Analysis
- max time kernel
158s - max time network
172s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
27/03/2024, 01:00
General
- Target b40c2a59483a325f19f496001775300f71e2eb5d1df1da5f2d182ad26520dc4e.exe
- Size 1.8MB
- Sample240327-bcn2wsbd6t
- SHA256 b40c2a59483a325f19f496001775300f71e2eb5d1df1da5f2d182ad26520dc4e
Malware Config
Extracted
-
amadey
-
4.17
-
http://185.215.113.32
-
install_dir
00c07260dc
-
install_file
explorgu.exe
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Extracted
-
amadey
-
4.17
-
http://185.215.113.32
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Extracted
-
redline
-
LiveTraffic
-
4.185.137.132:1632
Extracted
-
redline
-
@OLEH_PSP
-
185.172.128.33:8970
Extracted
-
smokeloader
-
2022
-
http://selebration17io.io/index.php
-
http://vacantion18ffeu.cc/index.php
-
http://valarioulinity1.net/index.php
-
http://buriatiarutuhuob.net/index.php
-
http://cassiosssionunu.me/index.php
-
http://sulugilioiu19.net/index.php
-
http://goodfooggooftool.net/index.php
-
http://trad-einmyus.com/index.php
-
http://tradein-myus.com/index.php
-
http://trade-inmyus.com/index.php
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Detect ZGRat V1 5 IoCs
- Glupteba
Glupteba is a modular loader written in Golang with various components.
- Glupteba payload 2 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 5 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- ZGRat
ZGRat is remote access trojan written in C#.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
- Blocklisted process makes network request 2 IoCs
- Downloads MZ/PE file
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 11 IoCs
- Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 3 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies data under HKEY_USERS 64 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 26 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b40c2a59483a325f19f496001775300f71e2eb5d1df1da5f2d182ad26520dc4e.exe"C:\Users\Admin\AppData\Local\Temp\b40c2a59483a325f19f496001775300f71e2eb5d1df1da5f2d182ad26520dc4e.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exeC:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000837001\goldprimeldlldf.exe"C:\Users\Admin\AppData\Local\Temp\1000837001\goldprimeldlldf.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\134859772495_Desktop.zip' -CompressionLevel Optimal4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main2⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe"C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000986001\987123.exe"C:\Users\Admin\AppData\Local\Temp\1000986001\987123.exe"2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\1001022001\chckik.exe"C:\Users\Admin\AppData\Local\Temp\1001022001\chckik.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exe"C:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exe" /F3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\1000181001\toolspub1.exe"C:\Users\Admin\AppData\Local\Temp\1000181001\toolspub1.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\1000182001\4767d2e713f2021e8fe856e3ea638b58.exe"C:\Users\Admin\AppData\Local\Temp\1000182001\4767d2e713f2021e8fe856e3ea638b58.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\1000182001\4767d2e713f2021e8fe856e3ea638b58.exe"C:\Users\Admin\AppData\Local\Temp\1000182001\4767d2e713f2021e8fe856e3ea638b58.exe"4⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\E601.bat" "1⤵
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 12⤵
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
explorgu.exe
toolspub1.exe
4767d2e713f2021e8fe856e3ea638b58.exe
4767d2e713f2021e8fe856e3ea638b58.exe
osminog.exe
goldprimeldlldf.exe
alex1234.exe
alex1234.exe
987123.exe
chckik.exe
amadka111.exe
NewB.exe
E601.bat
Tmp2BC9.tmp
__PSScriptPolicyTest_5entpywy.htk.ps1
clip64.dll
cred64.dll
cred64.dll
Traffic.exe
propro.exe
memory/776-65-0x0000000072BD0000-0x0000000073380000-memory.dmp
memory/776-79-0x0000000005060000-0x0000000005070000-memory.dmp
memory/776-64-0x0000000000530000-0x00000000005AA000-memory.dmp
memory/776-103-0x0000000072BD0000-0x0000000073380000-memory.dmp
memory/776-99-0x0000000002A60000-0x0000000004A60000-memory.dmp
memory/776-97-0x0000000072BD0000-0x0000000073380000-memory.dmp
memory/1644-225-0x0000022D95410000-0x0000022D95420000-memory.dmp
memory/1644-224-0x0000022D95410000-0x0000022D95420000-memory.dmp
memory/1644-235-0x0000022DAD760000-0x0000022DAD782000-memory.dmp
memory/1660-194-0x00007FFA60F00000-0x00007FFA619C1000-memory.dmp
memory/1660-193-0x0000000000E40000-0x0000000000ECC000-memory.dmp
memory/1660-199-0x000000001BBE0000-0x000000001BBF0000-memory.dmp
memory/1664-136-0x0000000004FB0000-0x0000000004FC0000-memory.dmp
memory/1664-129-0x0000000000400000-0x0000000000592000-memory.dmp
memory/1664-198-0x0000000072BD0000-0x0000000073380000-memory.dmp
memory/1664-220-0x0000000004FB0000-0x0000000004FC0000-memory.dmp
memory/1664-134-0x0000000072BD0000-0x0000000073380000-memory.dmp
memory/1908-104-0x00000000006B0000-0x0000000000B6C000-memory.dmp
memory/1908-66-0x00000000006B0000-0x0000000000B6C000-memory.dmp
memory/1908-28-0x00000000050D0000-0x00000000050D1000-memory.dmp
memory/1908-405-0x00000000006B0000-0x0000000000B6C000-memory.dmp
memory/1908-27-0x00000000050E0000-0x00000000050E1000-memory.dmp
memory/1908-21-0x0000000005090000-0x0000000005091000-memory.dmp
memory/1908-26-0x00000000050B0000-0x00000000050B1000-memory.dmp
memory/1908-25-0x0000000005060000-0x0000000005061000-memory.dmp
memory/1908-22-0x0000000005070000-0x0000000005071000-memory.dmp
memory/1908-20-0x0000000005080000-0x0000000005081000-memory.dmp
memory/1908-80-0x00000000006B0000-0x0000000000B6C000-memory.dmp
memory/1908-24-0x0000000005050000-0x0000000005051000-memory.dmp
memory/1908-19-0x00000000006B0000-0x0000000000B6C000-memory.dmp
memory/1908-23-0x00000000050C0000-0x00000000050C1000-memory.dmp
memory/1908-76-0x00000000006B0000-0x0000000000B6C000-memory.dmp
memory/1908-135-0x00000000006B0000-0x0000000000B6C000-memory.dmp
memory/1908-353-0x00000000006B0000-0x0000000000B6C000-memory.dmp
memory/1908-413-0x00000000006B0000-0x0000000000B6C000-memory.dmp
memory/1908-339-0x00000000006B0000-0x0000000000B6C000-memory.dmp
memory/1908-286-0x00000000006B0000-0x0000000000B6C000-memory.dmp
memory/1908-142-0x00000000006B0000-0x0000000000B6C000-memory.dmp
memory/1908-78-0x00000000006B0000-0x0000000000B6C000-memory.dmp
memory/1908-77-0x00000000006B0000-0x0000000000B6C000-memory.dmp
memory/1908-18-0x00000000006B0000-0x0000000000B6C000-memory.dmp
memory/2332-343-0x0000000000400000-0x0000000000AF7000-memory.dmp
memory/2508-170-0x0000000072BD0000-0x0000000073380000-memory.dmp
memory/2508-172-0x0000000000C00000-0x0000000000C52000-memory.dmp
memory/2508-195-0x0000000006AA0000-0x0000000006ABE000-memory.dmp
memory/2508-174-0x0000000005800000-0x0000000005810000-memory.dmp
memory/2508-191-0x0000000006150000-0x00000000061C6000-memory.dmp
memory/2724-133-0x0000000072BD0000-0x0000000073380000-memory.dmp
memory/2724-132-0x0000000003310000-0x0000000005310000-memory.dmp
memory/2724-126-0x0000000001990000-0x00000000019A0000-memory.dmp
memory/2724-125-0x0000000072BD0000-0x0000000073380000-memory.dmp
memory/2724-124-0x0000000000E70000-0x000000000102C000-memory.dmp
memory/2748-9-0x0000000004E60000-0x0000000004E61000-memory.dmp
memory/2748-5-0x0000000004DF0000-0x0000000004DF1000-memory.dmp
memory/2748-6-0x0000000004E30000-0x0000000004E31000-memory.dmp
memory/2748-1-0x0000000076FC4000-0x0000000076FC6000-memory.dmp
memory/2748-8-0x0000000004DE0000-0x0000000004DE1000-memory.dmp
memory/2748-0-0x0000000000D20000-0x00000000011DC000-memory.dmp
memory/2748-2-0x0000000000D20000-0x00000000011DC000-memory.dmp
memory/2748-7-0x0000000004DD0000-0x0000000004DD1000-memory.dmp
memory/2748-3-0x0000000004E00000-0x0000000004E01000-memory.dmp
memory/2748-4-0x0000000004E10000-0x0000000004E11000-memory.dmp
memory/2748-15-0x0000000000D20000-0x00000000011DC000-memory.dmp
memory/2748-10-0x0000000004E50000-0x0000000004E51000-memory.dmp
memory/3496-406-0x0000000000400000-0x0000000000EDA000-memory.dmp
memory/3496-426-0x0000000000400000-0x0000000000EDA000-memory.dmp
memory/3500-341-0x0000000002560000-0x0000000002576000-memory.dmp
memory/3500-262-0x00000000028F0000-0x0000000002906000-memory.dmp
memory/3552-221-0x0000000002F40000-0x0000000003040000-memory.dmp
memory/3552-223-0x0000000000400000-0x0000000002D4D000-memory.dmp
memory/3552-222-0x0000000002D90000-0x0000000002D9B000-memory.dmp
memory/3552-266-0x0000000000400000-0x0000000002D4D000-memory.dmp
memory/5096-137-0x0000000072BD0000-0x0000000073380000-memory.dmp
memory/5096-165-0x0000000007C40000-0x0000000007D4A000-memory.dmp
memory/5096-140-0x00000000052C0000-0x0000000005864000-memory.dmp
memory/5096-141-0x0000000004DF0000-0x0000000004E82000-memory.dmp
memory/5096-143-0x0000000004F20000-0x0000000004F30000-memory.dmp
memory/5096-144-0x0000000004EB0000-0x0000000004EBA000-memory.dmp
memory/5096-148-0x00000000061A0000-0x00000000067B8000-memory.dmp
memory/5096-100-0x0000000072BD0000-0x0000000073380000-memory.dmp
memory/5096-171-0x0000000007BD0000-0x0000000007C0C000-memory.dmp
memory/5096-96-0x0000000000400000-0x0000000000450000-memory.dmp
memory/5096-168-0x0000000007B70000-0x0000000007B82000-memory.dmp
memory/5096-173-0x0000000007D50000-0x0000000007D9C000-memory.dmp