Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
-
submitted
27-03-2023 14:48
General
-
Target
file.exe
-
Size
251KB
-
MD5
28676ee6929ed8b6d7082851f6933bc7
-
SHA1
f391a10869df832a3942b6f3dec017819c5d2e1d
-
SHA256
58cc5482d7de511b7adc6819c858b1c6de067fec262813396e0f580ada1e1ecd
-
SHA512
4a47a0b4d04a0bb1ca49f77d3f653bcb4021368f3be1385022314ab48d4e8a6d5b8a32af727cca9d389794b3cf01afc028c7f92fce6587e981312e1c286d9978
-
SSDEEP
3072:01XwHn5/TE2zdkzLuw/y0/IUIOIMzZ/4+DeuYOXSGEreU23ReOAj5qdqDb:cAHC2RkzLj/d/IKLxAreU23Ms4
Malware Config
Extracted
smokeloader
pub4
Extracted
smokeloader
2022
http://aapu.at/tmp/
http://poudineh.com/tmp/
http://firsttrusteedrx.ru/tmp/
http://kingpirate.ru/tmp/
Extracted
redline
koreamon
koreamonitoring.com:80
-
auth_value
1a0e1a9f491ef3df873a03577dfa10aa
Signatures
-
Detect rhadamanthys stealer shellcode 2 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 31 IoCs
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
-
Program crash 2 IoCs
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\DBFD.exeC:\Users\Admin\AppData\Local\Temp\DBFD.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 23362⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 4616 -ip 46161⤵
-
C:\Users\Admin\AppData\Local\Temp\4372.exeC:\Users\Admin\AppData\Local\Temp\4372.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\dllhost.exe"C:\Windows\system32\dllhost.exe"2⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- outlook_office_path
- outlook_win_path
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3320 -s 7322⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3320 -ip 33201⤵
-
C:\Users\Admin\AppData\Roaming\gwacihuC:\Users\Admin\AppData\Roaming\gwacihu1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
312KB
MD5e6064fdee64cf67d083a2f1d16e6ad5b
SHA1281160e46c60f4f57c12facc0b2575571d7220fa
SHA2560048ab300c6ed6ac61084c54c9d1dfab5338e54b9cfb5fb6a2a765bde03b2191
SHA512e9c85a7276b2242d79fe5b48fe4bfc63bb02a189d1f5860aa18361359b577e594e91d70070c9ca89b0876462fa8574d8ddb5f3d74b3f32f4fb9a000127e4ac56
-
Filesize
312KB
MD5e6064fdee64cf67d083a2f1d16e6ad5b
SHA1281160e46c60f4f57c12facc0b2575571d7220fa
SHA2560048ab300c6ed6ac61084c54c9d1dfab5338e54b9cfb5fb6a2a765bde03b2191
SHA512e9c85a7276b2242d79fe5b48fe4bfc63bb02a189d1f5860aa18361359b577e594e91d70070c9ca89b0876462fa8574d8ddb5f3d74b3f32f4fb9a000127e4ac56
-
Filesize
346KB
MD56093557e3e84e5ed1b2835e84941df6b
SHA124db3355c0ff0e30def3e3a99498d2f30cc66cf2
SHA25634fbd6db5481ec0b9e6adb9ed999af2f93b59b834f9cefc76c8eacfaedeb79db
SHA512ecefc5eccc7c88a537681a33267598da43c32dbe2961a0fe09e4f4369a280b3cdefb1cc15810e9bcaf55ecd810511c50faf5cda32b0f08adf9a68023a276da8a
-
Filesize
346KB
MD56093557e3e84e5ed1b2835e84941df6b
SHA124db3355c0ff0e30def3e3a99498d2f30cc66cf2
SHA25634fbd6db5481ec0b9e6adb9ed999af2f93b59b834f9cefc76c8eacfaedeb79db
SHA512ecefc5eccc7c88a537681a33267598da43c32dbe2961a0fe09e4f4369a280b3cdefb1cc15810e9bcaf55ecd810511c50faf5cda32b0f08adf9a68023a276da8a
-
Filesize
251KB
MD528676ee6929ed8b6d7082851f6933bc7
SHA1f391a10869df832a3942b6f3dec017819c5d2e1d
SHA25658cc5482d7de511b7adc6819c858b1c6de067fec262813396e0f580ada1e1ecd
SHA5124a47a0b4d04a0bb1ca49f77d3f653bcb4021368f3be1385022314ab48d4e8a6d5b8a32af727cca9d389794b3cf01afc028c7f92fce6587e981312e1c286d9978
-
Filesize
251KB
MD528676ee6929ed8b6d7082851f6933bc7
SHA1f391a10869df832a3942b6f3dec017819c5d2e1d
SHA25658cc5482d7de511b7adc6819c858b1c6de067fec262813396e0f580ada1e1ecd
SHA5124a47a0b4d04a0bb1ca49f77d3f653bcb4021368f3be1385022314ab48d4e8a6d5b8a32af727cca9d389794b3cf01afc028c7f92fce6587e981312e1c286d9978
-
Filesize
36KB
-
Filesize
3.0MB
-
Filesize
1000KB
-
Filesize
1000KB
-
Filesize
28KB
-
Filesize
88KB
-
Filesize
112KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
112KB
-
Filesize
184KB
-
Filesize
328KB
-
Filesize
6.1MB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
72KB
-
Filesize
1.0MB
-
Filesize
240KB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
584KB
-
Filesize
472KB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
120KB
-
Filesize
320KB
-
Filesize
64KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
392KB
-
Filesize
5.6MB
-
Filesize
64KB
-
Filesize
64KB