Analysis
- max time kernel
31s - max time network
307s - platform
windows10-1703_x64 - resource
win10-20240221-en - resource tags
- submitted
12/03/2024, 04:49
General
- Target 5a6fa11b465317c253d25419ecac2c822656b904b4714baaa009c626978048a6.exe
- Size 283KB
- Sample240312-ffvfasgh3s
- SHA256 5a6fa11b465317c253d25419ecac2c822656b904b4714baaa009c626978048a6
Malware Config
Extracted
-
smokeloader
-
2022
-
http://selebration17io.io/index.php
-
http://vacantion18ffeu.cc/index.php
-
http://valarioulinity1.net/index.php
-
http://buriatiarutuhuob.net/index.php
-
http://cassiosssionunu.me/index.php
-
http://sulugilioiu19.net/index.php
-
http://goodfooggooftool.net/index.php
Extracted
-
amadey
-
4.17
-
http://185.215.113.32
-
install_dir
00c07260dc
-
install_file
explorgu.exe
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Extracted
-
redline
-
LiveTraffic
-
20.218.68.91:7690
Extracted
-
amadey
-
4.17
-
http://185.215.113.32
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Detect ZGRat V1 6 IoCs
- Pitou 1 IoCs
Pitou.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 2 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- ZGRat
ZGRat is remote access trojan written in C#.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Deletes itself 1 IoCs
- Executes dropped EXE 3 IoCs
- Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 1 IoCs
- UPX packed file 15 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
- Enumerates processes with tasklist 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a6fa11b465317c253d25419ecac2c822656b904b4714baaa009c626978048a6.exe"C:\Users\Admin\AppData\Local\Temp\5a6fa11b465317c253d25419ecac2c822656b904b4714baaa009c626978048a6.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\43BB.exeC:\Users\Admin\AppData\Local\Temp\43BB.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exeC:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\1000836001\osminog.exe"C:\Users\Admin\AppData\Local\Temp\1000836001\osminog.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000837001\goldprime123mm.exe"C:\Users\Admin\AppData\Local\Temp\1000837001\goldprime123mm.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main2⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main3⤵
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\360119756166_Desktop.zip' -CompressionLevel Optimal4⤵
-
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1000838001\judith.exe"C:\Users\Admin\AppData\Local\Temp\1000838001\judith.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\onefile_232_133546926823963167\stub.exe"C:\Users\Admin\AppData\Local\Temp\1000838001\judith.exe"3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"4⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name5⤵
- Detects videocard installed
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"4⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get Manufacturer5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "gdb --version"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"4⤵
-
C:\Windows\system32\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000858001\alex12341.exe"C:\Users\Admin\AppData\Local\Temp\1000858001\alex12341.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1000865001\dais.exe"C:\Users\Admin\AppData\Local\Temp\1000865001\dais.exe"2⤵
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\5679.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\5679.dll2⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Roaming\cbgrrvhC:\Users\Admin\AppData\Roaming\cbgrrvh1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\9047.exeC:\Users\Admin\AppData\Local\Temp\9047.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\9047.exeC:\Users\Admin\AppData\Local\Temp\9047.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\6124.exeC:\Users\Admin\AppData\Local\Temp\6124.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7123.exeC:\Users\Admin\AppData\Local\Temp\7123.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\A8FD.exeC:\Users\Admin\AppData\Local\Temp\A8FD.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup_four.exe"C:\Users\Admin\AppData\Local\Temp\InstallSetup_four.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\u42s.0.exe"C:\Users\Admin\AppData\Local\Temp\u42s.0.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\u42s.1.exe"C:\Users\Admin\AppData\Local\Temp\u42s.1.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "4⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12515⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\april.exe"C:\Users\Admin\AppData\Local\Temp\april.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\is-57JMS.tmp\april.tmp"C:\Users\Admin\AppData\Local\Temp\is-57JMS.tmp\april.tmp" /SL5="$30298,1697899,56832,C:\Users\Admin\AppData\Local\Temp\april.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\D28F.exeC:\Users\Admin\AppData\Local\Temp\D28F.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\is-9HMLS.tmp\D28F.tmp"C:\Users\Admin\AppData\Local\Temp\is-9HMLS.tmp\D28F.tmp" /SL5="$A0226,1639144,56832,C:\Users\Admin\AppData\Local\Temp\D28F.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\EA1A.exeC:\Users\Admin\AppData\Local\Temp\EA1A.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
is-FSLQR.tmp
explorgu.exe
osminog.exe
osminog.exe
osminog.exe
goldprime123mm.exe
goldprime123mm.exe
goldprime123mm.exe
judith.exe
judith.exe
alex12341.exe
dais.exe
43BB.exe
cached-microdesc-consensus.tmp
cached-microdescs.new
5679.dll
6124.exe
6124.exe
7123.exe
7123.exe
9047.exe
9047.exe
9047.exe
_ctypes.pyd
_overlapped.pyd
_socket.pyd
_rust.pyd
libcrypto-1_1.dll
libssl-1_1.dll
sqlite3.dll
__PSScriptPolicyTest_trgtzmb4.fs5.ps1
april.exe
_iscrypt.dll
_shfoldr.dll
python310.dll
stub.exe
stub.exe
clip64.dll
cred64.dll
cred64.dll
cbgrrvh
5679.dll
5679.dll
_asyncio.pyd
_bz2.pyd
_cffi_backend.pyd
_lzma.pyd
_sqlite3.pyd
_ssl.pyd
_rust.pyd
libcrypto-1_1.dll
libffi-7.dll
libssl-1_1.dll
select.pyd
sqlite3.dll
python3.dll
python310.dll
vcruntime140.dll
cred64.dll
cred64.dll
memory/1840-317-0x0000000000400000-0x0000000001A77000-memory.dmp
memory/2120-321-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2120-156-0x0000000002E90000-0x0000000002F9F000-memory.dmp
memory/2120-266-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2120-270-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2120-369-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2120-273-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2120-370-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2120-144-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2120-143-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2120-142-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2120-155-0x0000000002E90000-0x0000000002F9F000-memory.dmp
memory/2120-152-0x0000000002E90000-0x0000000002F9F000-memory.dmp
memory/2120-150-0x0000000002D60000-0x0000000002E8B000-memory.dmp
memory/2120-148-0x0000000000A10000-0x0000000000A16000-memory.dmp
memory/2120-145-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2120-140-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2120-137-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2120-207-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2120-135-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2120-303-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2460-79-0x0000000000400000-0x0000000000448000-memory.dmp
memory/2460-75-0x0000000000400000-0x0000000000448000-memory.dmp
memory/2460-94-0x0000000002700000-0x0000000004700000-memory.dmp
memory/2460-95-0x0000000000DC0000-0x0000000000DC1000-memory.dmp
memory/2460-97-0x0000000000400000-0x0000000000448000-memory.dmp
memory/2500-119-0x0000000002400000-0x0000000004400000-memory.dmp
memory/2500-102-0x00000000001B0000-0x000000000023A000-memory.dmp
memory/2500-104-0x00000000722D0000-0x00000000729BE000-memory.dmp
memory/2500-106-0x0000000004A30000-0x0000000004A40000-memory.dmp
memory/2500-179-0x0000000002400000-0x0000000004400000-memory.dmp
memory/2500-113-0x00000000722D0000-0x00000000729BE000-memory.dmp
memory/3048-139-0x0000000002510000-0x00000000026C7000-memory.dmp
memory/3048-138-0x000000000234D000-0x0000000002505000-memory.dmp
memory/3108-127-0x0000000008360000-0x00000000083AB000-memory.dmp
memory/3108-123-0x0000000006B90000-0x0000000007196000-memory.dmp
memory/3108-122-0x00000000722D0000-0x00000000729BE000-memory.dmp
memory/3108-121-0x0000000005790000-0x000000000579A000-memory.dmp
memory/3108-124-0x00000000083F0000-0x00000000084FA000-memory.dmp
memory/3108-125-0x0000000006B60000-0x0000000006B72000-memory.dmp
memory/3108-114-0x0000000005C00000-0x00000000060FE000-memory.dmp
memory/3108-126-0x0000000008320000-0x000000000835E000-memory.dmp
memory/3108-115-0x00000000057A0000-0x0000000005832000-memory.dmp
memory/3108-109-0x0000000000400000-0x0000000000450000-memory.dmp
memory/3108-183-0x00000000722D0000-0x00000000729BE000-memory.dmp
memory/3296-116-0x0000000000AE0000-0x0000000000AF6000-memory.dmp
memory/3296-4-0x0000000000AA0000-0x0000000000AB6000-memory.dmp
memory/4284-100-0x0000000004A40000-0x0000000004B4F000-memory.dmp
memory/4284-105-0x0000000004A40000-0x0000000004B4F000-memory.dmp
memory/4284-46-0x0000000000A20000-0x0000000000A26000-memory.dmp
memory/4284-47-0x0000000010000000-0x00000000102CE000-memory.dmp
memory/4284-74-0x0000000004910000-0x0000000004A3B000-memory.dmp
memory/4284-96-0x0000000004A40000-0x0000000004B4F000-memory.dmp
memory/4400-269-0x0000000000D30000-0x00000000011D8000-memory.dmp
memory/4400-37-0x00000000056A0000-0x00000000056A1000-memory.dmp
memory/4400-271-0x0000000000D30000-0x00000000011D8000-memory.dmp
memory/4400-134-0x0000000000D30000-0x00000000011D8000-memory.dmp
memory/4400-265-0x0000000000D30000-0x00000000011D8000-memory.dmp
memory/4400-50-0x00000000056D0000-0x00000000056D1000-memory.dmp
memory/4400-49-0x00000000056E0000-0x00000000056E1000-memory.dmp
memory/4400-103-0x0000000000D30000-0x00000000011D8000-memory.dmp
memory/4400-128-0x0000000000D30000-0x00000000011D8000-memory.dmp
memory/4400-300-0x0000000000D30000-0x00000000011D8000-memory.dmp
memory/4400-36-0x0000000005690000-0x0000000005691000-memory.dmp
memory/4400-111-0x0000000000D30000-0x00000000011D8000-memory.dmp
memory/4400-38-0x00000000056C0000-0x00000000056C1000-memory.dmp
memory/4400-39-0x0000000005660000-0x0000000005661000-memory.dmp
memory/4400-40-0x0000000005680000-0x0000000005681000-memory.dmp
memory/4400-41-0x0000000005670000-0x0000000005671000-memory.dmp
memory/4400-42-0x00000000056B0000-0x00000000056B1000-memory.dmp
memory/4400-35-0x0000000000D30000-0x00000000011D8000-memory.dmp
memory/4400-34-0x0000000000D30000-0x00000000011D8000-memory.dmp
memory/4400-320-0x0000000000D30000-0x00000000011D8000-memory.dmp
memory/4400-180-0x0000000000D30000-0x00000000011D8000-memory.dmp
memory/4532-304-0x0000000000800000-0x0000000000801000-memory.dmp
memory/4532-120-0x0000000000400000-0x0000000001A33000-memory.dmp
memory/4532-308-0x0000000000840000-0x0000000000841000-memory.dmp
memory/4532-305-0x0000000000820000-0x0000000000821000-memory.dmp
memory/4532-54-0x0000000001DD0000-0x0000000001ED0000-memory.dmp
memory/4532-302-0x00000000007D0000-0x00000000007D1000-memory.dmp
memory/4532-301-0x00000000003F0000-0x00000000003F1000-memory.dmp
memory/4532-295-0x0000000001380000-0x0000000002072000-memory.dmp
memory/4532-55-0x0000000000400000-0x0000000001A33000-memory.dmp
memory/4532-307-0x0000000000830000-0x0000000000831000-memory.dmp
memory/4552-23-0x0000000004E30000-0x0000000004E31000-memory.dmp
memory/4552-25-0x0000000004EA0000-0x0000000004EA1000-memory.dmp
memory/4552-16-0x0000000077704000-0x0000000077705000-memory.dmp
memory/4552-22-0x0000000004E40000-0x0000000004E41000-memory.dmp
memory/4552-17-0x0000000000EE0000-0x0000000001388000-memory.dmp
memory/4552-19-0x0000000004E50000-0x0000000004E51000-memory.dmp
memory/4552-15-0x0000000000EE0000-0x0000000001388000-memory.dmp
memory/4552-18-0x0000000004E60000-0x0000000004E61000-memory.dmp
memory/4552-21-0x0000000004E20000-0x0000000004E21000-memory.dmp
memory/4552-20-0x0000000004E80000-0x0000000004E81000-memory.dmp
memory/4552-24-0x0000000004EB0000-0x0000000004EB1000-memory.dmp
memory/4552-31-0x0000000000EE0000-0x0000000001388000-memory.dmp
memory/4636-2-0x00000000001F0000-0x00000000001FB000-memory.dmp
memory/4636-1-0x0000000001A60000-0x0000000001B60000-memory.dmp
memory/4636-3-0x0000000000400000-0x0000000001A33000-memory.dmp
memory/4636-5-0x0000000000400000-0x0000000001A33000-memory.dmp
memory/4864-70-0x00000000724A0000-0x0000000072B8E000-memory.dmp
memory/4864-69-0x0000000000490000-0x00000000004E6000-memory.dmp
memory/4864-73-0x0000000004C50000-0x0000000004C60000-memory.dmp
memory/4864-80-0x00000000724A0000-0x0000000072B8E000-memory.dmp
memory/4864-90-0x0000000002700000-0x0000000004700000-memory.dmp
memory/4864-141-0x0000000002700000-0x0000000004700000-memory.dmp
memory/5108-177-0x0000018235A60000-0x0000018235A82000-memory.dmp
memory/5108-182-0x0000018235D90000-0x0000018235E06000-memory.dmp
memory/5108-197-0x0000018235B00000-0x0000018235B10000-memory.dmp
memory/5108-196-0x00007FFA30E30000-0x00007FFA3181C000-memory.dmp