Analysis

  • max time kernel
    152s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/04/2023, 04:25

General

  • Target

    a9353c9a335015483da3fa4f603006b11d3a56ef655919067fef8a1d62da1426.exe

  • Size

    351KB

  • MD5

    ba811b8357bf79af703ed5a7c50f44e4

  • SHA1

    1fbfa51ce0370b13a20d7b5c35f938a6b925da87

  • SHA256

    a9353c9a335015483da3fa4f603006b11d3a56ef655919067fef8a1d62da1426

  • SHA512

    7b4997e42325308c81a5049a10a5aecde6455a11aee8224c05d03bdc0bf1436b3b99da3ff7df9e4b12dfc338735c45135e91b276a1b382f009b74c5b9a23c90e

  • SSDEEP

    3072:caNCAkzztSfIBIOCkflzgG04b8chS66O7NPdrbuqx0w1AXqTHrZ9TwPOrK/42SvQ:XN++SZCcn04k+II0wkqTLZpXTi

Malware Config

Extracted

Family

smokeloader

Botnet

pub4

Extracted

Family

smokeloader

Version

2022

C2

http://aapu.at/tmp/

http://poudineh.com/tmp/

http://firsttrusteedrx.ru/tmp/

http://kingpirate.ru/tmp/

rc4.i32
rc4.i32

Extracted

Family

rhadamanthys

C2

http://179.43.142.201/img/favicon.png

Signatures

  • Detect rhadamanthys stealer shellcode 4 IoCs
  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a9353c9a335015483da3fa4f603006b11d3a56ef655919067fef8a1d62da1426.exe
    "C:\Users\Admin\AppData\Local\Temp\a9353c9a335015483da3fa4f603006b11d3a56ef655919067fef8a1d62da1426.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:4356
  • C:\Users\Admin\AppData\Local\Temp\2049.exe
    C:\Users\Admin\AppData\Local\Temp\2049.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:832
    • C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Checks processor information in registry
      • outlook_office_path
      • outlook_win_path
      PID:1756
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 832 -s 732
      2⤵
      • Program crash
      PID:412
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 832 -ip 832
    1⤵
      PID:4756

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\2049.exe

            Filesize

            423KB

            MD5

            cb2ba6d4940dc8abede20595ac94b3ea

            SHA1

            dbbc0e0723d92f12dce9a724624c36b40c545f0d

            SHA256

            cbcfd42a6ec669bf0f770a837ea751aa342b21256c6186e19d9931d47ca1ffef

            SHA512

            02702f91de518d5f318d01aba51faeac99bc4e94e7edf3dd978a55724eed24b12510c450860ef2b6610b648bbbc9741f97501814aa2861af44f80bf994a735b2

          • C:\Users\Admin\AppData\Local\Temp\2049.exe

            Filesize

            423KB

            MD5

            cb2ba6d4940dc8abede20595ac94b3ea

            SHA1

            dbbc0e0723d92f12dce9a724624c36b40c545f0d

            SHA256

            cbcfd42a6ec669bf0f770a837ea751aa342b21256c6186e19d9931d47ca1ffef

            SHA512

            02702f91de518d5f318d01aba51faeac99bc4e94e7edf3dd978a55724eed24b12510c450860ef2b6610b648bbbc9741f97501814aa2861af44f80bf994a735b2

          • memory/832-187-0x0000000000990000-0x00000000009AC000-memory.dmp

            Filesize

            112KB

          • memory/832-186-0x0000000000990000-0x00000000009AC000-memory.dmp

            Filesize

            112KB

          • memory/832-180-0x0000000000960000-0x000000000098E000-memory.dmp

            Filesize

            184KB

          • memory/832-182-0x0000000000400000-0x000000000080F000-memory.dmp

            Filesize

            4.1MB

          • memory/832-188-0x00000000009B0000-0x00000000009CA000-memory.dmp

            Filesize

            104KB

          • memory/832-189-0x0000000000990000-0x00000000009AC000-memory.dmp

            Filesize

            112KB

          • memory/832-191-0x00000000009B0000-0x00000000009CA000-memory.dmp

            Filesize

            104KB

          • memory/832-196-0x0000000000990000-0x00000000009AC000-memory.dmp

            Filesize

            112KB

          • memory/832-195-0x0000000000400000-0x000000000080F000-memory.dmp

            Filesize

            4.1MB

          • memory/1756-194-0x00007FF48D900000-0x00007FF48D9FA000-memory.dmp

            Filesize

            1000KB

          • memory/1756-193-0x00007FF48D900000-0x00007FF48D9FA000-memory.dmp

            Filesize

            1000KB

          • memory/1756-192-0x00000139F05E0000-0x00000139F05E7000-memory.dmp

            Filesize

            28KB

          • memory/1756-197-0x00007FF48D900000-0x00007FF48D9FA000-memory.dmp

            Filesize

            1000KB

          • memory/1756-190-0x00000139F02D0000-0x00000139F02D1000-memory.dmp

            Filesize

            4KB

          • memory/1756-198-0x00007FF48D900000-0x00007FF48D9FA000-memory.dmp

            Filesize

            1000KB

          • memory/1756-199-0x00007FF48D900000-0x00007FF48D9FA000-memory.dmp

            Filesize

            1000KB

          • memory/1756-200-0x00007FF48D900000-0x00007FF48D9FA000-memory.dmp

            Filesize

            1000KB

          • memory/1756-201-0x00007FF48D900000-0x00007FF48D9FA000-memory.dmp

            Filesize

            1000KB

          • memory/3244-204-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-149-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-163-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-164-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-165-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-166-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-167-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-168-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-169-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-170-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-171-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-173-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-175-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-172-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-176-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-177-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-178-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-179-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-157-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-181-0x0000000000960000-0x000000000098E000-memory.dmp

            Filesize

            184KB

          • memory/3244-158-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-183-0x0000000000960000-0x000000000098E000-memory.dmp

            Filesize

            184KB

          • memory/3244-256-0x0000000001240000-0x0000000001242000-memory.dmp

            Filesize

            8KB

          • memory/3244-156-0x0000000002C10000-0x0000000002C20000-memory.dmp

            Filesize

            64KB

          • memory/3244-142-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-155-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-154-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-153-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-152-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-151-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-150-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-135-0x0000000002BD0000-0x0000000002BE6000-memory.dmp

            Filesize

            88KB

          • memory/3244-148-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-147-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-146-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-145-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-144-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-143-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-202-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-203-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-257-0x0000000001250000-0x0000000001253000-memory.dmp

            Filesize

            12KB

          • memory/3244-205-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-206-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-207-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-208-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-209-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-210-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-211-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-212-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-213-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-214-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-215-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-216-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-217-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-218-0x00000000079F0000-0x00000000079F2000-memory.dmp

            Filesize

            8KB

          • memory/3244-219-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-220-0x0000000002C00000-0x0000000002C10000-memory.dmp

            Filesize

            64KB

          • memory/3244-235-0x0000000000D70000-0x0000000000D79000-memory.dmp

            Filesize

            36KB

          • memory/3244-236-0x0000000000D70000-0x0000000000D79000-memory.dmp

            Filesize

            36KB

          • memory/3244-237-0x0000000000D70000-0x0000000000D79000-memory.dmp

            Filesize

            36KB

          • memory/3244-238-0x0000000000D70000-0x0000000000D79000-memory.dmp

            Filesize

            36KB

          • memory/3244-239-0x0000000000D70000-0x0000000000D79000-memory.dmp

            Filesize

            36KB

          • memory/4356-134-0x0000000000A50000-0x0000000000A59000-memory.dmp

            Filesize

            36KB

          • memory/4356-136-0x0000000000400000-0x00000000007FD000-memory.dmp

            Filesize

            4.0MB