Analysis
- max time kernel
150s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20240221-en - resource tags
- submitted
26/03/2024, 20:12
General
- Target ea04271a88d3b5cc08e2d4aed3a720aaea145a0fbf0f35e47147afc0be11e543.exe
- Size 1.8MB
- Sample240326-yy7sfsec2t
- SHA256 ea04271a88d3b5cc08e2d4aed3a720aaea145a0fbf0f35e47147afc0be11e543
Malware Config
Extracted
-
amadey
-
4.17
-
http://185.215.113.32
-
install_dir
00c07260dc
-
install_file
explorgu.exe
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Extracted
-
redline
-
LiveTraffic
-
4.185.137.132:1632
Extracted
-
redline
-
@OLEH_PSP
-
185.172.128.33:8970
Extracted
-
amadey
-
4.17
-
http://185.215.113.32
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Extracted
-
smokeloader
-
2022
-
http://selebration17io.io/index.php
-
http://vacantion18ffeu.cc/index.php
-
http://valarioulinity1.net/index.php
-
http://buriatiarutuhuob.net/index.php
-
http://cassiosssionunu.me/index.php
-
http://sulugilioiu19.net/index.php
-
http://goodfooggooftool.net/index.php
-
http://trad-einmyus.com/index.php
-
http://tradein-myus.com/index.php
-
http://trade-inmyus.com/index.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Detect ZGRat V1 6 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 9 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- ZGRat
ZGRat is remote access trojan written in C#.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
- Blocklisted process makes network request 4 IoCs
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 16 IoCs
- Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 6 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies system certificate store 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 55 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea04271a88d3b5cc08e2d4aed3a720aaea145a0fbf0f35e47147afc0be11e543.exe"C:\Users\Admin\AppData\Local\Temp\ea04271a88d3b5cc08e2d4aed3a720aaea145a0fbf0f35e47147afc0be11e543.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exeC:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000837001\goldprimeldlldf.exe"C:\Users\Admin\AppData\Local\Temp\1000837001\goldprimeldlldf.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000979001\TeamFour.exe"C:\Users\Admin\AppData\Local\Temp\1000979001\TeamFour.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe"C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"4⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 35⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000986001\987123.exe"C:\Users\Admin\AppData\Local\Temp\1000986001\987123.exe"2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\930051783255_Desktop.zip' -CompressionLevel Optimal4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1001008001\lummalg.exe"C:\Users\Admin\AppData\Local\Temp\1001008001\lummalg.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1001022001\chckik.exe"C:\Users\Admin\AppData\Local\Temp\1001022001\chckik.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\1001025001\mk.exe"C:\Users\Admin\AppData\Local\Temp\1001025001\mk.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main2⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exe"C:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exe" /F3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\1000181001\toolspub1.exe"C:\Users\Admin\AppData\Local\Temp\1000181001\toolspub1.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exeC:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main2⤵
- Loads dropped DLL
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\930051783255_Desktop.zip' -CompressionLevel Optimal4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main2⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\87F8.bat" "1⤵
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\D9C2.exeC:\Users\Admin\AppData\Local\Temp\D9C2.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
explorgu.exe
amadka.exe
toolspub1.exe
osminog.exe
goldprimeldlldf.exe
TeamFour.exe
TeamFour.exe
alex1234.exe
alex1234.exe
alex1234.exe
987123.exe
lummalg.exe
chckik.exe
mk.exe
amadka111.exe
NewB.exe
87F8.bat
D9C2.exe
__PSScriptPolicyTest_sbxl0ivz.z4w.ps1
clip64.dll
cred64.dll
clip64.dll
cred64.dll
Traffic.exe
propro.exe
memory/1368-453-0x0000000000EA0000-0x0000000001237000-memory.dmp
memory/1868-264-0x0000000000400000-0x000000000044A000-memory.dmp
memory/1868-267-0x0000000000400000-0x000000000044A000-memory.dmp
memory/2024-154-0x00000000052F0000-0x0000000005300000-memory.dmp
memory/2024-153-0x00000000736B0000-0x0000000073E61000-memory.dmp
memory/2024-146-0x0000000000400000-0x0000000000592000-memory.dmp
memory/2076-295-0x0000000000400000-0x0000000002D4D000-memory.dmp
memory/2916-151-0x00000000736B0000-0x0000000073E61000-memory.dmp
memory/2916-152-0x0000000003380000-0x0000000005380000-memory.dmp
memory/2916-141-0x0000000000F30000-0x00000000010EC000-memory.dmp
memory/2916-142-0x00000000736B0000-0x0000000073E61000-memory.dmp
memory/3060-115-0x000000001E650000-0x000000001E812000-memory.dmp
memory/3060-113-0x000000001C4A0000-0x000000001C4BE000-memory.dmp
memory/3060-143-0x000000001B660000-0x000000001B670000-memory.dmp
memory/3060-104-0x000000001B660000-0x000000001B670000-memory.dmp
memory/3060-103-0x00007FFD649A0000-0x00007FFD65462000-memory.dmp
memory/3060-101-0x0000000000860000-0x00000000008EC000-memory.dmp
memory/3060-130-0x00007FFD649A0000-0x00007FFD65462000-memory.dmp
memory/3060-176-0x000000001B660000-0x000000001B670000-memory.dmp
memory/3060-116-0x000000001ED50000-0x000000001F278000-memory.dmp
memory/3060-114-0x000000001B660000-0x000000001B670000-memory.dmp
memory/3060-108-0x000000001DBF0000-0x000000001DCFA000-memory.dmp
memory/3060-109-0x000000001B8C0000-0x000000001B8D2000-memory.dmp
memory/3060-110-0x000000001C440000-0x000000001C47C000-memory.dmp
memory/3060-111-0x000000001B660000-0x000000001B670000-memory.dmp
memory/3060-112-0x000000001E000000-0x000000001E076000-memory.dmp
memory/3164-117-0x0000000002480000-0x0000000004480000-memory.dmp
memory/3164-54-0x0000000000070000-0x00000000000EA000-memory.dmp
memory/3164-56-0x00000000049B0000-0x00000000049C0000-memory.dmp
memory/3164-55-0x00000000736B0000-0x0000000073E61000-memory.dmp
memory/3164-62-0x00000000736B0000-0x0000000073E61000-memory.dmp
memory/3164-65-0x0000000002480000-0x0000000004480000-memory.dmp
memory/3320-413-0x0000000003910000-0x0000000003926000-memory.dmp
memory/3320-293-0x0000000003330000-0x0000000003346000-memory.dmp
memory/4492-77-0x0000000006DE0000-0x00000000073F8000-memory.dmp
memory/4492-75-0x0000000005740000-0x000000000574A000-memory.dmp
memory/4492-79-0x0000000006CA0000-0x0000000006CB2000-memory.dmp
memory/4492-107-0x0000000006830000-0x0000000006896000-memory.dmp
memory/4492-74-0x00000000736B0000-0x0000000073E61000-memory.dmp
memory/4492-76-0x00000000030E0000-0x00000000030F0000-memory.dmp
memory/4492-80-0x0000000006D00000-0x0000000006D3C000-memory.dmp
memory/4492-81-0x0000000006D50000-0x0000000006D9C000-memory.dmp
memory/4492-64-0x0000000005690000-0x0000000005722000-memory.dmp
memory/4492-120-0x00000000030E0000-0x00000000030F0000-memory.dmp
memory/4492-63-0x0000000005C40000-0x00000000061E6000-memory.dmp
memory/4492-119-0x00000000736B0000-0x0000000073E61000-memory.dmp
memory/4492-59-0x0000000000400000-0x0000000000450000-memory.dmp
memory/4492-78-0x00000000085A0000-0x00000000086AA000-memory.dmp
memory/4608-10-0x00000000050C0000-0x00000000050C1000-memory.dmp
memory/4608-6-0x0000000005050000-0x0000000005051000-memory.dmp
memory/4608-1-0x0000000077CF6000-0x0000000077CF8000-memory.dmp
memory/4608-2-0x0000000000C40000-0x0000000001108000-memory.dmp
memory/4608-0-0x0000000000C40000-0x0000000001108000-memory.dmp
memory/4608-3-0x0000000005080000-0x0000000005081000-memory.dmp
memory/4608-4-0x0000000005070000-0x0000000005071000-memory.dmp
memory/4608-5-0x00000000050B0000-0x00000000050B1000-memory.dmp
memory/4608-7-0x0000000005060000-0x0000000005061000-memory.dmp
memory/4608-8-0x0000000005090000-0x0000000005091000-memory.dmp
memory/4608-9-0x00000000050D0000-0x00000000050D1000-memory.dmp
memory/4608-15-0x0000000000C40000-0x0000000001108000-memory.dmp
memory/4896-24-0x00000000054E0000-0x00000000054E1000-memory.dmp
memory/4896-488-0x00000000000B0000-0x0000000000578000-memory.dmp
memory/4896-19-0x00000000000B0000-0x0000000000578000-memory.dmp
memory/4896-350-0x00000000000B0000-0x0000000000578000-memory.dmp
memory/4896-18-0x00000000000B0000-0x0000000000578000-memory.dmp
memory/4896-106-0x00000000000B0000-0x0000000000578000-memory.dmp
memory/4896-105-0x00000000000B0000-0x0000000000578000-memory.dmp
memory/4896-20-0x0000000005510000-0x0000000005511000-memory.dmp
memory/4896-412-0x00000000000B0000-0x0000000000578000-memory.dmp
memory/4896-102-0x00000000000B0000-0x0000000000578000-memory.dmp
memory/4896-490-0x00000000000B0000-0x0000000000578000-memory.dmp
memory/4896-432-0x00000000000B0000-0x0000000000578000-memory.dmp
memory/4896-21-0x0000000005520000-0x0000000005521000-memory.dmp
memory/4896-22-0x0000000005500000-0x0000000005501000-memory.dmp
memory/4896-421-0x00000000000B0000-0x0000000000578000-memory.dmp
memory/4896-436-0x00000000000B0000-0x0000000000578000-memory.dmp
memory/4896-431-0x00000000000B0000-0x0000000000578000-memory.dmp
memory/4896-23-0x0000000005540000-0x0000000005541000-memory.dmp
memory/4896-260-0x00000000000B0000-0x0000000000578000-memory.dmp
memory/4896-25-0x00000000054F0000-0x00000000054F1000-memory.dmp
memory/4896-26-0x0000000005560000-0x0000000005561000-memory.dmp
memory/4896-475-0x00000000000B0000-0x0000000000578000-memory.dmp
memory/4896-118-0x00000000000B0000-0x0000000000578000-memory.dmp
memory/4896-487-0x00000000000B0000-0x0000000000578000-memory.dmp
memory/4928-173-0x00000000736B0000-0x0000000073E61000-memory.dmp
memory/4928-174-0x0000000000330000-0x0000000000382000-memory.dmp
memory/4932-415-0x0000000000400000-0x0000000000AF5000-memory.dmp