Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
15/04/2023, 21:15
General
-
Target
76dd10a61c9c5b361d147bb841980200cc75fc1086c5db7291fc2461ed9e5292.exe
-
Size
352KB
-
MD5
b3ae41657a5f9c89ae96caebb09c0021
-
SHA1
1a0b9b48864f8fff463b5b7e3fd2cc8911afe40d
-
SHA256
76dd10a61c9c5b361d147bb841980200cc75fc1086c5db7291fc2461ed9e5292
-
SHA512
67bdc643d7b6b99cdee587b313462cdb5b356d2450b895500d8cf9efbf561c72b79bc28e6b98d19722be9bf2b634691bfd51041bd4575af6fe322e4f51e82a60
-
SSDEEP
3072:KBM5C6ZYc9IXCSiIZspc+cp02SYzr61Kba1eVxIhPBjvb06Ecdrx65B5cFnbl+OL:OMuMGNwpsBEOrIhP9TsSHBwe4
Malware Config
Extracted
smokeloader
pub4
Extracted
smokeloader
2022
http://aapu.at/tmp/
http://poudineh.com/tmp/
http://firsttrusteedrx.ru/tmp/
http://kingpirate.ru/tmp/
Extracted
rhadamanthys
http://179.43.142.201/img/favicon.png
Signatures
-
Detect rhadamanthys stealer shellcode 4 IoCs
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
-
Program crash 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\76dd10a61c9c5b361d147bb841980200cc75fc1086c5db7291fc2461ed9e5292.exe"C:\Users\Admin\AppData\Local\Temp\76dd10a61c9c5b361d147bb841980200cc75fc1086c5db7291fc2461ed9e5292.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\1F6F.exeC:\Users\Admin\AppData\Local\Temp\1F6F.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\dllhost.exe"C:\Windows\system32\dllhost.exe"2⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- outlook_office_path
- outlook_win_path
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4100 -s 7002⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4100 -ip 41001⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
424KB
MD51af6229f3d5d95510deeb9ac7677ef64
SHA1ced23ffb956d89ca07bcf425fe3a8f900f08ebd2
SHA256e90b966980543f422dbee87da402b0fd5b1e2a744ad49b89e293b588d2fb1545
SHA512e13dd65ab66c8863fb2ea23334923170bfb4a8bd1fe48fc86760d6eecc850f9e5c72bd22895f24e65cabd2bca16c4028145dc80bd1bcbf7047ee16ddd2944559
-
Filesize
424KB
MD51af6229f3d5d95510deeb9ac7677ef64
SHA1ced23ffb956d89ca07bcf425fe3a8f900f08ebd2
SHA256e90b966980543f422dbee87da402b0fd5b1e2a744ad49b89e293b588d2fb1545
SHA512e13dd65ab66c8863fb2ea23334923170bfb4a8bd1fe48fc86760d6eecc850f9e5c72bd22895f24e65cabd2bca16c4028145dc80bd1bcbf7047ee16ddd2944559
-
Filesize
88KB
-
Filesize
4KB
-
Filesize
1000KB
-
Filesize
1000KB
-
Filesize
1000KB
-
Filesize
1000KB
-
Filesize
1000KB
-
Filesize
1000KB
-
Filesize
28KB
-
Filesize
184KB
-
Filesize
12KB
-
Filesize
112KB
-
Filesize
8KB
-
Filesize
112KB
-
Filesize
4.1MB
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
4.1MB
-
Filesize
36KB
-
Filesize
4.0MB