Analysis
-
max time kernel
1s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
30/03/2025, 07:32
General
-
Target
2025-03-30_704245ea86ce3e9c6e7253b951f59b5c_amadey_nymaim_rhadamanthys_smoke-loader.exe
-
Size
1.4MB
-
MD5
704245ea86ce3e9c6e7253b951f59b5c
-
SHA1
46897e1b9fc6af38d1b7d4df4c1daa081fba6b7f
-
SHA256
d0cd4b16f61ef801ff6b0b57cd4a5d11d8ad204371bd57e7c4f4539ab5fccad5
-
SHA512
786b6e882e15af9243a5467c120b4b9e193884eeacd32faca30ee05ed808b1c0a736d380347ec88036f6f5dd4b94053e299fad926783988ccfbeb2373d854b16
-
SSDEEP
24576:fhrG5gX9qqY7tl96R7VOKjPgRe05OkhCOJDLonUc98hJNDpevFDsz5tJrPQ:fhZtRY73y1j4ReE4m8nR98PVpeszjW
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
Sality family
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 6 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 5 IoCs
-
Windows security modification 2 TTPs 7 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory 13 IoCs
-
UPX packed file 32 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 26 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\2025-03-30_704245ea86ce3e9c6e7253b951f59b5c_amadey_nymaim_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-30_704245ea86ce3e9c6e7253b951f59b5c_amadey_nymaim_rhadamanthys_smoke-loader.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\2025-03-30_704245ea86ce3e9c6e7253b951f59b5c_amadey_nymaim_rhadamanthys_smoke-loader.exeC:\Users\Admin\AppData\Local\Temp\2025-03-30_704245ea86ce3e9c6e7253b951f59b5c_amadey_nymaim_rhadamanthys_smoke-loader.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Users\Admin\AppData\Local\Temp\2025-03-30_704245ea86ce3e9c6e7253b951f59b5c_amadey_nymaim_rhadamanthys_smoke-loader4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\9E3B3C\E37CC5.EXEC:\Windows\system32\9E3B3C\E37CC5.EXE4⤵
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5822b87850f9a9c8da533a613c931871e
SHA14ab5203ac233b56a0f82ff10e3c57746bcd3d287
SHA2565ba7756baf8f244f54b6b3618ff8e44cc9e94899c669a1d688fa44f70f287d06
SHA5123ce7b3dee309c6af13cafbcbedbd0d38805ca0a302c0311ac2567bcdf0d4453213c888c785a0e3fe4190a9ac1aa93458f413b343b67e7b936669ab07099738f7
-
Filesize
56KB
MD5fb7ea6f8ae09fa7621ee13f86c4f2935
SHA1d93676c39ad0181dad70a662c41fc4c280cce848
SHA256bdc314d45af6a5afaed2663e63817902e80f9a18ba1965947c314b433e05bfb0
SHA512e15111dda54bcab507c20e910f8257d2dec2830bfbc5f69e5286ce37cabb79237ce8fb1c813b2d82fa7bed0c2df89e2940ceebde358162553290224cf0866749
-
Filesize
1.1MB
MD5cf46bb62a1ba559ceb0fad7a5d642f28
SHA180b63dd193e84bfacbe535587dd38471b8ea2c24
SHA256fe4bba1a99b332c8bbd196d3a2f3c78d9edc8f212842ff2efef17eba38427f67
SHA5121f71f31fdc1ef7695d7a6e79218a9192804178bb2af80486de4f8ff3d7e176860813a61fa265bf78fe4ff722a85b72798938d715d8a2a034ac759505197a1058
-
Filesize
111KB
MD5e2b86e9a37fe4f85bbf0d08af28690a2
SHA1d56b2d2a21cdf5661a17e32be5c71004eb558896
SHA256b05ad065919cee4748075a182d681215c645c7cc3fdf9a06bfd18f7ebb067c91
SHA5126cb065b121f11ee2700b22dd1cf9c9f4d44808261cc9ff2fac36165f42291598b708fa2501264d5c0dfc3df71e7bd6a3d22f9fff70e23d064733e488d49ee082
-
Filesize
260KB
MD5ce2f773275d3fe8b78f4cf067d5e6a0f
SHA1b7135e34d46eb4303147492d5cee5e1ef7b392ab
SHA256eb8099c0ad2d82d9d80530443e2909f3b34be0844d445e844f1c994476c86d2d
SHA512d733dc01c047be56680629a385abdd2aa1598a2b5459269028446da9097b6f6c1e7ade5b74e3ac3809dd8a3f8d1cbbe7fd669f2762be61f9c38fd4a2cca9e063
-
Filesize
112KB
MD56d4b2e73f6f8ecff02f19f7e8ef9a8c7
SHA109c32ca167136a17fd69df8c525ea5ffeca6c534
SHA256fe5783e64aa70fac10c2e42d460732d9770534357329d8bc78576557c165f040
SHA5122fd7a95cb632e9c4ac6b34e5b6b875aae94e73cd4b1f213e78f46dadab4846227a030776461bca08f9d75a1d61a0d45427f7b0c8b71406b7debc14db04b2ce04
-
Filesize
312KB
MD5936745bac5c873ab1a91478d27894626
SHA19ed92393f95692339ce03a8f1498f80c727e0555
SHA256edfbe514d330e942ecd50dd7331659d59df27668e762d5a00e43df67f5f08630
SHA51232d15337ab7a62ff25802c04bd782f5be36012f1a5251d962226a8e8e2daa7bc0a35b9cbfb67889d3b9dbc5f6cc51f924bae963ae12619249b22f2cc9aa2bbd4
-
Filesize
40KB
MD5d54753e7fc3ea03aec0181447969c0e8
SHA1824e7007b6569ae36f174c146ae1b7242f98f734
SHA256192608ff371400c1529aa05f1adba0fe4fdd769fcbf35ee5f8b4f78a838a7ec9
SHA512c25ed4cb38d5d5e95a267979f0f3f9398c04a1bf5822dceb03d6f6d9b4832dfb227f1e6868327e52a0303f45c36b9ba806e75b16bd7419a7c5203c2ecbae838f
-
Filesize
240KB
MD5d04ecdfe09ed0a18e329094de6497fc5
SHA18785ade539f63c2e36b16f6b2654e814e7c6bf74
SHA256a8e58035a411cbbc6d40a1cbfe0ea428aa3c1f0589add5f7fff2f086a6054d14
SHA51283aee713c42365920db66a18e9f3e6a7ad653e40ee8914b9c4867c94937665fdc0812ef68559b0cf17ac00e60436a4f33cfdb68dd02167a866399331a732f248
-
Filesize
100KB
MD54a756d1d8d3adf70d829c8d77fe6819e
SHA1f401046da7468b00ff917283ea44516ced612357
SHA2561a9bb323270b9a5d17d327120be9f3dc3ccfc749d36d4cb944c0a11575aa5a85
SHA512ba8bc2a51948bd37aaa954f64aea04a717a604d3eb766de7cf79ca71b7723e0cf604892d9aedc0dd825043c25597641a7358c6235132e7fa9f9af19319f14ea5
-
Filesize
172KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
372KB
-
Filesize
68KB
-
Filesize
296KB
-
Filesize
4KB
-
Filesize
120KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
704KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
704KB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
456KB
-
Filesize
120KB
-
Filesize
68KB
-
Filesize
456KB
-
Filesize
80KB