Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14-03-2024 11:38
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20240226-en
General
-
Target
tmp.exe
-
Size
284KB
-
MD5
e3dc222d0a34c4b230f538a67bb7265d
-
SHA1
d88345aef0e59341e6c4297d2685cb5f08c0aa80
-
SHA256
a7f605d4110bba430e02c7c5240e656fb3f1dd7f02dce985e9e5677169c9de55
-
SHA512
3d775c3c940ddd3d43fa56726ae4f8c0442a4d576cb410e60e2f010e1ff6273a2064f646c6af4a6993ff78924c329ac821811f97402d1472495c1d7a6d838797
-
SSDEEP
6144:ukXNoFja9QXwKN1NdR7ws5lDohIiTXcnXzrCZemJPg1ZVzqH:jiFWUtXjDojODrXeIBze
Malware Config
Extracted
smokeloader
2022
http://glueberry-og.cc/
http://glueberry-og.co/
http://glueberry-og.to/
Signatures
-
PureLog Stealer
PureLog Stealer is an infostealer written in C#.
-
PureLog Stealer payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2960-2-0x00000000020F0000-0x000000000213A000-memory.dmp family_purelog_stealer behavioral1/memory/2960-3-0x00000000005A0000-0x00000000005E0000-memory.dmp family_purelog_stealer -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 1 IoCs
Processes:
ctrrjucpid process 2720 ctrrjuc -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
tmp.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\SOCKET5 = "C:\\Users\\Admin\\AppData\\Roaming\\SOCKET5.exe" tmp.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
tmp.exedescription pid process target process PID 2960 set thread context of 2524 2960 tmp.exe RegAsm.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
RegAsm.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI RegAsm.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
RegAsm.exepid process 2524 RegAsm.exe 2524 RegAsm.exe 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
RegAsm.exepid process 2524 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
tmp.exedescription pid process Token: SeDebugPrivilege 2960 tmp.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
tmp.exetaskeng.exedescription pid process target process PID 2960 wrote to memory of 2524 2960 tmp.exe RegAsm.exe PID 2960 wrote to memory of 2524 2960 tmp.exe RegAsm.exe PID 2960 wrote to memory of 2524 2960 tmp.exe RegAsm.exe PID 2960 wrote to memory of 2524 2960 tmp.exe RegAsm.exe PID 2960 wrote to memory of 2524 2960 tmp.exe RegAsm.exe PID 2960 wrote to memory of 2524 2960 tmp.exe RegAsm.exe PID 2960 wrote to memory of 2524 2960 tmp.exe RegAsm.exe PID 2960 wrote to memory of 2524 2960 tmp.exe RegAsm.exe PID 2960 wrote to memory of 2524 2960 tmp.exe RegAsm.exe PID 2960 wrote to memory of 2524 2960 tmp.exe RegAsm.exe PID 2488 wrote to memory of 2720 2488 taskeng.exe ctrrjuc PID 2488 wrote to memory of 2720 2488 taskeng.exe ctrrjuc PID 2488 wrote to memory of 2720 2488 taskeng.exe ctrrjuc PID 2488 wrote to memory of 2720 2488 taskeng.exe ctrrjuc -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2524
-
C:\Windows\system32\taskeng.exetaskeng.exe {2F09EC9D-644E-471E-8DD9-E99ABEA9AE1F} S-1-5-21-3452737119-3959686427-228443150-1000:QGTQZTRE\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Roaming\ctrrjucC:\Users\Admin\AppData\Roaming\ctrrjuc2⤵
- Executes dropped EXE
PID:2720
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
63KB
MD5b58b926c3574d28d5b7fdd2ca3ec30d5
SHA1d260c4ffd603a9cfc057fcb83d678b1cecdf86f9
SHA2566e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3
SHA512b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab