Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
26/02/2023, 20:33
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20230220-en
General
-
Target
tmp.exe
-
Size
29KB
-
MD5
1496b98fe0530da47982105a87a69bce
-
SHA1
00719a1b168c8baa3827a161326b157713f9a07a
-
SHA256
c7c03c2d6a78eb79409a53304bfaf8a69334d2f6a5928db641092bcc39dc8e8d
-
SHA512
286c28a228dda2d589e7e5a75027c27fcc69244b8fec2ae1019d66a8fe6aa00ef245682a1e2dd3f37722c9c4220f2ddc52ab8750369842da028970c59513dcc6
-
SSDEEP
768:en3FjOzFQjRuGjXi2nZFwn3SGTfMve9L0hPOZ:eaQ3Xi2ni3SKfMkLw
Malware Config
Extracted
remcos
N
173.212.217.108:1050
zab4ever.no-ip.org:1050
1zab4ever.no-ip.org:1050
1zab4ever.duckdns.org:1050
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
svhost.exe
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
true
-
install_flag
true
-
install_path
%WinDir%
-
keylog_crypt
false
-
keylog_file
psibos.dat
-
keylog_flag
false
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
hgfjioupsc-UDD5UN
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Windows VHost
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Signatures
-
Detects Smokeloader packer 2 IoCs
resource yara_rule behavioral2/memory/4476-133-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral2/memory/4476-135-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run D15E.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Windows VHost = "\"C:\\Windows\\svhost.exe\"" D15E.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Windows VHost = "\"C:\\Windows\\svhost.exe\"" svhost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation D15E.exe -
Executes dropped EXE 3 IoCs
pid Process 2416 D15E.exe 4496 D20B.exe 1296 svhost.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\Users\\Admin\\AppData\\Local\\Temp\\D20B.exe" D20B.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1296 set thread context of 2116 1296 svhost.exe 89 -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\svhost.exe D15E.exe File created C:\Windows\svhost.exe D15E.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tmp.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tmp.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tmp.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ D15E.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4476 tmp.exe 4476 tmp.exe 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3160 Process not Found -
Suspicious behavior: MapViewOfSection 12 IoCs
pid Process 4476 tmp.exe 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 1296 svhost.exe 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found 3160 Process not Found -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1296 svhost.exe -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 3160 wrote to memory of 2416 3160 Process not Found 84 PID 3160 wrote to memory of 2416 3160 Process not Found 84 PID 3160 wrote to memory of 2416 3160 Process not Found 84 PID 3160 wrote to memory of 4496 3160 Process not Found 85 PID 3160 wrote to memory of 4496 3160 Process not Found 85 PID 3160 wrote to memory of 4496 3160 Process not Found 85 PID 3160 wrote to memory of 4708 3160 Process not Found 86 PID 3160 wrote to memory of 4708 3160 Process not Found 86 PID 3160 wrote to memory of 4708 3160 Process not Found 86 PID 3160 wrote to memory of 4708 3160 Process not Found 86 PID 3160 wrote to memory of 3336 3160 Process not Found 87 PID 3160 wrote to memory of 3336 3160 Process not Found 87 PID 3160 wrote to memory of 3336 3160 Process not Found 87 PID 2416 wrote to memory of 1296 2416 D15E.exe 88 PID 2416 wrote to memory of 1296 2416 D15E.exe 88 PID 2416 wrote to memory of 1296 2416 D15E.exe 88 PID 1296 wrote to memory of 2116 1296 svhost.exe 89 PID 1296 wrote to memory of 2116 1296 svhost.exe 89 PID 1296 wrote to memory of 2116 1296 svhost.exe 89 PID 1296 wrote to memory of 2116 1296 svhost.exe 89 PID 3160 wrote to memory of 1432 3160 Process not Found 90 PID 3160 wrote to memory of 1432 3160 Process not Found 90 PID 3160 wrote to memory of 1432 3160 Process not Found 90 PID 3160 wrote to memory of 1432 3160 Process not Found 90 PID 3160 wrote to memory of 2300 3160 Process not Found 91 PID 3160 wrote to memory of 2300 3160 Process not Found 91 PID 3160 wrote to memory of 2300 3160 Process not Found 91 PID 3160 wrote to memory of 2300 3160 Process not Found 91 PID 3160 wrote to memory of 2108 3160 Process not Found 92 PID 3160 wrote to memory of 2108 3160 Process not Found 92 PID 3160 wrote to memory of 2108 3160 Process not Found 92 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4476
-
C:\Users\Admin\AppData\Local\Temp\D15E.exeC:\Users\Admin\AppData\Local\Temp\D15E.exe1⤵
- Adds policy Run key to start application
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\svhost.exe"C:\Windows\svhost.exe"2⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵PID:2116
-
-
-
C:\Users\Admin\AppData\Local\Temp\D20B.exeC:\Users\Admin\AppData\Local\Temp\D20B.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4496
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:4708
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3336
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1432
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2300
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2108
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
458KB
MD5eefc82bd1babcace31d1823bf8974852
SHA1ea1e7ffb166b2c12a95fad1c7398d5e2ff74ed52
SHA256970833813b7677c96a5ac2b136a982bc32c1179cf77aee729a0f4993f23c1f34
SHA5126b21c156df25befe6b884761288092c680590d6cd9f52434c01404d3ee4e7a769de2766075be2b4f160266c382966d3ea36a415ba7b4b0de84e347c2fd4713dc
-
Filesize
458KB
MD5eefc82bd1babcace31d1823bf8974852
SHA1ea1e7ffb166b2c12a95fad1c7398d5e2ff74ed52
SHA256970833813b7677c96a5ac2b136a982bc32c1179cf77aee729a0f4993f23c1f34
SHA5126b21c156df25befe6b884761288092c680590d6cd9f52434c01404d3ee4e7a769de2766075be2b4f160266c382966d3ea36a415ba7b4b0de84e347c2fd4713dc
-
Filesize
141KB
MD54da855885a48a88b2b99abdaf7dbaddb
SHA195be38902672a4f729325f4322449fafe52791c4
SHA256e6e5fa379b321d66c93d236eadc5c81478c821b545a7ff9ac6d07e14ed5a8983
SHA5124f5855573c3d08d8a11325775230544ecf79f884009a94c30c8bd4547e2ad873224ef1d34fd15b9e91423a5cf4351f22d4aa50be7c14cc2bdc2260c009e61c93
-
Filesize
141KB
MD54da855885a48a88b2b99abdaf7dbaddb
SHA195be38902672a4f729325f4322449fafe52791c4
SHA256e6e5fa379b321d66c93d236eadc5c81478c821b545a7ff9ac6d07e14ed5a8983
SHA5124f5855573c3d08d8a11325775230544ecf79f884009a94c30c8bd4547e2ad873224ef1d34fd15b9e91423a5cf4351f22d4aa50be7c14cc2bdc2260c009e61c93
-
Filesize
458KB
MD5eefc82bd1babcace31d1823bf8974852
SHA1ea1e7ffb166b2c12a95fad1c7398d5e2ff74ed52
SHA256970833813b7677c96a5ac2b136a982bc32c1179cf77aee729a0f4993f23c1f34
SHA5126b21c156df25befe6b884761288092c680590d6cd9f52434c01404d3ee4e7a769de2766075be2b4f160266c382966d3ea36a415ba7b4b0de84e347c2fd4713dc
-
Filesize
458KB
MD5eefc82bd1babcace31d1823bf8974852
SHA1ea1e7ffb166b2c12a95fad1c7398d5e2ff74ed52
SHA256970833813b7677c96a5ac2b136a982bc32c1179cf77aee729a0f4993f23c1f34
SHA5126b21c156df25befe6b884761288092c680590d6cd9f52434c01404d3ee4e7a769de2766075be2b4f160266c382966d3ea36a415ba7b4b0de84e347c2fd4713dc
-
Filesize
458KB
MD5eefc82bd1babcace31d1823bf8974852
SHA1ea1e7ffb166b2c12a95fad1c7398d5e2ff74ed52
SHA256970833813b7677c96a5ac2b136a982bc32c1179cf77aee729a0f4993f23c1f34
SHA5126b21c156df25befe6b884761288092c680590d6cd9f52434c01404d3ee4e7a769de2766075be2b4f160266c382966d3ea36a415ba7b4b0de84e347c2fd4713dc