Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/04/2023, 13:45

General

  • Target

    73abcf36bebe7fe725dd0ac7b7dfafe13572b6dcc3f3e6ca8b9c1329b43648a1.exe

  • Size

    352KB

  • MD5

    005a01ca85dd07925406bc75012374fc

  • SHA1

    ea867e76596ca39b5f71d2c2e0ae64de75bd1b7d

  • SHA256

    73abcf36bebe7fe725dd0ac7b7dfafe13572b6dcc3f3e6ca8b9c1329b43648a1

  • SHA512

    fae49acb01c90cf855a79813e6e3ffc90434245cd2cb7b1f9a7d9a753241a025486dc637d99bb91faeaaef5b047eb486bf05ebf05f90f972e3349a341d06aa99

  • SSDEEP

    6144:/2pCM5m2yZbIAot2b6lo8DfPr4jyduZVB7we4:/2Do2yFIAot2boo8jrIiUVB7t4

Malware Config

Extracted

Family

smokeloader

Botnet

pub4

Extracted

Family

smokeloader

Version

2022

C2

http://aapu.at/tmp/

http://poudineh.com/tmp/

http://firsttrusteedrx.ru/tmp/

http://kingpirate.ru/tmp/

rc4.i32
rc4.i32

Extracted

Family

rhadamanthys

C2

http://179.43.142.201/img/favicon.png

Signatures

  • Detect rhadamanthys stealer shellcode 4 IoCs
  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\73abcf36bebe7fe725dd0ac7b7dfafe13572b6dcc3f3e6ca8b9c1329b43648a1.exe
    "C:\Users\Admin\AppData\Local\Temp\73abcf36bebe7fe725dd0ac7b7dfafe13572b6dcc3f3e6ca8b9c1329b43648a1.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:4052
  • C:\Users\Admin\AppData\Local\Temp\5D91.exe
    C:\Users\Admin\AppData\Local\Temp\5D91.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:448
    • C:\Windows\system32\dllhost.exe
      "C:\Windows\system32\dllhost.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Checks processor information in registry
      • outlook_office_path
      • outlook_win_path
      PID:2000
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 636
      2⤵
      • Program crash
      PID:4208
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 448 -ip 448
    1⤵
      PID:4432

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\5D91.exe

            Filesize

            424KB

            MD5

            bc19b47e06fc27425839ca0346c78aef

            SHA1

            423a177b539878ce4edced3e207dcdb95b392427

            SHA256

            c90741a043ee54880a939009935f65d458437c3f25ef66d0388a1b8083aec99c

            SHA512

            56d7a24efcf34883cec2ae32625109c9e65e0396d21de0b5530d455b10e9942ae4cd06e77f2162622d29148ce3e925710362ab9c35ea26cce80e05655529874d

          • C:\Users\Admin\AppData\Local\Temp\5D91.exe

            Filesize

            424KB

            MD5

            bc19b47e06fc27425839ca0346c78aef

            SHA1

            423a177b539878ce4edced3e207dcdb95b392427

            SHA256

            c90741a043ee54880a939009935f65d458437c3f25ef66d0388a1b8083aec99c

            SHA512

            56d7a24efcf34883cec2ae32625109c9e65e0396d21de0b5530d455b10e9942ae4cd06e77f2162622d29148ce3e925710362ab9c35ea26cce80e05655529874d

          • memory/448-184-0x0000000002430000-0x000000000244C000-memory.dmp

            Filesize

            112KB

          • memory/448-183-0x0000000000400000-0x000000000080F000-memory.dmp

            Filesize

            4.1MB

          • memory/448-179-0x0000000002480000-0x0000000002482000-memory.dmp

            Filesize

            8KB

          • memory/448-177-0x0000000002430000-0x000000000244C000-memory.dmp

            Filesize

            112KB

          • memory/448-176-0x0000000002450000-0x000000000246A000-memory.dmp

            Filesize

            104KB

          • memory/448-175-0x0000000002430000-0x000000000244C000-memory.dmp

            Filesize

            112KB

          • memory/448-174-0x0000000002430000-0x000000000244C000-memory.dmp

            Filesize

            112KB

          • memory/448-171-0x0000000000400000-0x000000000080F000-memory.dmp

            Filesize

            4.1MB

          • memory/448-170-0x0000000002400000-0x000000000242E000-memory.dmp

            Filesize

            184KB

          • memory/1040-207-0x0000000003250000-0x0000000003259000-memory.dmp

            Filesize

            36KB

          • memory/1040-192-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-152-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-153-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-154-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-155-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-156-0x0000000007460000-0x0000000007470000-memory.dmp

            Filesize

            64KB

          • memory/1040-158-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-160-0x00000000074D0000-0x00000000074E0000-memory.dmp

            Filesize

            64KB

          • memory/1040-161-0x00000000074D0000-0x00000000074E0000-memory.dmp

            Filesize

            64KB

          • memory/1040-159-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-157-0x00000000074D0000-0x00000000074E0000-memory.dmp

            Filesize

            64KB

          • memory/1040-162-0x00000000074D0000-0x00000000074E0000-memory.dmp

            Filesize

            64KB

          • memory/1040-163-0x00000000074D0000-0x00000000074E0000-memory.dmp

            Filesize

            64KB

          • memory/1040-164-0x00000000074D0000-0x00000000074E0000-memory.dmp

            Filesize

            64KB

          • memory/1040-150-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-149-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-148-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-147-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-146-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-145-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-144-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-143-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-229-0x00000000029B0000-0x00000000029C0000-memory.dmp

            Filesize

            64KB

          • memory/1040-142-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-228-0x00000000029B0000-0x00000000029C0000-memory.dmp

            Filesize

            64KB

          • memory/1040-227-0x00000000029B0000-0x00000000029C0000-memory.dmp

            Filesize

            64KB

          • memory/1040-226-0x0000000002950000-0x0000000002952000-memory.dmp

            Filesize

            8KB

          • memory/1040-225-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-135-0x0000000000E80000-0x0000000000E96000-memory.dmp

            Filesize

            88KB

          • memory/1040-224-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-223-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-222-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-221-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-189-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-190-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-191-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-151-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-193-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-194-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-196-0x0000000008550000-0x0000000008552000-memory.dmp

            Filesize

            8KB

          • memory/1040-197-0x0000000003250000-0x0000000003260000-memory.dmp

            Filesize

            64KB

          • memory/1040-195-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-198-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-199-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-200-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-201-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-202-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-203-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-204-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-205-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-206-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-220-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-208-0x0000000003250000-0x0000000003260000-memory.dmp

            Filesize

            64KB

          • memory/1040-209-0x0000000008550000-0x0000000008552000-memory.dmp

            Filesize

            8KB

          • memory/1040-210-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-211-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-212-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-213-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-214-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-215-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-216-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-217-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-218-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/1040-219-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

            Filesize

            64KB

          • memory/2000-188-0x00007FF4F9750000-0x00007FF4F984A000-memory.dmp

            Filesize

            1000KB

          • memory/2000-187-0x00007FF4F9750000-0x00007FF4F984A000-memory.dmp

            Filesize

            1000KB

          • memory/2000-186-0x00007FF4F9750000-0x00007FF4F984A000-memory.dmp

            Filesize

            1000KB

          • memory/2000-185-0x00007FF4F9750000-0x00007FF4F984A000-memory.dmp

            Filesize

            1000KB

          • memory/2000-182-0x00007FF4F9750000-0x00007FF4F984A000-memory.dmp

            Filesize

            1000KB

          • memory/2000-181-0x00007FF4F9750000-0x00007FF4F984A000-memory.dmp

            Filesize

            1000KB

          • memory/2000-180-0x0000021135D50000-0x0000021135D57000-memory.dmp

            Filesize

            28KB

          • memory/2000-178-0x0000021135A40000-0x0000021135A41000-memory.dmp

            Filesize

            4KB

          • memory/4052-134-0x0000000000950000-0x0000000000959000-memory.dmp

            Filesize

            36KB

          • memory/4052-136-0x0000000000400000-0x00000000007FD000-memory.dmp

            Filesize

            4.0MB