Resubmissions
09/04/2024, 08:32
240409-kfg77aaf851009/04/2024, 08:32
240409-kfglnaaf841009/04/2024, 08:32
240409-kffz5aea2y1009/04/2024, 08:32
240409-kffpcsaf791011/03/2024, 08:03
240311-jxm94afe6y1010/03/2024, 15:15
240310-snee9sfd3y10Analysis
- max time kernel
33s - max time network
301s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
09/04/2024, 08:32
General
- Target FUCKER.exe
- Size 10KB
- Sample240409-kffpcsaf79
- SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
Malware Config
Extracted
-
asyncrat
-
Venom RAT + HVNC + Stealer + Grabber v6.0.3
-
Default
-
glpngorolvfhxvlr
-
delay
1
-
install
true
-
install_file
client.exe
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/LwwcrLg4
Extracted
-
redline
-
CLOUDYTTEAM
-
185.172.128.33:8970
Extracted
-
amadey
-
4.17
-
http://185.215.113.32
-
install_dir
00c07260dc
-
install_file
explorgu.exe
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Extracted
-
redline
-
@OLEH_PSP
-
185.172.128.33:8970
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Detect ZGRat V1 39 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 5 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Async RAT payload 1 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Downloads MZ/PE file
- .NET Reactor proctector 2 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 7 IoCs
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 8 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies system certificate store 2 TTPs 5 IoCs
- Runs net.exe
- Runs ping.exe 1 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 45 IoCs
- Suspicious use of WriteProcessMemory 51 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\FUCKER.exe"C:\Users\Admin\AppData\Local\Temp\FUCKER.exe"1⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\Ledger-Live.exe"C:\Users\Admin\AppData\Local\Temp\Files\Ledger-Live.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\Files\Ledger-Live.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 2.2.2.2 -n 1 -w 30004⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\afile.exe"C:\Users\Admin\AppData\Local\Temp\Files\afile.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\configurationValue\newss.exe"C:\Users\Admin\AppData\Roaming\configurationValue\newss.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\configurationValue\traffic.exe"C:\Users\Admin\AppData\Roaming\configurationValue\traffic.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\virus.exe"C:\Users\Admin\AppData\Local\Temp\Files\virus.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Files\TJeAjWEEeH.exe"C:\Users\Admin\AppData\Local\Temp\Files\TJeAjWEEeH.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\amert.exe"C:\Users\Admin\AppData\Local\Temp\Files\amert.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\Files\PCSupport.exe"C:\Users\Admin\AppData\Local\Temp\Files\PCSupport.exe"2⤵
-
C:\Users\Admin\AppData\Local\PhantomSoft\Support\winvnc.exeC:\Users\Admin\AppData\Local\PhantomSoft\Support\winvnc.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe"C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\dsdasda.exe"C:\Users\Admin\AppData\Local\Temp\Files\dsdasda.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 6123⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\H667H.exe"C:\Users\Admin\AppData\Local\Temp\Files\H667H.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ma.exe"C:\Users\Admin\AppData\Local\Temp\Files\ma.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\MStore.exe"C:\Users\Admin\AppData\Local\Temp\Files\MStore.exe"2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell Add-MpPreference -ExclusionExtension .exe3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionExtension .exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\NINJA.exe"C:\Users\Admin\AppData\Local\Temp\Files\NINJA.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn SBADLH.exe /tr C:\Users\Admin\AppData\Roaming\Windata\system.exe /sc minute /mo 13⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn SBADLH.exe /tr C:\Users\Admin\AppData\Roaming\Windata\system.exe /sc minute /mo 14⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\SysWOW64\WSCript.exeWSCript C:\Users\Admin\AppData\Local\Temp\SBADLH.vbs3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe"C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 2524⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\alexxxxxxxx.exe"C:\Users\Admin\AppData\Local\Temp\Files\alexxxxxxxx.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"4⤵
-
-
C:\Users\Admin\AppData\Roaming\configurationValue\traffic.exe"C:\Users\Admin\AppData\Roaming\configurationValue\traffic.exe"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\goldprimeldlldf.exe"C:\Users\Admin\AppData\Local\Temp\Files\goldprimeldlldf.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\patch.exe"C:\Users\Admin\AppData\Local\Temp\Files\patch.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\KB824105-x86-ENU.exe"C:\Users\Admin\AppData\Local\Temp\Files\KB824105-x86-ENU.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c net use3⤵
-
C:\Windows\SysWOW64\net.exenet use4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Ledger-Live.exe"C:\Users\Admin\AppData\Local\Temp\Files\Ledger-Live.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\Files\Ledger-Live.exe3⤵
-
C:\Windows\SysWOW64\PING.EXEping 2.2.2.2 -n 1 -w 30004⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\lummahelp.exe"C:\Users\Admin\AppData\Local\Temp\Files\lummahelp.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\VLTKBacdau.exe"C:\Users\Admin\AppData\Local\Temp\Files\VLTKBacdau.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
CNSWA.exe
94308059B57B3142E455B38A6EB92015
94308059B57B3142E455B38A6EB92015
94308059B57B3142E455B38A6EB92015
94308059B57B3142E455B38A6EB92015
UltraVNC.ini
NINJA.exe
TJeAjWEEeH.exe
amert.exe
crypted.exe
dsdasda.exe
ghjkl.exe
goldprimeldlldf.exe
ma.exe
Tar4486.tmp
Tmp6A38.tmp
590aee7bdd69b59b.customDestinations-ms
traffic.exe
winvnc.exe
H667H.exe
Ledger-Live.exe
MStore.exe
PCSupport.exe
afile.exe
alexxxxxxxx.exe
virus.exe
newss.exe
propro.exe
memory/360-735-0x0000000074DF0000-0x00000000754DE000-memory.dmp
memory/360-227-0x0000000074DF0000-0x00000000754DE000-memory.dmp
memory/360-224-0x0000000001380000-0x00000000013D0000-memory.dmp
memory/360-228-0x00000000012C0000-0x0000000001300000-memory.dmp
memory/560-537-0x0000000005180000-0x000000000562B000-memory.dmp
memory/560-521-0x0000000005180000-0x000000000562B000-memory.dmp
memory/560-489-0x0000000005180000-0x000000000562B000-memory.dmp
memory/560-478-0x0000000005180000-0x000000000562B000-memory.dmp
memory/560-467-0x0000000005180000-0x0000000005630000-memory.dmp
memory/560-570-0x0000000005180000-0x000000000562B000-memory.dmp
memory/560-493-0x0000000005180000-0x000000000562B000-memory.dmp
memory/560-456-0x0000000001240000-0x000000000179A000-memory.dmp
memory/560-539-0x0000000005180000-0x000000000562B000-memory.dmp
memory/560-541-0x0000000005180000-0x000000000562B000-memory.dmp
memory/560-552-0x0000000005180000-0x000000000562B000-memory.dmp
memory/560-568-0x0000000005180000-0x000000000562B000-memory.dmp
memory/560-457-0x0000000074DF0000-0x00000000754DE000-memory.dmp
memory/560-495-0x0000000005180000-0x000000000562B000-memory.dmp
memory/560-497-0x0000000005180000-0x000000000562B000-memory.dmp
memory/560-506-0x0000000005180000-0x000000000562B000-memory.dmp
memory/560-508-0x0000000005180000-0x000000000562B000-memory.dmp
memory/560-510-0x0000000005180000-0x000000000562B000-memory.dmp
memory/560-512-0x0000000005180000-0x000000000562B000-memory.dmp
memory/560-514-0x0000000005180000-0x000000000562B000-memory.dmp
memory/560-516-0x0000000005180000-0x000000000562B000-memory.dmp
memory/560-519-0x0000000005180000-0x000000000562B000-memory.dmp
memory/560-535-0x0000000005180000-0x000000000562B000-memory.dmp
memory/560-523-0x0000000005180000-0x000000000562B000-memory.dmp
memory/560-561-0x0000000005180000-0x000000000562B000-memory.dmp
memory/560-559-0x0000000005180000-0x000000000562B000-memory.dmp
memory/560-556-0x0000000005180000-0x000000000562B000-memory.dmp
memory/560-554-0x0000000005180000-0x000000000562B000-memory.dmp
memory/1148-386-0x000000001AEB0000-0x000000001AF30000-memory.dmp
memory/1148-385-0x0000000001020000-0x0000000001104000-memory.dmp
memory/1148-384-0x000007FEF6000000-0x000007FEF69EC000-memory.dmp
memory/1704-751-0x0000000000C90000-0x0000000000D0A000-memory.dmp
memory/1788-438-0x00000000003A0000-0x00000000003A1000-memory.dmp
memory/1836-405-0x0000000002CB4000-0x0000000002CB7000-memory.dmp
memory/1836-409-0x0000000002CBB000-0x0000000002D22000-memory.dmp
memory/1836-407-0x000007FEECB20000-0x000007FEED4BD000-memory.dmp
memory/1836-408-0x0000000002CB0000-0x0000000002D30000-memory.dmp
memory/1836-396-0x000000001B570000-0x000000001B852000-memory.dmp
memory/1836-397-0x00000000022B0000-0x00000000022B8000-memory.dmp
memory/1836-406-0x000007FEECB20000-0x000007FEED4BD000-memory.dmp
memory/1852-230-0x000007FEF6000000-0x000007FEF69EC000-memory.dmp
memory/1852-223-0x0000000000270000-0x00000000002D6000-memory.dmp
memory/1856-71-0x00000000047C0000-0x0000000004800000-memory.dmp
memory/1856-69-0x0000000001030000-0x0000000001050000-memory.dmp
memory/1856-70-0x0000000074DF0000-0x00000000754DE000-memory.dmp
memory/1856-73-0x0000000074DF0000-0x00000000754DE000-memory.dmp
memory/2008-0-0x0000000000C50000-0x0000000000C58000-memory.dmp
memory/2008-2-0x00000000047D0000-0x0000000004810000-memory.dmp
memory/2008-383-0x00000000047D0000-0x0000000004810000-memory.dmp
memory/2008-411-0x0000000007930000-0x0000000007DEF000-memory.dmp
memory/2008-1-0x0000000074DF0000-0x00000000754DE000-memory.dmp
memory/2008-412-0x0000000007930000-0x0000000007DEF000-memory.dmp
memory/2008-229-0x0000000074DF0000-0x00000000754DE000-memory.dmp
memory/2164-225-0x000007FEF6000000-0x000007FEF69EC000-memory.dmp
memory/2164-389-0x000007FEF6000000-0x000007FEF69EC000-memory.dmp
memory/2164-226-0x000000001A710000-0x000000001A790000-memory.dmp
memory/2164-188-0x0000000000AC0000-0x0000000000AD8000-memory.dmp
memory/2296-82-0x0000000074DF0000-0x00000000754DE000-memory.dmp
memory/2296-81-0x00000000010D0000-0x000000000128C000-memory.dmp
memory/2296-113-0x0000000004F70000-0x0000000004FB0000-memory.dmp
memory/2296-147-0x0000000002690000-0x0000000004690000-memory.dmp
memory/2296-164-0x0000000074DF0000-0x00000000754DE000-memory.dmp
memory/2420-156-0x0000000000400000-0x0000000000592000-memory.dmp
memory/2420-158-0x0000000000400000-0x0000000000592000-memory.dmp
memory/2420-159-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2420-161-0x0000000000400000-0x0000000000592000-memory.dmp
memory/2420-150-0x0000000000400000-0x0000000000592000-memory.dmp
memory/2420-174-0x0000000000400000-0x0000000000592000-memory.dmp
memory/2420-176-0x0000000000400000-0x0000000000592000-memory.dmp
memory/2420-146-0x0000000000400000-0x0000000000592000-memory.dmp
memory/2492-717-0x0000000004740000-0x00000000047A4000-memory.dmp
memory/2492-694-0x00000000045A0000-0x0000000004606000-memory.dmp
memory/2512-759-0x000000001B5D0000-0x000000001B8B2000-memory.dmp
memory/2576-423-0x0000000000E20000-0x0000000000E21000-memory.dmp
memory/2576-447-0x0000000001120000-0x00000000015DF000-memory.dmp
memory/2576-414-0x0000000077DE0000-0x0000000077DE2000-memory.dmp
memory/2576-416-0x0000000000E60000-0x0000000000E61000-memory.dmp
memory/2576-415-0x0000000000E40000-0x0000000000E41000-memory.dmp
memory/2576-417-0x0000000000D10000-0x0000000000D11000-memory.dmp
memory/2576-418-0x0000000000F60000-0x0000000000F61000-memory.dmp
memory/2576-419-0x00000000004A0000-0x00000000004A1000-memory.dmp
memory/2576-420-0x0000000000E30000-0x0000000000E31000-memory.dmp
memory/2576-421-0x0000000000520000-0x0000000000521000-memory.dmp
memory/2576-422-0x0000000000B40000-0x0000000000B41000-memory.dmp
memory/2576-413-0x0000000001120000-0x00000000015DF000-memory.dmp
memory/2576-443-0x0000000002C50000-0x0000000002C51000-memory.dmp
memory/2576-424-0x0000000000F10000-0x0000000000F11000-memory.dmp
memory/2576-425-0x0000000000510000-0x0000000000511000-memory.dmp
memory/2576-426-0x00000000006B0000-0x00000000006B1000-memory.dmp
memory/2576-427-0x0000000001080000-0x0000000001081000-memory.dmp
memory/2576-428-0x0000000000740000-0x0000000000741000-memory.dmp
memory/2576-439-0x0000000001120000-0x00000000015DF000-memory.dmp
memory/2576-440-0x0000000000F70000-0x0000000000F71000-memory.dmp
memory/2576-441-0x00000000004B0000-0x00000000004B1000-memory.dmp
memory/2900-734-0x0000000000F10000-0x0000000001414000-memory.dmp