Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
14-07-2023 23:34
General
-
Target
c9666af965998eddcc1f1e03f97040435bf00ff0a557945cba96cbff93c286db.exe
-
Size
164KB
-
MD5
ef0ecd2f11d3b6bd090474db2a2432ba
-
SHA1
67127f642d92296aaa7f7d3ba9fbac77bdfaad33
-
SHA256
c9666af965998eddcc1f1e03f97040435bf00ff0a557945cba96cbff93c286db
-
SHA512
ab7f818fe9f4f018af87f187a7c63c8aa6157e1b30b0f8ac2077ccf8c3c8fa787049f35353cb31a4f49e37bc9e4f8ea0d354bf84453f73fccd0230c90313810e
-
SSDEEP
3072:XiML/SFYg65k6NZt313UZgdrOiCToYGzN2uLK5wY:XVL/nDk6jteZgQoYGz3LPY
Malware Config
Extracted
smokeloader
summ
Extracted
smokeloader
2022
http://stalagmijesarl.com/
http://ukdantist-sarl.com/
http://cpcorprotationltd.com/
Extracted
lumma
gstatic-node.io
Signatures
-
Detect rhadamanthys stealer shellcode 6 IoCs
-
Lumma Stealer
An infostealer written in C++ first seen in August 2022.
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
-
Renames multiple (65) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
-
Downloads MZ/PE file
-
Modifies Windows Firewall 1 TTPs 2 IoCs
-
Drops startup file 1 IoCs
-
Executes dropped EXE 7 IoCs
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 3 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Program crash 3 IoCs
-
Checks SCSI registry key(s) 3 TTPs 10 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 20 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c9666af965998eddcc1f1e03f97040435bf00ff0a557945cba96cbff93c286db.exe"C:\Users\Admin\AppData\Local\Temp\c9666af965998eddcc1f1e03f97040435bf00ff0a557945cba96cbff93c286db.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\3FE2.exeC:\Users\Admin\AppData\Local\Temp\3FE2.exe2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 10163⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\488E.exeC:\Users\Admin\AppData\Local\Temp\488E.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3900 -s 33363⤵
- Program crash
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵
-
C:\Windows\system32\certreq.exe"C:\Windows\system32\certreq.exe"2⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3128 -ip 31281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3900 -ip 39001⤵
-
C:\Users\Admin\AppData\Local\Microsoft\vm[R1ZQW.exe"C:\Users\Admin\AppData\Local\Microsoft\vm[R1ZQW.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\vm[R1ZQW.exe"C:\Users\Admin\AppData\Local\Microsoft\vm[R1ZQW.exe"2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Microsoft\y6[Gi4`1.exe"C:\Users\Admin\AppData\Local\Microsoft\y6[Gi4`1.exe"1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\y6[Gi4`1.exe"C:\Users\Admin\AppData\Local\Microsoft\y6[Gi4`1.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 4283⤵
- Program crash
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off3⤵
- Modifies Windows Firewall
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
-
C:\Users\Admin\AppData\Local\Microsoft\tSsr`r.exe"C:\Users\Admin\AppData\Local\Microsoft\tSsr`r.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4984 -ip 49841⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD57687e74daa74f44efabb51f5efe72bc3
SHA1d87a3a810e0caa2d95210c0eaff1061973094b27
SHA256647eb7d6cb9777be0fdac10fa0b8c919127f781936e26658020cc8cb9f1a1961
SHA512e676a69fd8d42f0d21f7e85078910075fa741344868f92295a6749d757451e2497b1b54f538032845f7505efbe71fd53b0bb640ca96a76728e6db053b74a9058
-
Filesize
164KB
MD56ac14216327dcfb60b33ebd914f62769
SHA1d55eba9a523347f5ee65c9e27a3dc73a1eb4cf7b
SHA25625f77a058ec8aff36602762a75066b3ba52652ce90fc823b51dc81e4b14bbeb9
SHA5126af659cfee302b0faefd85a87bc0aa3e10c40aeb18c6246cf2b335a34b40c21279f1b76ae420217f2caa3913d66e96116860ce442fad5fe465d2273de79ff3ed
-
Filesize
164KB
MD56ac14216327dcfb60b33ebd914f62769
SHA1d55eba9a523347f5ee65c9e27a3dc73a1eb4cf7b
SHA25625f77a058ec8aff36602762a75066b3ba52652ce90fc823b51dc81e4b14bbeb9
SHA5126af659cfee302b0faefd85a87bc0aa3e10c40aeb18c6246cf2b335a34b40c21279f1b76ae420217f2caa3913d66e96116860ce442fad5fe465d2273de79ff3ed
-
Filesize
164KB
MD509d7f30d2f8432be6087038562a029dd
SHA107fc20446a03a20c191e750ef21737ec948d9544
SHA2568c7319e9b6bd1ec0fa5658aaf55096a7e549b21a380de406c705969f165cb3f8
SHA512abc4670991a0a109a292d36f2b5116685374d0c85c157eefac3b44e240050b51c41839b8df4ffdad3ef6460dcd70c2b9457492c7d486fccd7a48e931cebacf7e
-
Filesize
164KB
MD509d7f30d2f8432be6087038562a029dd
SHA107fc20446a03a20c191e750ef21737ec948d9544
SHA2568c7319e9b6bd1ec0fa5658aaf55096a7e549b21a380de406c705969f165cb3f8
SHA512abc4670991a0a109a292d36f2b5116685374d0c85c157eefac3b44e240050b51c41839b8df4ffdad3ef6460dcd70c2b9457492c7d486fccd7a48e931cebacf7e
-
Filesize
164KB
MD509d7f30d2f8432be6087038562a029dd
SHA107fc20446a03a20c191e750ef21737ec948d9544
SHA2568c7319e9b6bd1ec0fa5658aaf55096a7e549b21a380de406c705969f165cb3f8
SHA512abc4670991a0a109a292d36f2b5116685374d0c85c157eefac3b44e240050b51c41839b8df4ffdad3ef6460dcd70c2b9457492c7d486fccd7a48e931cebacf7e
-
Filesize
164KB
MD5de348ef9eed7ccdaed5a70ae15796a86
SHA142914d94e8024ca94e58bb4bd9cfa4d0ae524975
SHA256a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855
SHA512605bdb115b9fc95b1c0924f01b3b62b27737d94fe97825e81ebc5f1de107a317bd47fbe88be9d2ac4e6b3c9d0d537a8b38986b24480a54495442c6206e9eb163
-
Filesize
164KB
MD5de348ef9eed7ccdaed5a70ae15796a86
SHA142914d94e8024ca94e58bb4bd9cfa4d0ae524975
SHA256a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855
SHA512605bdb115b9fc95b1c0924f01b3b62b27737d94fe97825e81ebc5f1de107a317bd47fbe88be9d2ac4e6b3c9d0d537a8b38986b24480a54495442c6206e9eb163
-
Filesize
164KB
MD5de348ef9eed7ccdaed5a70ae15796a86
SHA142914d94e8024ca94e58bb4bd9cfa4d0ae524975
SHA256a2333bcbbdbf6846ea6945637f93ecc2500a32bbfa9032c4cc39021a4e41a855
SHA512605bdb115b9fc95b1c0924f01b3b62b27737d94fe97825e81ebc5f1de107a317bd47fbe88be9d2ac4e6b3c9d0d537a8b38986b24480a54495442c6206e9eb163
-
Filesize
374KB
MD5aaf3d68aeea347268ede50e621ca21ce
SHA10e7c0e38a200a9ea3af663dfd33941cc5e1657c9
SHA25609c9bc026f600cb19848ba96858b3dbfe13f03358dc0703818d3bfa3d632d416
SHA51261416225031cbb74114ee61e3f7ce697e73423c75a0f2e96f51557b3d289ad868034e2e07ead926cd12a95b524ed37cf1626dc75dc99c47fac9cb8f843002bd0
-
Filesize
374KB
MD5aaf3d68aeea347268ede50e621ca21ce
SHA10e7c0e38a200a9ea3af663dfd33941cc5e1657c9
SHA25609c9bc026f600cb19848ba96858b3dbfe13f03358dc0703818d3bfa3d632d416
SHA51261416225031cbb74114ee61e3f7ce697e73423c75a0f2e96f51557b3d289ad868034e2e07ead926cd12a95b524ed37cf1626dc75dc99c47fac9cb8f843002bd0
-
Filesize
290KB
MD56d35d4cb11e99f8645441b0f1f96da3d
SHA13b6e12da0c1c37d38db867ab6330ace34461c56a
SHA2569066d830ae21197499f19a044054b0ea96f5be17cbb246714e15f36f32312204
SHA51201b5b75ce608f55f70c6471bb20f0a248116ef902f4bd602b5cf11fed747e0af9b811fbe74d393895672806f2b525900c6cef0ce889229d27032683a5e591aa4
-
Filesize
290KB
MD56d35d4cb11e99f8645441b0f1f96da3d
SHA13b6e12da0c1c37d38db867ab6330ace34461c56a
SHA2569066d830ae21197499f19a044054b0ea96f5be17cbb246714e15f36f32312204
SHA51201b5b75ce608f55f70c6471bb20f0a248116ef902f4bd602b5cf11fed747e0af9b811fbe74d393895672806f2b525900c6cef0ce889229d27032683a5e591aa4
-
Filesize
908KB
-
Filesize
1024KB
-
Filesize
36KB
-
Filesize
908KB
-
Filesize
36KB
-
Filesize
28KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
28KB
-
Filesize
32KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
28KB
-
Filesize
44KB
-
Filesize
28KB
-
Filesize
44KB
-
Filesize
36KB
-
Filesize
20KB
-
Filesize
36KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
216KB
-
Filesize
1024KB
-
Filesize
4.0MB
-
Filesize
1.1MB
-
Filesize
4.0MB
-
Filesize
216KB
-
Filesize
1024KB
-
Filesize
452KB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
1.1MB
-
Filesize
4.0MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
452KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
88KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
36KB
-
Filesize
60KB
-
Filesize
36KB
-
Filesize
60KB
-
Filesize
1.0MB
-
Filesize
1024KB
-
Filesize
340KB
-
Filesize
1.0MB
-
Filesize
1024KB
-
Filesize
340KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
2.0MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
12KB
-
Filesize
1.2MB
-
Filesize
12KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
156KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
156KB