Analysis
-
max time kernel
151s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
15/04/2023, 08:35
Static task
static1
Behavioral task
behavioral1
Sample
828bdd40bebbb1ff9d1524b539a9f592619b4be68e65e6c70a0579f364fb9a49.exe
Resource
win10v2004-20230220-en
General
-
Target
828bdd40bebbb1ff9d1524b539a9f592619b4be68e65e6c70a0579f364fb9a49.exe
-
Size
350KB
-
MD5
29899f4bdb072e6b043814e4c2e682bd
-
SHA1
8324ca39037e58eee12513d20477a00bdb2714c1
-
SHA256
828bdd40bebbb1ff9d1524b539a9f592619b4be68e65e6c70a0579f364fb9a49
-
SHA512
55b4b849d7ce42692840ca638f842601b9b23d2bab15f1395414176e4ae0083002d73aad2c291271ff29c64eb094360fdeee62debf7d13ac5976750275b0a6a8
-
SSDEEP
3072:Dd94UtR6y/CXve1w9z90gNAm2UGgcVZYQOIMrTuYYOUq3pgslTXHJj/xWGmfvIsy:DT4qCfe1EV2uUmuuf3pgsllJD5/taTi
Malware Config
Extracted
smokeloader
pub4
Extracted
smokeloader
2022
http://aapu.at/tmp/
http://poudineh.com/tmp/
http://firsttrusteedrx.ru/tmp/
http://kingpirate.ru/tmp/
Extracted
rhadamanthys
http://179.43.142.201/img/favicon.png
Signatures
-
Detect rhadamanthys stealer shellcode 4 IoCs
resource yara_rule behavioral1/memory/1528-151-0x0000000002480000-0x000000000249C000-memory.dmp family_rhadamanthys behavioral1/memory/1528-152-0x0000000002480000-0x000000000249C000-memory.dmp family_rhadamanthys behavioral1/memory/1528-154-0x0000000002480000-0x000000000249C000-memory.dmp family_rhadamanthys behavioral1/memory/1528-161-0x0000000002480000-0x000000000249C000-memory.dmp family_rhadamanthys -
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 1528 4C2C.exe -
Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook dllhost.exe Key opened \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook dllhost.exe Key opened \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook dllhost.exe Key opened \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook dllhost.exe Key opened \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook dllhost.exe Key opened \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook dllhost.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3568 1528 WerFault.exe 91 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 828bdd40bebbb1ff9d1524b539a9f592619b4be68e65e6c70a0579f364fb9a49.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 828bdd40bebbb1ff9d1524b539a9f592619b4be68e65e6c70a0579f364fb9a49.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 828bdd40bebbb1ff9d1524b539a9f592619b4be68e65e6c70a0579f364fb9a49.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dllhost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 dllhost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2652 828bdd40bebbb1ff9d1524b539a9f592619b4be68e65e6c70a0579f364fb9a49.exe 2652 828bdd40bebbb1ff9d1524b539a9f592619b4be68e65e6c70a0579f364fb9a49.exe 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found 768 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 768 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2652 828bdd40bebbb1ff9d1524b539a9f592619b4be68e65e6c70a0579f364fb9a49.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 768 Process not Found Token: SeCreatePagefilePrivilege 768 Process not Found -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 768 wrote to memory of 1528 768 Process not Found 91 PID 768 wrote to memory of 1528 768 Process not Found 91 PID 768 wrote to memory of 1528 768 Process not Found 91 PID 1528 wrote to memory of 4772 1528 4C2C.exe 92 PID 1528 wrote to memory of 4772 1528 4C2C.exe 92 PID 1528 wrote to memory of 4772 1528 4C2C.exe 92 PID 1528 wrote to memory of 4772 1528 4C2C.exe 92 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook dllhost.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook dllhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\828bdd40bebbb1ff9d1524b539a9f592619b4be68e65e6c70a0579f364fb9a49.exe"C:\Users\Admin\AppData\Local\Temp\828bdd40bebbb1ff9d1524b539a9f592619b4be68e65e6c70a0579f364fb9a49.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2652
-
C:\Users\Admin\AppData\Local\Temp\4C2C.exeC:\Users\Admin\AppData\Local\Temp\4C2C.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\system32\dllhost.exe"C:\Windows\system32\dllhost.exe"2⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- outlook_office_path
- outlook_win_path
PID:4772
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 6962⤵
- Program crash
PID:3568
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1528 -ip 15281⤵PID:4836
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
424KB
MD5c7013845630a13cd1161a9bce5482f67
SHA18f65a5509972092bb3087ac120c2cc741a41ea0b
SHA256076a0fb7ebf20a100ef850835a9cfe79d33e6dc797b78d267f92982ec75807f3
SHA512b4b6513c970a32b8459b0576ed81cf0f59c833ec9f311fd79a59a787ad9d514562f41916014e9a42f6e2a24ef6b458ab268727b5c906191c98bf758b7196dde5
-
Filesize
424KB
MD5c7013845630a13cd1161a9bce5482f67
SHA18f65a5509972092bb3087ac120c2cc741a41ea0b
SHA256076a0fb7ebf20a100ef850835a9cfe79d33e6dc797b78d267f92982ec75807f3
SHA512b4b6513c970a32b8459b0576ed81cf0f59c833ec9f311fd79a59a787ad9d514562f41916014e9a42f6e2a24ef6b458ab268727b5c906191c98bf758b7196dde5