Analysis
- max time kernel
153s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
16/01/2023, 18:02
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target file.exe
- Size 223KB
- Sample230116-wmfhqaeg7x
- SHA256 10ea85c992d5bc686475b85c23caa967145eb98e849622629125f69b6e62c19f
- MD5 15d7d8d29917f9f1d4ab9d2046e621ca
- SHA1 0ff077e011254b64089bd246e7f69cecf6cee76a
- SHA512 1951697da0cffc48a3a98d86763eaddf8a37bca06d61333c3fc7d60b47c8a23348a9b16d8c2f6d49902b71d6df4aa5acdc5e56cb4beb158e27cf71547ae73998
- SSDEEP 3072:YzNnhucwLHVwY4sMDIc0GYUgfer/KW+OBkfJndJryAk9GSksJ9ODKyQ/uZF:2NhTwL134sHGYUsBdxyAvjLDHX/
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detect rhadamanthys stealer shellcode 2 IoCs
resource yara_rule behavioral2/memory/3512-147-0x0000000002BF0000-0x0000000002C0D000-memory.dmp family_rhadamanthys behavioral2/memory/3512-148-0x0000000002BF0000-0x0000000002C0D000-memory.dmp family_rhadamanthys - Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/3468-133-0x00000000004F0000-0x00000000004F9000-memory.dmp family_smokeloader - Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Executes dropped EXE 1 IoCs
pid Process 5080 EC49.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5080 set thread context of 3512 5080 EC49.exe 83 - Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 AppLaunch.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID AppLaunch.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3468 file.exe 3468 file.exe 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found 2176 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2176 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3468 file.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeShutdownPrivilege 2176 Process not Found Token: SeCreatePagefilePrivilege 2176 Process not Found Token: SeShutdownPrivilege 2176 Process not Found Token: SeCreatePagefilePrivilege 2176 Process not Found Token: SeShutdownPrivilege 2176 Process not Found Token: SeCreatePagefilePrivilege 2176 Process not Found Token: SeShutdownPrivilege 2176 Process not Found Token: SeCreatePagefilePrivilege 2176 Process not Found Token: SeShutdownPrivilege 3512 AppLaunch.exe Token: SeCreatePagefilePrivilege 3512 AppLaunch.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2176 wrote to memory of 5080 2176 Process not Found 81 PID 2176 wrote to memory of 5080 2176 Process not Found 81 PID 2176 wrote to memory of 5080 2176 Process not Found 81 PID 5080 wrote to memory of 3512 5080 EC49.exe 83 PID 5080 wrote to memory of 3512 5080 EC49.exe 83 PID 5080 wrote to memory of 3512 5080 EC49.exe 83 PID 5080 wrote to memory of 3512 5080 EC49.exe 83 PID 5080 wrote to memory of 3512 5080 EC49.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3468
-
C:\Users\Admin\AppData\Local\Temp\EC49.exeC:\Users\Admin\AppData\Local\Temp\EC49.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3512
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\EC49.exe
- Size 301KB
- SHA256 7e09cf3d09ef89b5595c70637ce9173919a61e8fc5a5fcde253762db61bf90f5
- MD5 4acdf57f748191b2854578e156e919c7
- SHA1 7ca4f3a36c5edab59111512e2b577bd2b9836525
- SHA512 688dfea73e30fb1a77d8ca398c5bbce77eae05eed848c2905467e3dfff4818b3bf06edcae78de1093d931eb39fd65ada99bdca686986e9fb3b7c8d3ddf009776
- SSDEEP 6144:dx6dcNuMSPr/tN0NwjUtDTfYuPZN9t/P+BnaRY3JVHXxHJAPSom4:KcNapN0NuE1h+BnSYbxJAPSol
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\EC49.exe
- Size 301KB
- SHA256 7e09cf3d09ef89b5595c70637ce9173919a61e8fc5a5fcde253762db61bf90f5
- MD5 4acdf57f748191b2854578e156e919c7
- SHA1 7ca4f3a36c5edab59111512e2b577bd2b9836525
- SHA512 688dfea73e30fb1a77d8ca398c5bbce77eae05eed848c2905467e3dfff4818b3bf06edcae78de1093d931eb39fd65ada99bdca686986e9fb3b7c8d3ddf009776
- SSDEEP 6144:dx6dcNuMSPr/tN0NwjUtDTfYuPZN9t/P+BnaRY3JVHXxHJAPSom4:KcNapN0NuE1h+BnSYbxJAPSol
- MD5 SHA1 SHA512 SSDEEP