Analysis
-
max time kernel
151s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
15/04/2023, 16:20
General
-
Target
26f4bb629b1edcf4164fe8dbea1fb6c9ee2c7f0ef4cb2febd8a38fc5205fb278.exe
-
Size
352KB
-
MD5
cf7534f90446600755811c889eb30fb8
-
SHA1
db19771e20ceaa9c07f14358cbaa7b3af4563591
-
SHA256
26f4bb629b1edcf4164fe8dbea1fb6c9ee2c7f0ef4cb2febd8a38fc5205fb278
-
SHA512
bf2b1079e94d8e64c3a2a366d256e6da7ec7348720884b3dfd8cc3ed0072eded868ae685e81b01cd29fbd8d3ab96b318d17ec41300e0c598d9680cd17356e312
-
SSDEEP
3072:WBX5CuZY4eXCSieZSlZ+cU2odYzr6dB6a1eDq+hbWerOr6NYz2/UkNB5cF2l+OV9:aX644N4ljASDrh6C4z28H8we4
Malware Config
Extracted
smokeloader
pub4
Extracted
smokeloader
2022
http://aapu.at/tmp/
http://poudineh.com/tmp/
http://firsttrusteedrx.ru/tmp/
http://kingpirate.ru/tmp/
Extracted
rhadamanthys
http://179.43.142.201/img/favicon.png
Signatures
-
Detect rhadamanthys stealer shellcode 4 IoCs
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
-
Program crash 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 14 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\26f4bb629b1edcf4164fe8dbea1fb6c9ee2c7f0ef4cb2febd8a38fc5205fb278.exe"C:\Users\Admin\AppData\Local\Temp\26f4bb629b1edcf4164fe8dbea1fb6c9ee2c7f0ef4cb2febd8a38fc5205fb278.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\979C.exeC:\Users\Admin\AppData\Local\Temp\979C.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\dllhost.exe"C:\Windows\system32\dllhost.exe"2⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- outlook_office_path
- outlook_win_path
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3660 -s 6962⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3660 -ip 36601⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
424KB
MD5f7cb5d405f6785a1064662caef14c6c7
SHA138b3b8be69a18c727958fb18b2c4e53b93105f84
SHA256cedea09dd4ba32091c16cb187e4291aa53a5e5580701b8706fb136a78b72edd9
SHA51262fa320ca229738d44d312b919fcadaa275fb0ffca74656a86d907ed9cddfaae7fe57de893c3647e61c53e207bc4737e846c4b2dbcf644255d89593b8870a638
-
Filesize
424KB
MD5f7cb5d405f6785a1064662caef14c6c7
SHA138b3b8be69a18c727958fb18b2c4e53b93105f84
SHA256cedea09dd4ba32091c16cb187e4291aa53a5e5580701b8706fb136a78b72edd9
SHA51262fa320ca229738d44d312b919fcadaa275fb0ffca74656a86d907ed9cddfaae7fe57de893c3647e61c53e207bc4737e846c4b2dbcf644255d89593b8870a638
-
Filesize
64KB
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
88KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
112KB
-
Filesize
184KB
-
Filesize
4.1MB
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
104KB
-
Filesize
112KB
-
Filesize
4.1MB
-
Filesize
104KB
-
Filesize
1000KB
-
Filesize
28KB
-
Filesize
1000KB
-
Filesize
4KB
-
Filesize
1000KB
-
Filesize
1000KB
-
Filesize
1000KB
-
Filesize
1000KB
-
Filesize
1000KB
-
Filesize
36KB
-
Filesize
4.0MB