Analysis
- max time kernel
150s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
16/01/2023, 17:31
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target file.exe
- Size 223KB
- Sample230116-v3pwnaae32
- SHA256 ef0d02404a74d0e990f7ec624d207348c697fdeb0f9fcf98e37cbfbecf2918b0
- MD5 154aa5bac486f61553b3f1e4af824917
- SHA1 41fcad6a24f3e2152fbd0072ce032ba8bf97ccec
- SHA512 681f137af9adacf51cdc8f2be2667aa36c1e36b3cb318a763170a14a6754b78493f14a8fb57b8f93975cb68bf7ba99749622f07642f16a7395ac3b2d089e19fc
- SSDEEP 3072:CzyZhN/OkH4LN0VwgBLzDIc0b00xhe8loX6Qtb837+iOjMwYuookJ/19eyDKyQ/W:Yy3NN4LNaLBLUDZv37ojM7skJdPDHX/
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detect rhadamanthys stealer shellcode 1 IoCs
resource yara_rule behavioral2/memory/1308-148-0x0000000002E50000-0x0000000002E6D000-memory.dmp family_rhadamanthys - Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/2240-133-0x00000000005D0000-0x00000000005D9000-memory.dmp family_smokeloader - Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Executes dropped EXE 1 IoCs
pid Process 4756 BE73.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4756 set thread context of 1308 4756 BE73.exe 82 - Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 AppLaunch.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID AppLaunch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2240 file.exe 2240 file.exe 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2680 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2240 file.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeShutdownPrivilege 2680 Process not Found Token: SeCreatePagefilePrivilege 2680 Process not Found Token: SeShutdownPrivilege 2680 Process not Found Token: SeCreatePagefilePrivilege 2680 Process not Found Token: SeShutdownPrivilege 2680 Process not Found Token: SeCreatePagefilePrivilege 2680 Process not Found Token: SeShutdownPrivilege 2680 Process not Found Token: SeCreatePagefilePrivilege 2680 Process not Found Token: SeShutdownPrivilege 1308 AppLaunch.exe Token: SeCreatePagefilePrivilege 1308 AppLaunch.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2680 wrote to memory of 4756 2680 Process not Found 80 PID 2680 wrote to memory of 4756 2680 Process not Found 80 PID 2680 wrote to memory of 4756 2680 Process not Found 80 PID 4756 wrote to memory of 1308 4756 BE73.exe 82 PID 4756 wrote to memory of 1308 4756 BE73.exe 82 PID 4756 wrote to memory of 1308 4756 BE73.exe 82 PID 4756 wrote to memory of 1308 4756 BE73.exe 82 PID 4756 wrote to memory of 1308 4756 BE73.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2240
-
C:\Users\Admin\AppData\Local\Temp\BE73.exeC:\Users\Admin\AppData\Local\Temp\BE73.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1308
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\BE73.exe
- Size 301KB
- SHA256 7e09cf3d09ef89b5595c70637ce9173919a61e8fc5a5fcde253762db61bf90f5
- MD5 4acdf57f748191b2854578e156e919c7
- SHA1 7ca4f3a36c5edab59111512e2b577bd2b9836525
- SHA512 688dfea73e30fb1a77d8ca398c5bbce77eae05eed848c2905467e3dfff4818b3bf06edcae78de1093d931eb39fd65ada99bdca686986e9fb3b7c8d3ddf009776
- SSDEEP 6144:dx6dcNuMSPr/tN0NwjUtDTfYuPZN9t/P+BnaRY3JVHXxHJAPSom4:KcNapN0NuE1h+BnSYbxJAPSol
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\BE73.exe
- Size 301KB
- SHA256 7e09cf3d09ef89b5595c70637ce9173919a61e8fc5a5fcde253762db61bf90f5
- MD5 4acdf57f748191b2854578e156e919c7
- SHA1 7ca4f3a36c5edab59111512e2b577bd2b9836525
- SHA512 688dfea73e30fb1a77d8ca398c5bbce77eae05eed848c2905467e3dfff4818b3bf06edcae78de1093d931eb39fd65ada99bdca686986e9fb3b7c8d3ddf009776
- SSDEEP 6144:dx6dcNuMSPr/tN0NwjUtDTfYuPZN9t/P+BnaRY3JVHXxHJAPSom4:KcNapN0NuE1h+BnSYbxJAPSol
- MD5 SHA1 SHA512 SSDEEP