Analysis
-
max time kernel
181s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
16-04-2023 12:34
General
-
Target
e1333b612da8a0435c3e071f057db334c9fec56bd93b51bf0dbfe323eb5045ac.exe
-
Size
346KB
-
MD5
c18d4f024539b85c0d7ed51ea005862a
-
SHA1
f993e69da6d138ab50b895d2960134ae1475acca
-
SHA256
e1333b612da8a0435c3e071f057db334c9fec56bd93b51bf0dbfe323eb5045ac
-
SHA512
a2ad691f7afdc70c5f55ee2eb3ac8c06852586a6f3b527a60592ba74d86c21da2f59364b1e085ced04e815a310e05131e8c402d24d75c5377a8cdca4139e76ba
-
SSDEEP
6144:wnB9sYL1okAQ9hZyGiXr6B8QONeVXh+yJA/oF4wbe4:wnLsIBAQ9hZLio8Qae/LAwF4wq4
Malware Config
Extracted
smokeloader
sprg
Extracted
smokeloader
2022
http://hoh0aeghwugh2gie.com/
http://hie7doodohpae4na.com/
http://aek0aicifaloh1yo.com/
http://yic0oosaeiy7ahng.com/
http://wa5zu7sekai8xeih.com/
Extracted
vidar
3.4
e749025c61b2caca10aa829a9e1a65a1
https://steamcommunity.com/profiles/76561199494593681
https://t.me/auftriebs
-
profile_id_v2
e749025c61b2caca10aa829a9e1a65a1
-
user_agent
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:105.0) Gecko/20100101 Firefox/105.0
Extracted
laplas
http://185.106.92.74
-
api_key
bc2dceabe69fa26dbf4dd8295d65e03e1990633a88c1c8410825c9266b239396
Signatures
-
Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 6 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Accesses 2FA software files, possible credential harvesting 2 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 6 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 49 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Delays execution with timeout.exe 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 4 IoCs
-
Modifies registry class 19 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 19 IoCs
-
Suspicious use of AdjustPrivilegeToken 38 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1333b612da8a0435c3e071f057db334c9fec56bd93b51bf0dbfe323eb5045ac.exe"C:\Users\Admin\AppData\Local\Temp\e1333b612da8a0435c3e071f057db334c9fec56bd93b51bf0dbfe323eb5045ac.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\E1AA.exeC:\Users\Admin\AppData\Local\Temp\E1AA.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\41536376213023398657.exe"C:\ProgramData\41536376213023398657.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe"C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe"3⤵
- Executes dropped EXE
-
-
-
C:\ProgramData\60424203220090539797.exe"C:\ProgramData\60424203220090539797.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\ProgramData\60424203220090539797.exe3⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 04⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\E1AA.exe" & exit2⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 24002⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\EEAB.exeC:\Users\Admin\AppData\Local\Temp\EEAB.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 9722⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 10682⤵
- Program crash
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 9842⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 9722⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 1402⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\F8ED.exeC:\Users\Admin\AppData\Local\Temp\F8ED.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2564 -ip 25641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2564 -ip 25641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2564 -ip 25641⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2564 -ip 25641⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2564 -ip 25641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5104 -ip 51041⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.7MB
MD53bc6d011a6c3d265bcc0f04075eaaf0e
SHA1a2b389d5a0fd9e06c33eba512aa6ac51cee53e0d
SHA256c73e76cac5d6f6b9dae7327586d2240db1eff444fca0689f23c2f66d9737f7fa
SHA5120b75a073d6952a901738d30b04aaf911f57434b44f339c320a3815bbffe606ae52a2ff5fdc473a1e9aa1162e567705b4767630e1378ff1538b2d96c963aed3ed
-
Filesize
6.7MB
MD53bc6d011a6c3d265bcc0f04075eaaf0e
SHA1a2b389d5a0fd9e06c33eba512aa6ac51cee53e0d
SHA256c73e76cac5d6f6b9dae7327586d2240db1eff444fca0689f23c2f66d9737f7fa
SHA5120b75a073d6952a901738d30b04aaf911f57434b44f339c320a3815bbffe606ae52a2ff5fdc473a1e9aa1162e567705b4767630e1378ff1538b2d96c963aed3ed
-
Filesize
6.7MB
MD53bc6d011a6c3d265bcc0f04075eaaf0e
SHA1a2b389d5a0fd9e06c33eba512aa6ac51cee53e0d
SHA256c73e76cac5d6f6b9dae7327586d2240db1eff444fca0689f23c2f66d9737f7fa
SHA5120b75a073d6952a901738d30b04aaf911f57434b44f339c320a3815bbffe606ae52a2ff5fdc473a1e9aa1162e567705b4767630e1378ff1538b2d96c963aed3ed
-
Filesize
4.3MB
MD5c4ab3149ef02a36d663699a8c541933e
SHA167088f5eff9ec575775b711c9e3650d12d7f4d5c
SHA2560a0fbd6af9e5d110118f02b87f9a92f9f58fb100f6d9883d55a6aae6c548b4ce
SHA51288b10f81b2cd273fefeffb4c2078807e89b4b756d50110b61e9f89092715f29ba8d1803f64bc971c1293dc624b92d0b7f05612ae661dd8d24e47d39047a4b7b4
-
Filesize
4.3MB
MD5c4ab3149ef02a36d663699a8c541933e
SHA167088f5eff9ec575775b711c9e3650d12d7f4d5c
SHA2560a0fbd6af9e5d110118f02b87f9a92f9f58fb100f6d9883d55a6aae6c548b4ce
SHA51288b10f81b2cd273fefeffb4c2078807e89b4b756d50110b61e9f89092715f29ba8d1803f64bc971c1293dc624b92d0b7f05612ae661dd8d24e47d39047a4b7b4
-
Filesize
4.3MB
MD5c4ab3149ef02a36d663699a8c541933e
SHA167088f5eff9ec575775b711c9e3650d12d7f4d5c
SHA2560a0fbd6af9e5d110118f02b87f9a92f9f58fb100f6d9883d55a6aae6c548b4ce
SHA51288b10f81b2cd273fefeffb4c2078807e89b4b756d50110b61e9f89092715f29ba8d1803f64bc971c1293dc624b92d0b7f05612ae661dd8d24e47d39047a4b7b4
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
28KB
MD51b93501eb8760fe7ef3b0cbad97a4934
SHA1cf1d5eebc18c23d95b7818b54c4ca707acf785b3
SHA256c50f664e9d0db015e1060f9c1c418164ce5ab7dc7b1cd3f8e8dae688d0e734ca
SHA51292972f59e606ab4d4b9420e71737a5a93c4c769b10fdc63337d16889c7854553c0325296c6fdb572a9147b53b60b3579b1a224815bb0df38fae2d320f23653e3
-
Filesize
467KB
MD5e14718b9843e34635d519ab4075ce752
SHA1de9fbd477157cfe36861c81ac9dec6711a90c85c
SHA2565e829cccedcaf95154fe177c9dc5c217259a1036f09552e02c77808d065035af
SHA512eb7a3635565189eb5dfc633f5e3b0a795826d18625e538613f93b60bd06675516d247e881f3363314d507f05530bbdec0e836e7eaa42fa903ca9923c39aa1963
-
Filesize
467KB
MD5e14718b9843e34635d519ab4075ce752
SHA1de9fbd477157cfe36861c81ac9dec6711a90c85c
SHA2565e829cccedcaf95154fe177c9dc5c217259a1036f09552e02c77808d065035af
SHA512eb7a3635565189eb5dfc633f5e3b0a795826d18625e538613f93b60bd06675516d247e881f3363314d507f05530bbdec0e836e7eaa42fa903ca9923c39aa1963
-
Filesize
5.4MB
MD519b50e116e3708c663672d9c6e5a02f7
SHA1f2fcb880b1448f745dc525e192e0b13199363946
SHA256a9b3a6990f77252738e89a4880dba0f331cb151c0dfda1ddd0d5002aa907479e
SHA5125b42f712c5a3b6af0c163eb3fc30a85b74458711ca7c6ff2ff2eebdd2b7951f7080384f59bff850a2e49c052d1ce4da34c8d7d22b76ab82f99dc1ffe240af7cf
-
Filesize
5.4MB
MD519b50e116e3708c663672d9c6e5a02f7
SHA1f2fcb880b1448f745dc525e192e0b13199363946
SHA256a9b3a6990f77252738e89a4880dba0f331cb151c0dfda1ddd0d5002aa907479e
SHA5125b42f712c5a3b6af0c163eb3fc30a85b74458711ca7c6ff2ff2eebdd2b7951f7080384f59bff850a2e49c052d1ce4da34c8d7d22b76ab82f99dc1ffe240af7cf
-
Filesize
1.4MB
MD550d71bbcdc326b964d33e0ed668ee274
SHA1a86ff91a2d476140a8a948db6fe46bcd652256e5
SHA2566c9a84b2d280a6bfafc9a3ee2401af74784585e81fa91569da189dedf29b297d
SHA512fd61ae716c3b55753f512d5fb9ed023be99a5bc21bbc2ebb877ba81b29302bd25865e36dd4e3e412873036db6fe5962dd91bd192204ac1ae09e50d8e2a7e6696
-
Filesize
1.4MB
MD550d71bbcdc326b964d33e0ed668ee274
SHA1a86ff91a2d476140a8a948db6fe46bcd652256e5
SHA2566c9a84b2d280a6bfafc9a3ee2401af74784585e81fa91569da189dedf29b297d
SHA512fd61ae716c3b55753f512d5fb9ed023be99a5bc21bbc2ebb877ba81b29302bd25865e36dd4e3e412873036db6fe5962dd91bd192204ac1ae09e50d8e2a7e6696
-
Filesize
810.7MB
MD50b3c794d1871f4cebd86bdea17ad1894
SHA18638e6125d13ef2eccc49dfb541cb4d7705f648f
SHA256a2d84e7318264d0d978fb5c0be15394e6547392a98edf0b21082a59c13f2294f
SHA512514d638b9c3b57d8292b609342432ced303efda54cc1455d76a1ed0e867a83c247d21349f7e1742621c24d55b2b4797705a6f9a02dad9b6f976c884fc52fbd35
-
Filesize
810.7MB
MD50b3c794d1871f4cebd86bdea17ad1894
SHA18638e6125d13ef2eccc49dfb541cb4d7705f648f
SHA256a2d84e7318264d0d978fb5c0be15394e6547392a98edf0b21082a59c13f2294f
SHA512514d638b9c3b57d8292b609342432ced303efda54cc1455d76a1ed0e867a83c247d21349f7e1742621c24d55b2b4797705a6f9a02dad9b6f976c884fc52fbd35
-
Filesize
24KB
-
Filesize
48KB
-
Filesize
24KB
-
Filesize
48KB
-
Filesize
44KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
44KB
-
Filesize
11.2MB
-
Filesize
5.4MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
11.2MB
-
Filesize
11.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
11.2MB
-
Filesize
4KB
-
Filesize
4.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
156KB
-
Filesize
136KB
-
Filesize
156KB
-
Filesize
136KB
-
Filesize
4KB
-
Filesize
88KB
-
Filesize
36KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
36KB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
120KB
-
Filesize
240KB
-
Filesize
6.1MB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
472KB
-
Filesize
1.8MB
-
Filesize
160KB
-
Filesize
5.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
52KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
20KB
-
Filesize
14.4MB
-
Filesize
14.4MB
-
Filesize
4KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
11.2MB
-
Filesize
11.2MB
-
Filesize
11.2MB
-
Filesize
4KB
-
Filesize
11.2MB
-
Filesize
11.2MB
-
Filesize
4KB
-
Filesize
11.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
10.1MB
-
Filesize
11.2MB
-
Filesize
11.2MB
-
Filesize
4KB
-
Filesize
11.2MB
-
Filesize
11.2MB
-
Filesize
11.2MB
-
Filesize
11.2MB
-
Filesize
11.2MB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
44KB
-
Filesize
1.4MB
-
Filesize
5.6MB
-
Filesize
40KB
-
Filesize
624KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
64KB
-
Filesize
36KB
-
Filesize
20KB
-
Filesize
36KB
-
Filesize
20KB
-
Filesize
36KB
-
Filesize
4.0MB
-
Filesize
972KB
-
Filesize
4.1MB
-
Filesize
348KB