Analysis
- max time kernel
151s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
16/01/2023, 11:36
Static task
static1
Behavioral task
behavioral1
Sample
9d0b285f2e4db1f5dbabe3e01d8078b8.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
9d0b285f2e4db1f5dbabe3e01d8078b8.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 9d0b285f2e4db1f5dbabe3e01d8078b8.exe
- Size 233KB
- Sample230116-nqkylsab71
- SHA256 c0a99ec3a77d23a53c79bb6baa5c26b4db26e044fa1c75eac8336d9b92c99cdc
- MD5 9d0b285f2e4db1f5dbabe3e01d8078b8
- SHA1 8c8b141292e55b00e5c0948de1639215060c7125
- SHA512 7f548b159a7cda230834c1b4711bf55483ad1483bca52a4d2e5b5a123968f644c53c27867200ea7ffd55db2cb0fec2ab3c8860ee6833d51bbea76cb95d79ffd3
- SSDEEP 6144:4wLc3LVrVKgURZiyYGGaNd3mgl6DHXyUC:4wL4BZKLxYGtNwxi
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detect rhadamanthys stealer shellcode 1 IoCs
resource yara_rule behavioral2/memory/1064-147-0x0000000000780000-0x000000000079D000-memory.dmp family_rhadamanthys - Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/572-133-0x0000000000500000-0x0000000000509000-memory.dmp family_smokeloader - Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Executes dropped EXE 1 IoCs
pid Process 1844 BD2A.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1844 set thread context of 1064 1844 BD2A.exe 83 - Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9d0b285f2e4db1f5dbabe3e01d8078b8.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9d0b285f2e4db1f5dbabe3e01d8078b8.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9d0b285f2e4db1f5dbabe3e01d8078b8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 AppLaunch.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID AppLaunch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 572 9d0b285f2e4db1f5dbabe3e01d8078b8.exe 572 9d0b285f2e4db1f5dbabe3e01d8078b8.exe 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2648 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 572 9d0b285f2e4db1f5dbabe3e01d8078b8.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeShutdownPrivilege 2648 Process not Found Token: SeCreatePagefilePrivilege 2648 Process not Found Token: SeShutdownPrivilege 2648 Process not Found Token: SeCreatePagefilePrivilege 2648 Process not Found Token: SeShutdownPrivilege 2648 Process not Found Token: SeCreatePagefilePrivilege 2648 Process not Found Token: SeShutdownPrivilege 2648 Process not Found Token: SeCreatePagefilePrivilege 2648 Process not Found Token: SeShutdownPrivilege 1064 AppLaunch.exe Token: SeCreatePagefilePrivilege 1064 AppLaunch.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2648 wrote to memory of 1844 2648 Process not Found 81 PID 2648 wrote to memory of 1844 2648 Process not Found 81 PID 2648 wrote to memory of 1844 2648 Process not Found 81 PID 1844 wrote to memory of 1064 1844 BD2A.exe 83 PID 1844 wrote to memory of 1064 1844 BD2A.exe 83 PID 1844 wrote to memory of 1064 1844 BD2A.exe 83 PID 1844 wrote to memory of 1064 1844 BD2A.exe 83 PID 1844 wrote to memory of 1064 1844 BD2A.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d0b285f2e4db1f5dbabe3e01d8078b8.exe"C:\Users\Admin\AppData\Local\Temp\9d0b285f2e4db1f5dbabe3e01d8078b8.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:572
-
C:\Users\Admin\AppData\Local\Temp\BD2A.exeC:\Users\Admin\AppData\Local\Temp\BD2A.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1064
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\BD2A.exe
- Size 301KB
- SHA256 7e09cf3d09ef89b5595c70637ce9173919a61e8fc5a5fcde253762db61bf90f5
- MD5 4acdf57f748191b2854578e156e919c7
- SHA1 7ca4f3a36c5edab59111512e2b577bd2b9836525
- SHA512 688dfea73e30fb1a77d8ca398c5bbce77eae05eed848c2905467e3dfff4818b3bf06edcae78de1093d931eb39fd65ada99bdca686986e9fb3b7c8d3ddf009776
- SSDEEP 6144:dx6dcNuMSPr/tN0NwjUtDTfYuPZN9t/P+BnaRY3JVHXxHJAPSom4:KcNapN0NuE1h+BnSYbxJAPSol
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\BD2A.exe
- Size 301KB
- SHA256 7e09cf3d09ef89b5595c70637ce9173919a61e8fc5a5fcde253762db61bf90f5
- MD5 4acdf57f748191b2854578e156e919c7
- SHA1 7ca4f3a36c5edab59111512e2b577bd2b9836525
- SHA512 688dfea73e30fb1a77d8ca398c5bbce77eae05eed848c2905467e3dfff4818b3bf06edcae78de1093d931eb39fd65ada99bdca686986e9fb3b7c8d3ddf009776
- SSDEEP 6144:dx6dcNuMSPr/tN0NwjUtDTfYuPZN9t/P+BnaRY3JVHXxHJAPSom4:KcNapN0NuE1h+BnSYbxJAPSol
- MD5 SHA1 SHA512 SSDEEP