000-0x0000000002EF6000-memory.dmp
memory/1228-278-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/1344-134-0x0000000000400000-0x0000000000414000-memory.dmp
memory/1508-260-0x00000000002F0000-0x0000000000346000-memory.dmp
memory/1508-375-0x0000000072A90000-0x000000007317E000-memory.dmp
memory/1536-190-0x00000000737C0000-0x0000000073EAE000-memory.dmp
memory/1536-128-0x0000000000D10000-0x00000000013A2000-memory.dmp
memory/1576-355-0x0000000000F30000-0x0000000000FBA000-memory.dmp
memory/1728-61-0x0000000002100000-0x00000000022B7000-memory.dmp
memory/1728-60-0x0000000001F40000-0x00000000020F8000-memory.dmp
memory/1728-58-0x0000000001F40000-0x00000000020F8000-memory.dmp
memory/1972-120-0x0000000000250000-0x00000000002BB000-memory.dmp
memory/1972-121-0x0000000000400000-0x0000000001A77000-memory.dmp
memory/1972-119-0x0000000001B90000-0x0000000001C90000-memory.dmp
memory/1972-122-0x0000000000400000-0x0000000001A77000-memory.dmp
memory/1992-107-0x0000000000140000-0x0000000000141000-memory.dmp
memory/1992-99-0x0000000000080000-0x0000000000081000-memory.dmp
memory/1992-91-0x0000000000850000-0x0000000001542000-memory.dmp
memory/1992-110-0x0000000000140000-0x0000000000141000-memory.dmp
memory/1992-106-0x0000000000850000-0x0000000001542000-memory.dmp
memory/1992-105-0x0000000000080000-0x0000000000081000-memory.dmp
memory/1992-103-0x0000000000080000-0x0000000000081000-memory.dmp
memory/2032-301-0x0000000000400000-0x0000000001A32000-memory.dmp
memory/2032-288-0x0000000000334000-0x0000000000349000-memory.dmp
memory/2032-290-0x00000000001B0000-0x00000000001BB000-memory.dmp
memory/2120-189-0x0000000000400000-0x0000000000414000-memory.dmp
memory/2360-73-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2360-66-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2360-86-0x0000000002D90000-0x0000000002E9F000-memory.dmp
memory/2360-64-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2360-83-0x0000000002D90000-0x0000000002E9F000-memory.dmp
memory/2360-82-0x0000000002C60000-0x0000000002D8B000-memory.dmp
memory/2360-76-0x0000000000270000-0x0000000000276000-memory.dmp
memory/2360-72-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2360-71-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2360-69-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2360-70-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2680-21-0x0000000000D90000-0x0000000000D91000-memory.dmp
memory/2680-33-0x0000000002850000-0x0000000002851000-memory.dmp
memory/2680-23-0x00000000004E0000-0x00000000004E1000-memory.dmp
memory/2680-25-0x0000000000D80000-0x0000000000D81000-memory.dmp
memory/2680-26-0x0000000000E20000-0x0000000000E21000-memory.dmp
memory/2680-27-0x0000000002830000-0x0000000002831000-memory.dmp
memory/2680-28-0x00000000006D0000-0x00000000006D1000-memory.dmp
memory/2680-29-0x0000000000B20000-0x0000000000B21000-memory.dmp
memory/2680-17-0x0000000000E30000-0x00000000012D8000-memory.dmp
memory/2680-22-0x0000000002840000-0x0000000002841000-memory.dmp
memory/2680-30-0x0000000000E30000-0x00000000012D8000-memory.dmp
memory/2680-18-0x0000000076F20000-0x0000000076F22000-memory.dmp
memory/2680-19-0x00000000026E0000-0x00000000026E2000-memory.dmp
memory/2680-24-0x0000000000B10000-0x0000000000B11000-memory.dmp
memory/2680-32-0x0000000000D30000-0x0000000000D31000-memory.dmp
memory/2680-34-0x00000000004F0000-0x00000000004F1000-memory.dmp
memory/2680-20-0x0000000002700000-0x0000000002701000-memory.dmp
memory/2680-40-0x0000000000E30000-0x00000000012D8000-memory.dmp
memory/2680-35-0x0000000002D70000-0x0000000002D71000-memory.dmp
memory/2912-284-0x00000000002A0000-0x0000000000307000-memory.dmp
memory/2912-274-0x0000000000400000-0x0000000001A52000-memory.dmp
memory/2912-281-0x0000000001F04000-0x0000000001F39000-memory.dmp
memory/2988-2-0x0000000000220000-0x000000000022B000-memory.dmp
memory/2988-5-0x0000000000400000-0x0000000001A32000-memory.dmp
memory/2988-3-0x0000000000400000-0x0000000001A32000-memory.dmp
memory/2988-1-0x0000000001B30000-0x0000000001C30000-memory.dmp
memory/3036-184-0x0000000003670000-0x0000000003A68000-memory.dmp