Analysis
- max time kernel
148s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
12/03/2024, 04:27
General
- Target 987123.exe
- Size 282KB
- Sample240312-e3gbhsac83
- SHA256 68120a16380509e3cd084aa1b5c0bc59103883f23b0763b779c1ab5975f8f4b5
Malware Config
Extracted
-
smokeloader
-
2022
-
http://selebration17io.io/index.php
-
http://vacantion18ffeu.cc/index.php
-
http://valarioulinity1.net/index.php
-
http://buriatiarutuhuob.net/index.php
-
http://cassiosssionunu.me/index.php
-
http://sulugilioiu19.net/index.php
-
http://goodfooggooftool.net/index.php
Extracted
-
amadey
-
4.17
-
http://185.215.113.32
-
install_dir
00c07260dc
-
install_file
explorgu.exe
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Extracted
-
redline
-
LiveTraffic
-
20.218.68.91:7690
Extracted
-
lumma
-
https://herdbescuitinjurywu.shop/api
-
https://resergvearyinitiani.shop/api
-
https://wisemassiveharmonious.shop/api
-
https://colorfulequalugliess.shop/api
-
https://associationokeo.shop/api
-
https://relevantvoicelesskw.shop/api
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Detect ZGRat V1 2 IoCs
- Lumma Stealer
An infostealer written in C++ first seen in August 2022.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- ZGRat
ZGRat is remote access trojan written in C#.
- Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 3 IoCs
- Detects executables packed with VMProtect. 3 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
- UPX dump on OEP (original entry point) 17 IoCs
- Blocklisted process makes network request 1 IoCs
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Deletes itself 1 IoCs
- Executes dropped EXE 8 IoCs
- Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 4 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 17 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 1 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 21 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 60 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\987123.exe"C:\Users\Admin\AppData\Local\Temp\987123.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\CAE1.exeC:\Users\Admin\AppData\Local\Temp\CAE1.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\EA13.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\EA13.dll2⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\3D5.exeC:\Users\Admin\AppData\Local\Temp\3D5.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3D5.exeC:\Users\Admin\AppData\Local\Temp\3D5.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
-
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exeC:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000836001\osminog.exe"C:\Users\Admin\AppData\Local\Temp\1000836001\osminog.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000837001\goldprime123mm.exe"C:\Users\Admin\AppData\Local\Temp\1000837001\goldprime123mm.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\570491262506_Desktop.zip' -CompressionLevel Optimal4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1000838001\judith.exe"C:\Users\Admin\AppData\Local\Temp\1000838001\judith.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1000858001\alex12341.exe"C:\Users\Admin\AppData\Local\Temp\1000858001\alex12341.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\93B3.exeC:\Users\Admin\AppData\Local\Temp\93B3.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\A874.exeC:\Users\Admin\AppData\Local\Temp\A874.exe1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\AppData\Local\Temp\FCB0.exeC:\Users\Admin\AppData\Local\Temp\FCB0.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup_four.exe"C:\Users\Admin\AppData\Local\Temp\InstallSetup_four.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\u298.0.exe"C:\Users\Admin\AppData\Local\Temp\u298.0.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\u298.1.exe"C:\Users\Admin\AppData\Local\Temp\u298.1.exe"3⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 11563⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\april.exe"C:\Users\Admin\AppData\Local\Temp\april.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\is-LAJ02.tmp\april.tmp"C:\Users\Admin\AppData\Local\Temp\is-LAJ02.tmp\april.tmp" /SL5="$601EE,1697899,56832,C:\Users\Admin\AppData\Local\Temp\april.exe"3⤵
-
C:\Users\Admin\AppData\Local\Email Box Organizer\emailboxorganizer.exe"C:\Users\Admin\AppData\Local\Email Box Organizer\emailboxorganizer.exe" -i4⤵
-
-
C:\Users\Admin\AppData\Local\Email Box Organizer\emailboxorganizer.exe"C:\Users\Admin\AppData\Local\Email Box Organizer\emailboxorganizer.exe" -s4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\F6.exeC:\Users\Admin\AppData\Local\Temp\F6.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\is-42HBK.tmp\F6.tmp"C:\Users\Admin\AppData\Local\Temp\is-42HBK.tmp\F6.tmp" /SL5="$90212,1639144,56832,C:\Users\Admin\AppData\Local\Temp\F6.exe"2⤵
-
C:\Users\Admin\AppData\Local\Simple Web Builder Free\simplewebbuilder.exe"C:\Users\Admin\AppData\Local\Simple Web Builder Free\simplewebbuilder.exe" -i3⤵
-
-
C:\Users\Admin\AppData\Local\Simple Web Builder Free\simplewebbuilder.exe"C:\Users\Admin\AppData\Local\Simple Web Builder Free\simplewebbuilder.exe" -s3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\149F.exeC:\Users\Admin\AppData\Local\Temp\149F.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\2BD1.exeC:\Users\Admin\AppData\Local\Temp\2BD1.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2924 -ip 29241⤵
-
C:\Users\Admin\AppData\Roaming\jfshjwrC:\Users\Admin\AppData\Roaming\jfshjwr1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
1Pre-OS Boot
1Bootkit
1Virtualization/Sandbox Evasion
2Credential Access
Unsecured Credentials
3Credentials In Files
2Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
emailboxorganizer.exe
is-9EGNM.tmp
simplewebbuilder.exe
simplewebbuilder.exe
simplewebbuilder.exe
osminog.exe
goldprime123mm.exe
judith.exe
288c47bbc1871b439df19ff4df68f076.exe
288c47bbc1871b439df19ff4df68f076.exe
288c47bbc1871b439df19ff4df68f076.exe
2BD1.exe
3D5.exe
3D5.exe
cached-microdesc-consensus.tmp
cached-microdescs.new
93B3.exe
A874.exe
CAE1.exe
EA13.dll
EA13.dll
F6.exe
FCB0.exe
FCB0.exe
InstallSetup_four.exe
__PSScriptPolicyTest_lcztkylx.p4k.ps1
april.exe
april.exe
april.exe
F6.tmp
F6.tmp
_iscrypt.dll
_shfoldr.dll
april.tmp
u298.0.exe
u298.1.exe
u298.1.exe
u298.1.exe
clip64.dll
cred64.dll
jfshjwr
memory/1644-388-0x0000000000400000-0x00000000005D0000-memory.dmp
memory/1728-314-0x0000000000400000-0x0000000000414000-memory.dmp
memory/1800-153-0x0000000001780000-0x0000000001781000-memory.dmp
memory/1800-140-0x0000000001750000-0x0000000001751000-memory.dmp
memory/1800-169-0x0000000073460000-0x0000000073C10000-memory.dmp
memory/1800-121-0x0000000000910000-0x0000000001602000-memory.dmp
memory/1800-139-0x0000000001720000-0x0000000001721000-memory.dmp
memory/1800-172-0x0000000073460000-0x0000000073C10000-memory.dmp
memory/1800-175-0x0000000001790000-0x0000000001791000-memory.dmp
memory/1800-138-0x0000000001710000-0x0000000001711000-memory.dmp
memory/1800-152-0x0000000001770000-0x0000000001771000-memory.dmp
memory/1800-141-0x0000000001760000-0x0000000001761000-memory.dmp
memory/1800-142-0x0000000000910000-0x0000000001602000-memory.dmp
memory/1800-174-0x0000000073460000-0x0000000073C10000-memory.dmp
memory/1800-228-0x0000000000910000-0x0000000001602000-memory.dmp
memory/1800-155-0x0000000000910000-0x0000000001602000-memory.dmp
memory/2200-392-0x0000000000400000-0x00000000005E8000-memory.dmp
memory/2200-403-0x0000000000400000-0x00000000005E8000-memory.dmp
memory/2208-277-0x0000000000400000-0x0000000000414000-memory.dmp
memory/2628-183-0x0000000000400000-0x0000000000448000-memory.dmp
memory/2628-170-0x0000000000400000-0x0000000000448000-memory.dmp
memory/2644-164-0x0000000073460000-0x0000000073C10000-memory.dmp
memory/2644-176-0x0000000073460000-0x0000000073C10000-memory.dmp
memory/2644-154-0x0000000000830000-0x0000000000886000-memory.dmp
memory/2644-180-0x0000000002C50000-0x0000000004C50000-memory.dmp
memory/2844-51-0x0000000002540000-0x00000000026F7000-memory.dmp
memory/2844-50-0x0000000002370000-0x0000000002535000-memory.dmp
memory/3364-4-0x0000000002A40000-0x0000000002A56000-memory.dmp
memory/3416-8-0x0000000001BE0000-0x0000000001BEB000-memory.dmp
memory/3416-1-0x0000000001C20000-0x0000000001D20000-memory.dmp
memory/3416-3-0x0000000000400000-0x0000000001A32000-memory.dmp
memory/3416-2-0x0000000001BE0000-0x0000000001BEB000-memory.dmp
memory/3416-5-0x0000000000400000-0x0000000001A32000-memory.dmp
memory/3460-44-0x0000000003430000-0x000000000353F000-memory.dmp
memory/3460-36-0x0000000001340000-0x0000000001346000-memory.dmp
memory/3460-37-0x0000000010000000-0x00000000102CE000-memory.dmp
memory/3460-39-0x0000000003300000-0x000000000342B000-memory.dmp
memory/3460-40-0x0000000003430000-0x000000000353F000-memory.dmp
memory/3460-43-0x0000000003430000-0x000000000353F000-memory.dmp
memory/3472-205-0x0000000005300000-0x000000000530A000-memory.dmp
memory/3472-199-0x0000000000400000-0x0000000000450000-memory.dmp
memory/3472-209-0x0000000006710000-0x0000000006722000-memory.dmp
memory/3472-203-0x0000000005730000-0x0000000005CD4000-memory.dmp
memory/3472-211-0x0000000008010000-0x000000000804C000-memory.dmp
memory/3472-210-0x00000000053C0000-0x00000000053D0000-memory.dmp
memory/3472-208-0x0000000073290000-0x0000000073A40000-memory.dmp
memory/3472-212-0x0000000008050000-0x000000000809C000-memory.dmp
memory/3472-207-0x00000000080E0000-0x00000000081EA000-memory.dmp
memory/3472-206-0x0000000006750000-0x0000000006D68000-memory.dmp
memory/3472-204-0x0000000005240000-0x00000000052D2000-memory.dmp
memory/3836-193-0x0000000073290000-0x0000000073A40000-memory.dmp
memory/3836-202-0x0000000073290000-0x0000000073A40000-memory.dmp
memory/3836-196-0x00000000051F0000-0x0000000005200000-memory.dmp
memory/3836-185-0x00000000007B0000-0x000000000083A000-memory.dmp
memory/3940-62-0x0000000000B60000-0x0000000000B66000-memory.dmp
memory/3940-57-0x0000000000400000-0x0000000000848000-memory.dmp
memory/3940-194-0x0000000000400000-0x0000000000848000-memory.dmp
memory/3940-84-0x0000000000400000-0x0000000000848000-memory.dmp
memory/3940-83-0x0000000000400000-0x0000000000848000-memory.dmp
memory/3940-82-0x0000000000400000-0x0000000000848000-memory.dmp
memory/3940-69-0x0000000002F90000-0x000000000309F000-memory.dmp
memory/3940-102-0x0000000000400000-0x0000000000848000-memory.dmp
memory/3940-52-0x0000000000400000-0x0000000000848000-memory.dmp
memory/3940-56-0x0000000000400000-0x0000000000848000-memory.dmp
memory/3940-229-0x0000000000400000-0x0000000000848000-memory.dmp
memory/3940-55-0x0000000000400000-0x0000000000848000-memory.dmp
memory/3940-68-0x0000000002F90000-0x000000000309F000-memory.dmp
memory/3940-85-0x0000000000400000-0x0000000000848000-memory.dmp
memory/3940-58-0x0000000000400000-0x0000000000848000-memory.dmp
memory/3940-65-0x0000000002F90000-0x000000000309F000-memory.dmp
memory/3940-59-0x0000000000400000-0x0000000000848000-memory.dmp
memory/3940-248-0x0000000000400000-0x0000000000848000-memory.dmp
memory/3940-64-0x0000000002E60000-0x0000000002F8B000-memory.dmp
memory/3952-234-0x0000000000400000-0x0000000001A77000-memory.dmp
memory/3952-231-0x0000000000400000-0x0000000001A77000-memory.dmp
memory/3952-186-0x0000000001C80000-0x0000000001D80000-memory.dmp
memory/3952-187-0x0000000001BF0000-0x0000000001C5B000-memory.dmp
memory/3952-189-0x0000000000400000-0x0000000001A77000-memory.dmp
memory/4528-441-0x0000000000A60000-0x0000000000F08000-memory.dmp
memory/5084-232-0x0000000000E70000-0x0000000001318000-memory.dmp
memory/5084-98-0x0000000005820000-0x0000000005821000-memory.dmp
memory/5084-91-0x0000000000E70000-0x0000000001318000-memory.dmp
memory/5084-92-0x00000000057F0000-0x00000000057F1000-memory.dmp
memory/5084-93-0x0000000005800000-0x0000000005801000-memory.dmp
memory/5084-94-0x00000000057E0000-0x00000000057E1000-memory.dmp
memory/5084-95-0x0000000005830000-0x0000000005831000-memory.dmp
memory/5084-96-0x00000000057C0000-0x00000000057C1000-memory.dmp
memory/5084-97-0x00000000057D0000-0x00000000057D1000-memory.dmp
memory/5084-438-0x0000000000E70000-0x0000000001318000-memory.dmp
memory/5084-233-0x0000000000E70000-0x0000000001318000-memory.dmp
memory/5084-195-0x0000000000E70000-0x0000000001318000-memory.dmp
memory/5084-230-0x0000000000E70000-0x0000000001318000-memory.dmp
memory/5084-100-0x0000000005840000-0x0000000005841000-memory.dmp
memory/5084-99-0x0000000005850000-0x0000000005851000-memory.dmp
memory/5084-90-0x0000000000E70000-0x0000000001318000-memory.dmp
memory/5084-167-0x0000000000E70000-0x0000000001318000-memory.dmp
memory/5096-32-0x0000000000E30000-0x00000000012D8000-memory.dmp
memory/5096-24-0x00000000056C0000-0x00000000056C1000-memory.dmp
memory/5096-23-0x00000000056A0000-0x00000000056A1000-memory.dmp
memory/5096-25-0x0000000005720000-0x0000000005721000-memory.dmp
memory/5096-26-0x0000000005710000-0x0000000005711000-memory.dmp
memory/5096-22-0x0000000005690000-0x0000000005691000-memory.dmp
memory/5096-21-0x00000000056F0000-0x00000000056F1000-memory.dmp
memory/5096-20-0x00000000056B0000-0x00000000056B1000-memory.dmp
memory/5096-19-0x00000000056D0000-0x00000000056D1000-memory.dmp
memory/5096-18-0x0000000000E30000-0x00000000012D8000-memory.dmp
memory/5096-17-0x00000000779A4000-0x00000000779A6000-memory.dmp
memory/5096-16-0x0000000000E30000-0x00000000012D8000-memory.dmp