Analysis
- max time kernel
151s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system - submitted
16/01/2023, 04:02
Static task
static1
Behavioral task
behavioral1
Sample
d557d25c09800d3fbc76ab421c547f79.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
d557d25c09800d3fbc76ab421c547f79.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target d557d25c09800d3fbc76ab421c547f79.exe
- Size 211KB
- Sample230116-elscfsch5w
- SHA256 0c69ea822ae475767e675bb3e53247df4f5141d5a2ccf238647cc5ba58e8e75c
- MD5 d557d25c09800d3fbc76ab421c547f79
- SHA1 8f859dcb8be05f7879cd6b3421b643666c00843b
- SHA512 e4c8aa8a679d6b4a7376e8985de6b00b8d401703a04daa82376fb359b48740ee9283c7dd0b06626c486807c57c55523239563bbff946686cbfc28e3dca33e301
- SSDEEP 3072:nCXmt/8vFd59EvEkuUXNvYKqNkqj3nYi:nCRfEckuAVYTj
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detect rhadamanthys stealer shellcode 1 IoCs
resource yara_rule behavioral2/memory/480-147-0x0000000000ED0000-0x0000000000EED000-memory.dmp family_rhadamanthys - Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/4932-133-0x0000000002D30000-0x0000000002D39000-memory.dmp family_smokeloader - Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Executes dropped EXE 1 IoCs
pid Process 2208 12BD.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2208 set thread context of 480 2208 12BD.exe 89 - Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d557d25c09800d3fbc76ab421c547f79.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d557d25c09800d3fbc76ab421c547f79.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d557d25c09800d3fbc76ab421c547f79.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 AppLaunch.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID AppLaunch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4932 d557d25c09800d3fbc76ab421c547f79.exe 4932 d557d25c09800d3fbc76ab421c547f79.exe 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found 2664 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2664 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4932 d557d25c09800d3fbc76ab421c547f79.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeShutdownPrivilege 2664 Process not Found Token: SeCreatePagefilePrivilege 2664 Process not Found Token: SeShutdownPrivilege 2664 Process not Found Token: SeCreatePagefilePrivilege 2664 Process not Found Token: SeShutdownPrivilege 2664 Process not Found Token: SeCreatePagefilePrivilege 2664 Process not Found Token: SeShutdownPrivilege 2664 Process not Found Token: SeCreatePagefilePrivilege 2664 Process not Found Token: SeShutdownPrivilege 480 AppLaunch.exe Token: SeCreatePagefilePrivilege 480 AppLaunch.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2664 wrote to memory of 2208 2664 Process not Found 87 PID 2664 wrote to memory of 2208 2664 Process not Found 87 PID 2664 wrote to memory of 2208 2664 Process not Found 87 PID 2208 wrote to memory of 480 2208 12BD.exe 89 PID 2208 wrote to memory of 480 2208 12BD.exe 89 PID 2208 wrote to memory of 480 2208 12BD.exe 89 PID 2208 wrote to memory of 480 2208 12BD.exe 89 PID 2208 wrote to memory of 480 2208 12BD.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\d557d25c09800d3fbc76ab421c547f79.exe"C:\Users\Admin\AppData\Local\Temp\d557d25c09800d3fbc76ab421c547f79.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4932
-
C:\Users\Admin\AppData\Local\Temp\12BD.exeC:\Users\Admin\AppData\Local\Temp\12BD.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:480
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\12BD.exe
- Size 301KB
- SHA256 7e09cf3d09ef89b5595c70637ce9173919a61e8fc5a5fcde253762db61bf90f5
- MD5 4acdf57f748191b2854578e156e919c7
- SHA1 7ca4f3a36c5edab59111512e2b577bd2b9836525
- SHA512 688dfea73e30fb1a77d8ca398c5bbce77eae05eed848c2905467e3dfff4818b3bf06edcae78de1093d931eb39fd65ada99bdca686986e9fb3b7c8d3ddf009776
- SSDEEP 6144:dx6dcNuMSPr/tN0NwjUtDTfYuPZN9t/P+BnaRY3JVHXxHJAPSom4:KcNapN0NuE1h+BnSYbxJAPSol
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\12BD.exe
- Size 301KB
- SHA256 7e09cf3d09ef89b5595c70637ce9173919a61e8fc5a5fcde253762db61bf90f5
- MD5 4acdf57f748191b2854578e156e919c7
- SHA1 7ca4f3a36c5edab59111512e2b577bd2b9836525
- SHA512 688dfea73e30fb1a77d8ca398c5bbce77eae05eed848c2905467e3dfff4818b3bf06edcae78de1093d931eb39fd65ada99bdca686986e9fb3b7c8d3ddf009776
- SSDEEP 6144:dx6dcNuMSPr/tN0NwjUtDTfYuPZN9t/P+BnaRY3JVHXxHJAPSom4:KcNapN0NuE1h+BnSYbxJAPSol
- MD5 SHA1 SHA512 SSDEEP