Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/04/2023, 23:10

General

  • Target

    80c36406fe9a8324d37956f431da269a69b7a484de1da5f5a9bb443511000fb3.exe

  • Size

    351KB

  • MD5

    dd92fadb1366eeefbfad93998b731223

  • SHA1

    4b14337001a0f7a861d93654c1b185932ba575aa

  • SHA256

    80c36406fe9a8324d37956f431da269a69b7a484de1da5f5a9bb443511000fb3

  • SHA512

    fcfa44082098f3dfdeb2ea0a54653d50f632f89e792a0edef58d2737dd17bb2bb2b4714bd03324421524c337d896dbf408cd0eeef7783ea9376705572d7be0c9

  • SSDEEP

    6144:stN90xWixziSqsI3MuVXZcknsD04oxSQU/dXxi:stsxVQSqscMuM0vD3

Malware Config

Extracted

Family

smokeloader

Botnet

pub4

Extracted

Family

smokeloader

Version

2022

C2

http://aapu.at/tmp/

http://poudineh.com/tmp/

http://firsttrusteedrx.ru/tmp/

http://kingpirate.ru/tmp/

rc4.i32
rc4.i32

Extracted

Family

rhadamanthys

C2

http://179.43.142.201/img/favicon.png

Signatures

  • Detect rhadamanthys stealer shellcode 4 IoCs
  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\80c36406fe9a8324d37956f431da269a69b7a484de1da5f5a9bb443511000fb3.exe
    "C:\Users\Admin\AppData\Local\Temp\80c36406fe9a8324d37956f431da269a69b7a484de1da5f5a9bb443511000fb3.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:3040
  • C:\Users\Admin\AppData\Local\Temp\82BD.exe
    C:\Users\Admin\AppData\Local\Temp\82BD.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3088
    • C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Checks processor information in registry
      • outlook_office_path
      • outlook_win_path
      PID:2796
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 704
      2⤵
      • Program crash
      PID:4596
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3088 -ip 3088
    1⤵
      PID:1552

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\82BD.exe

            Filesize

            423KB

            MD5

            8aa3b8f3bfe27c28a62d9cff03b9320e

            SHA1

            581cf8b925b2321b9a27f615787454d682942f07

            SHA256

            1fc88500422917840f534cba0275b2d13a9b78ec791e445b7c6e53fa88fc351d

            SHA512

            7ef7860c1e9c62c4d51bc54b7333e285cc031df36ee4e76d2223eec26acee2044cf8363cc0a44a022168da69e8cc988d8b76850c21c0c752cef8f9641134e540

          • C:\Users\Admin\AppData\Local\Temp\82BD.exe

            Filesize

            423KB

            MD5

            8aa3b8f3bfe27c28a62d9cff03b9320e

            SHA1

            581cf8b925b2321b9a27f615787454d682942f07

            SHA256

            1fc88500422917840f534cba0275b2d13a9b78ec791e445b7c6e53fa88fc351d

            SHA512

            7ef7860c1e9c62c4d51bc54b7333e285cc031df36ee4e76d2223eec26acee2044cf8363cc0a44a022168da69e8cc988d8b76850c21c0c752cef8f9641134e540

          • memory/2796-187-0x00007FF46E380000-0x00007FF46E47A000-memory.dmp

            Filesize

            1000KB

          • memory/2796-188-0x00007FF46E380000-0x00007FF46E47A000-memory.dmp

            Filesize

            1000KB

          • memory/2796-177-0x000002131A4D0000-0x000002131A4D1000-memory.dmp

            Filesize

            4KB

          • memory/2796-180-0x00007FF46E380000-0x00007FF46E47A000-memory.dmp

            Filesize

            1000KB

          • memory/2796-186-0x00007FF46E380000-0x00007FF46E47A000-memory.dmp

            Filesize

            1000KB

          • memory/2796-185-0x00007FF46E380000-0x00007FF46E47A000-memory.dmp

            Filesize

            1000KB

          • memory/2796-184-0x00007FF46E380000-0x00007FF46E47A000-memory.dmp

            Filesize

            1000KB

          • memory/2796-179-0x000002131A7E0000-0x000002131A7E7000-memory.dmp

            Filesize

            28KB

          • memory/2796-181-0x00007FF46E380000-0x00007FF46E47A000-memory.dmp

            Filesize

            1000KB

          • memory/3040-136-0x0000000000400000-0x00000000007FC000-memory.dmp

            Filesize

            4.0MB

          • memory/3040-134-0x0000000000980000-0x0000000000989000-memory.dmp

            Filesize

            36KB

          • memory/3088-147-0x00000000008B0000-0x00000000008DE000-memory.dmp

            Filesize

            184KB

          • memory/3088-178-0x00000000008E0000-0x00000000008FA000-memory.dmp

            Filesize

            104KB

          • memory/3088-182-0x0000000000400000-0x000000000080E000-memory.dmp

            Filesize

            4.1MB

          • memory/3088-183-0x0000000000880000-0x000000000089C000-memory.dmp

            Filesize

            112KB

          • memory/3088-167-0x0000000000400000-0x000000000080E000-memory.dmp

            Filesize

            4.1MB

          • memory/3088-176-0x0000000000880000-0x000000000089C000-memory.dmp

            Filesize

            112KB

          • memory/3088-175-0x00000000008E0000-0x00000000008FA000-memory.dmp

            Filesize

            104KB

          • memory/3088-174-0x0000000000880000-0x000000000089C000-memory.dmp

            Filesize

            112KB

          • memory/3088-173-0x0000000000880000-0x000000000089C000-memory.dmp

            Filesize

            112KB

          • memory/3152-158-0x0000000006D90000-0x0000000006DA0000-memory.dmp

            Filesize

            64KB

          • memory/3152-189-0x0000000006D90000-0x0000000006DA0000-memory.dmp

            Filesize

            64KB

          • memory/3152-166-0x0000000006D90000-0x0000000006DA0000-memory.dmp

            Filesize

            64KB

          • memory/3152-160-0x0000000006E60000-0x0000000006E70000-memory.dmp

            Filesize

            64KB

          • memory/3152-168-0x0000000006E60000-0x0000000006E70000-memory.dmp

            Filesize

            64KB

          • memory/3152-169-0x0000000006E60000-0x0000000006E70000-memory.dmp

            Filesize

            64KB

          • memory/3152-170-0x0000000006E60000-0x0000000006E70000-memory.dmp

            Filesize

            64KB

          • memory/3152-161-0x0000000006D90000-0x0000000006DA0000-memory.dmp

            Filesize

            64KB

          • memory/3152-162-0x0000000006E60000-0x0000000006E70000-memory.dmp

            Filesize

            64KB

          • memory/3152-164-0x0000000006E60000-0x0000000006E70000-memory.dmp

            Filesize

            64KB

          • memory/3152-163-0x0000000006D90000-0x0000000006DA0000-memory.dmp

            Filesize

            64KB

          • memory/3152-159-0x0000000006D90000-0x0000000006DA0000-memory.dmp

            Filesize

            64KB

          • memory/3152-155-0x0000000006D90000-0x0000000006DA0000-memory.dmp

            Filesize

            64KB

          • memory/3152-156-0x0000000006D90000-0x0000000006DA0000-memory.dmp

            Filesize

            64KB

          • memory/3152-157-0x0000000006D90000-0x0000000006DA0000-memory.dmp

            Filesize

            64KB

          • memory/3152-154-0x0000000006D90000-0x0000000006DA0000-memory.dmp

            Filesize

            64KB

          • memory/3152-153-0x0000000006D90000-0x0000000006DA0000-memory.dmp

            Filesize

            64KB

          • memory/3152-152-0x0000000006D90000-0x0000000006DA0000-memory.dmp

            Filesize

            64KB

          • memory/3152-151-0x0000000006D90000-0x0000000006DA0000-memory.dmp

            Filesize

            64KB

          • memory/3152-150-0x0000000006D90000-0x0000000006DA0000-memory.dmp

            Filesize

            64KB

          • memory/3152-149-0x0000000006D90000-0x0000000006DA0000-memory.dmp

            Filesize

            64KB

          • memory/3152-148-0x0000000006D90000-0x0000000006DA0000-memory.dmp

            Filesize

            64KB

          • memory/3152-135-0x0000000000590000-0x00000000005A6000-memory.dmp

            Filesize

            88KB

          • memory/3152-165-0x0000000006D90000-0x0000000006DA0000-memory.dmp

            Filesize

            64KB

          • memory/3152-190-0x0000000006D90000-0x0000000006DA0000-memory.dmp

            Filesize

            64KB

          • memory/3152-191-0x0000000006D90000-0x0000000006DA0000-memory.dmp

            Filesize

            64KB

          • memory/3152-192-0x0000000006D90000-0x0000000006DA0000-memory.dmp

            Filesize

            64KB

          • memory/3152-193-0x0000000006D90000-0x0000000006DA0000-memory.dmp

            Filesize

            64KB

          • memory/3152-194-0x0000000006D90000-0x0000000006DA0000-memory.dmp

            Filesize

            64KB

          • memory/3152-195-0x0000000006D90000-0x0000000006DA0000-memory.dmp

            Filesize

            64KB

          • memory/3152-196-0x0000000006D90000-0x0000000006DA0000-memory.dmp

            Filesize

            64KB

          • memory/3152-197-0x0000000006D90000-0x0000000006DA0000-memory.dmp

            Filesize

            64KB

          • memory/3152-198-0x0000000006D90000-0x0000000006DA0000-memory.dmp

            Filesize

            64KB

          • memory/3152-199-0x0000000006D90000-0x0000000006DA0000-memory.dmp

            Filesize

            64KB

          • memory/3152-200-0x0000000006D90000-0x0000000006DA0000-memory.dmp

            Filesize

            64KB

          • memory/3152-201-0x0000000006D90000-0x0000000006DA0000-memory.dmp

            Filesize

            64KB

          • memory/3152-202-0x0000000006D90000-0x0000000006DA0000-memory.dmp

            Filesize

            64KB

          • memory/3152-203-0x0000000006D90000-0x0000000006DA0000-memory.dmp

            Filesize

            64KB

          • memory/3152-204-0x0000000006D90000-0x0000000006DA0000-memory.dmp

            Filesize

            64KB

          • memory/3152-205-0x00007FF46E380000-0x00007FF46E47A000-memory.dmp

            Filesize

            1000KB

          • memory/3152-206-0x00007FF46E380000-0x00007FF46E47A000-memory.dmp

            Filesize

            1000KB

          • memory/3152-207-0x00007FF46E380000-0x00007FF46E47A000-memory.dmp

            Filesize

            1000KB

          • memory/3152-208-0x00007FF46E380000-0x00007FF46E47A000-memory.dmp

            Filesize

            1000KB

          • memory/3152-209-0x00007FF46E380000-0x00007FF46E47A000-memory.dmp

            Filesize

            1000KB

          • memory/3152-210-0x00007FF46E380000-0x00007FF46E47A000-memory.dmp

            Filesize

            1000KB