Analysis
- max time kernel
141s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
17/03/2024, 01:32
General
- Target SecuriteInfo.com.Win32.BotX-gen.3892.8628.exe
- Size 208KB
- Sample240317-bxyrtsbc39
- SHA256 81e2a48aed2eb0f524947c8c002f753c1c66583602cf505c7f3adac1aeff1df5
Malware Config
Extracted
-
smokeloader
-
2022
-
http://selebration17io.io/index.php
-
http://vacantion18ffeu.cc/index.php
-
http://valarioulinity1.net/index.php
-
http://buriatiarutuhuob.net/index.php
-
http://cassiosssionunu.me/index.php
-
http://sulugilioiu19.net/index.php
-
http://goodfooggooftool.net/index.php
-
http://nidoe.org/tmp/index.php
-
http://sodez.ru/tmp/index.php
-
http://uama.com.ua/tmp/index.php
-
http://talesofpirates.net/tmp/index.php
Extracted
-
smokeloader
-
pub1
Extracted
-
stealc
-
http://185.172.128.145
-
url_path
/3cd2b41cbde8fc9c.php
Extracted
-
lumma
-
https://herdbescuitinjurywu.shop/api
-
https://colorfulequalugliess.shop/api
Signatures
- DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Glupteba
Glupteba is a modular loader written in Golang with various components.
- Glupteba payload 6 IoCs
- Lumma Stealer
An infostealer written in C++ first seen in August 2022.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Stealc
Stealc is an infostealer written in C++.
- Downloads MZ/PE file
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Deletes itself 1 IoCs
- Executes dropped EXE 18 IoCs
- Loads dropped DLL 6 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 6 IoCs
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies data under HKEY_USERS 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 38 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.BotX-gen.3892.8628.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.BotX-gen.3892.8628.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\26EC.exeC:\Users\Admin\AppData\Local\Temp\26EC.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 3883⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 10483⤵
- Program crash
-
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\8568.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\8568.dll2⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\BB6D.exeC:\Users\Admin\AppData\Local\Temp\BB6D.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup_four.exe"C:\Users\Admin\AppData\Local\Temp\InstallSetup_four.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\u384.0.exe"C:\Users\Admin\AppData\Local\Temp\u384.0.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\JKKFIIEBKE.exe"4⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 24364⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\u384.1.exe"C:\Users\Admin\AppData\Local\Temp\u384.1.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "4⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12515⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F5⤵
- Creates scheduled task(s)
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4180 -s 15843⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"3⤵
- Executes dropped EXE
- Checks for VirtualBox DLLs, possible anti-VM trick
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"4⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes5⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\april.exe"C:\Users\Admin\AppData\Local\Temp\april.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-JBQGN.tmp\april.tmp"C:\Users\Admin\AppData\Local\Temp\is-JBQGN.tmp\april.tmp" /SL5="$C0120,1478464,54272,C:\Users\Admin\AppData\Local\Temp\april.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Text Ultra Edit\textultraedit.exe"C:\Users\Admin\AppData\Local\Text Ultra Edit\textultraedit.exe" -i4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Text Ultra Edit\textultraedit.exe"C:\Users\Admin\AppData\Local\Text Ultra Edit\textultraedit.exe" -s4⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\DC45.exeC:\Users\Admin\AppData\Local\Temp\DC45.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\EA6F.exeC:\Users\Admin\AppData\Local\Temp\EA6F.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-OUH3A.tmp\EA6F.tmp"C:\Users\Admin\AppData\Local\Temp\is-OUH3A.tmp\EA6F.tmp" /SL5="$7020A,2096861,54272,C:\Users\Admin\AppData\Local\Temp\EA6F.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Kimoto IDE Plus\kimotoideplus.exe"C:\Users\Admin\AppData\Local\Kimoto IDE Plus\kimotoideplus.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Kimoto IDE Plus\kimotoideplus.exe"C:\Users\Admin\AppData\Local\Kimoto IDE Plus\kimotoideplus.exe" -s3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4424 -ip 44241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4424 -ip 44241⤵
-
C:\Users\Admin\AppData\Local\Temp\48F.exeC:\Users\Admin\AppData\Local\Temp\48F.exe1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4180 -ip 41801⤵
-
C:\Users\Admin\AppData\Local\Temp\8588.exeC:\Users\Admin\AppData\Local\Temp\8588.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 11002⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 10722⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1924 -ip 19241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1924 -ip 19241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1508 -ip 15081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1924 -ip 19241⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
Are.docx
mozglue.dll
nss3.dll
is-0UBE6.tmp
kimotoideplus.exe
kimotoideplus.exe
kimotoideplus.exe
26EC.exe
288c47bbc1871b439df19ff4df68f076.exe
288c47bbc1871b439df19ff4df68f076.exe
288c47bbc1871b439df19ff4df68f076.exe
288c47bbc1871b439df19ff4df68f076.exe
48F.exe
8568.dll
8568.dll
8588.exe
BB6D.exe
DC45.exe
EA6F.exe
EA6F.exe
InstallSetup_four.exe
Protect544cd51a.dll
__PSScriptPolicyTest_xas000s0.cw0.ps1
april.exe
april.tmp
_iscrypt.dll
EA6F.tmp
EA6F.tmp
_shfoldr.dll
u384.0.exe
u384.1.exe
textultraedit.exe
Task.bat
powershell.exe.log
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
memory/404-5-0x0000000000400000-0x0000000000474000-memory.dmp
memory/404-1-0x0000000000630000-0x0000000000730000-memory.dmp
memory/404-3-0x0000000000400000-0x0000000000474000-memory.dmp
memory/404-2-0x00000000005E0000-0x00000000005EB000-memory.dmp
memory/496-182-0x0000000000400000-0x0000000000414000-memory.dmp
memory/496-91-0x0000000000400000-0x0000000000414000-memory.dmp
memory/1136-252-0x0000000000400000-0x0000000000930000-memory.dmp
memory/1136-253-0x0000000000BF0000-0x0000000000BF1000-memory.dmp
memory/1136-339-0x0000000000400000-0x0000000000930000-memory.dmp
memory/1184-63-0x0000000075260000-0x0000000075A10000-memory.dmp
memory/1184-30-0x0000000075260000-0x0000000075A10000-memory.dmp
memory/1184-38-0x0000000005580000-0x0000000005712000-memory.dmp
memory/1184-44-0x0000000005570000-0x0000000005580000-memory.dmp
memory/1184-45-0x0000000005990000-0x00000000059A0000-memory.dmp
memory/1184-49-0x0000000005570000-0x0000000005580000-memory.dmp
memory/1184-17-0x0000000005130000-0x00000000051CC000-memory.dmp
memory/1184-46-0x0000000005570000-0x0000000005580000-memory.dmp
memory/1184-16-0x0000000000270000-0x0000000000746000-memory.dmp
memory/1184-15-0x0000000075260000-0x0000000075A10000-memory.dmp
memory/1184-47-0x0000000005570000-0x0000000005580000-memory.dmp
memory/1184-48-0x0000000005570000-0x0000000005580000-memory.dmp
memory/1184-52-0x0000000005A80000-0x0000000005B80000-memory.dmp
memory/1184-51-0x0000000005A80000-0x0000000005B80000-memory.dmp
memory/1184-50-0x0000000005570000-0x0000000005580000-memory.dmp
memory/1508-266-0x0000000000400000-0x000000000063B000-memory.dmp
memory/1508-261-0x0000000000400000-0x000000000063B000-memory.dmp
memory/1508-264-0x0000000000950000-0x0000000000A50000-memory.dmp
memory/1508-294-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/1508-265-0x00000000008C0000-0x00000000008E7000-memory.dmp
memory/2504-222-0x0000000000400000-0x0000000000667000-memory.dmp
memory/2504-217-0x0000000000400000-0x0000000000667000-memory.dmp
memory/2600-259-0x0000000000400000-0x00000000004B8000-memory.dmp
memory/2600-263-0x00000000020D0000-0x00000000020D1000-memory.dmp
memory/2600-167-0x00000000020D0000-0x00000000020D1000-memory.dmp
memory/2792-35-0x0000000000790000-0x0000000000DD4000-memory.dmp
memory/2792-36-0x0000000075260000-0x0000000075A10000-memory.dmp
memory/2792-92-0x0000000075260000-0x0000000075A10000-memory.dmp
memory/2844-212-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/2844-221-0x0000000002A70000-0x0000000002E74000-memory.dmp
memory/2844-122-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/2844-116-0x0000000002E80000-0x000000000376B000-memory.dmp
memory/2844-268-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/2844-226-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/2844-224-0x0000000002E80000-0x000000000376B000-memory.dmp
memory/2844-115-0x0000000002A70000-0x0000000002E74000-memory.dmp
memory/3420-4-0x0000000002AE0000-0x0000000002AF6000-memory.dmp
memory/3420-230-0x0000000002800000-0x0000000002816000-memory.dmp
memory/3488-24-0x00000000027D0000-0x0000000002910000-memory.dmp
memory/3488-21-0x0000000002670000-0x0000000002676000-memory.dmp
memory/3488-22-0x0000000010000000-0x00000000102F2000-memory.dmp
memory/3488-28-0x0000000002920000-0x0000000002A42000-memory.dmp
memory/3488-25-0x0000000002920000-0x0000000002A42000-memory.dmp
memory/3488-29-0x0000000002920000-0x0000000002A42000-memory.dmp
memory/4180-111-0x0000000000520000-0x0000000000620000-memory.dmp
memory/4180-113-0x0000000000400000-0x00000000004A5000-memory.dmp
memory/4180-190-0x0000000000400000-0x00000000004A5000-memory.dmp
memory/4180-218-0x0000000000520000-0x0000000000620000-memory.dmp
memory/4180-254-0x0000000000400000-0x00000000004A5000-memory.dmp
memory/4180-112-0x0000000002110000-0x0000000002177000-memory.dmp
memory/4212-186-0x0000000000720000-0x0000000000721000-memory.dmp
memory/4212-215-0x0000000000400000-0x00000000004B8000-memory.dmp
memory/4212-102-0x0000000000720000-0x0000000000721000-memory.dmp
memory/4348-227-0x0000000000400000-0x0000000000667000-memory.dmp
memory/4348-292-0x0000000000400000-0x0000000000667000-memory.dmp
memory/4356-240-0x00000000035A0000-0x000000000360B000-memory.dmp
memory/4356-239-0x0000000000400000-0x0000000001A77000-memory.dmp
memory/4356-238-0x0000000001D00000-0x0000000001E00000-memory.dmp
memory/4356-336-0x0000000000400000-0x0000000001A77000-memory.dmp
memory/4412-270-0x00000000051F0000-0x0000000005226000-memory.dmp
memory/4424-59-0x0000000000400000-0x000000000044B000-memory.dmp
memory/4424-62-0x0000000000400000-0x000000000044B000-memory.dmp
memory/4424-61-0x0000000001440000-0x0000000001441000-memory.dmp
memory/4424-65-0x0000000001440000-0x0000000001441000-memory.dmp
memory/4424-64-0x0000000001440000-0x0000000001441000-memory.dmp
memory/4424-66-0x0000000001440000-0x0000000001441000-memory.dmp
memory/4424-163-0x0000000000400000-0x000000000044B000-memory.dmp
memory/4424-53-0x0000000000400000-0x000000000044B000-memory.dmp
memory/4424-161-0x0000000001440000-0x0000000001441000-memory.dmp
memory/4456-189-0x0000000000400000-0x0000000000474000-memory.dmp
memory/4456-187-0x0000000000750000-0x0000000000850000-memory.dmp
memory/4456-188-0x00000000005D0000-0x00000000005DB000-memory.dmp
memory/4456-235-0x0000000000400000-0x0000000000474000-memory.dmp
memory/4600-155-0x0000000000400000-0x00000000005AA000-memory.dmp
memory/4600-152-0x0000000000400000-0x00000000005AA000-memory.dmp
memory/4600-143-0x0000000000400000-0x00000000005AA000-memory.dmp
memory/4884-150-0x0000000000400000-0x0000000000414000-memory.dmp
memory/4884-237-0x0000000000400000-0x0000000000414000-memory.dmp
memory/5012-183-0x0000000000400000-0x00000000005AA000-memory.dmp
memory/5012-166-0x0000000000400000-0x00000000005AA000-memory.dmp
memory/5012-262-0x0000000000400000-0x00000000005AA000-memory.dmp
memory/5012-260-0x0000000000400000-0x00000000005AA000-memory.dmp