Analysis
- max time kernel
82s - max time network
106s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
14/04/2023, 19:55
General
- Target f25b1dd4bc3b8f899575ff4ae01594385a490a644b51e51c1a8f6685fd167006.exe
- Size 349KB
- Sample230414-ym94fabe95
- SHA256 f25b1dd4bc3b8f899575ff4ae01594385a490a644b51e51c1a8f6685fd167006
Malware Config
Extracted
-
smokeloader
-
pub4
Extracted
-
smokeloader
-
2022
-
http://aapu.at/tmp/
-
http://poudineh.com/tmp/
-
http://firsttrusteedrx.ru/tmp/
-
http://kingpirate.ru/tmp/
Extracted
-
rhadamanthys
-
http://179.43.142.201/img/favicon.png
Signatures
- Detect rhadamanthys stealer shellcode 4 IoCs
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
- Program crash 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f25b1dd4bc3b8f899575ff4ae01594385a490a644b51e51c1a8f6685fd167006.exe"C:\Users\Admin\AppData\Local\Temp\f25b1dd4bc3b8f899575ff4ae01594385a490a644b51e51c1a8f6685fd167006.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\BE7.exeC:\Users\Admin\AppData\Local\Temp\BE7.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\dllhost.exe"C:\Windows\system32\dllhost.exe"2⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- outlook_office_path
- outlook_win_path
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 776 -s 6402⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 776 -ip 7761⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
BE7.exe
BE7.exe
memory/776-154-0x0000000000A30000-0x0000000000A4C000-memory.dmp
memory/776-160-0x0000000000400000-0x000000000080E000-memory.dmp
memory/776-147-0x0000000002430000-0x000000000245E000-memory.dmp
memory/776-148-0x0000000000400000-0x000000000080E000-memory.dmp
memory/776-151-0x0000000000A30000-0x0000000000A4C000-memory.dmp
memory/776-152-0x0000000000A30000-0x0000000000A4C000-memory.dmp
memory/776-153-0x0000000000910000-0x0000000000912000-memory.dmp
memory/776-156-0x0000000002690000-0x0000000002692000-memory.dmp
memory/776-161-0x0000000000A30000-0x0000000000A4C000-memory.dmp
memory/3112-135-0x0000000001260000-0x0000000001276000-memory.dmp
memory/4284-134-0x00000000008B0000-0x00000000008B9000-memory.dmp
memory/4284-136-0x0000000000400000-0x00000000007FC000-memory.dmp
memory/4412-155-0x000002C0B85D0000-0x000002C0B85D1000-memory.dmp
memory/4412-159-0x00007FF4BC520000-0x00007FF4BC61A000-memory.dmp
memory/4412-158-0x00007FF4BC520000-0x00007FF4BC61A000-memory.dmp
memory/4412-157-0x000002C0B88E0000-0x000002C0B88E7000-memory.dmp
memory/4412-162-0x00007FF4BC520000-0x00007FF4BC61A000-memory.dmp
memory/4412-163-0x00007FF4BC520000-0x00007FF4BC61A000-memory.dmp
memory/4412-164-0x00007FF4BC520000-0x00007FF4BC61A000-memory.dmp
memory/4412-165-0x00007FF4BC520000-0x00007FF4BC61A000-memory.dmp