Analysis
-
max time kernel
0s -
max time network
103s -
platform
windows11-21h2_x64 -
resource
win11-20250410-en -
resource tags
-
submitted
22/04/2025, 06:55
General
-
Target
2025-04-22_dda55ffa9b136b8aba2adc6cbef38606_agent-tesla_amadey_backswap_elex_icedid_rhadamanthys_smoke-loader.exe
-
Size
2.6MB
-
MD5
dda55ffa9b136b8aba2adc6cbef38606
-
SHA1
77aa2e3062396070fe5bf7e80a8de24738a69b26
-
SHA256
b86cd7fb11d17abe7ad972ec3714f162e8a3bff8cefbc511ee9f96e9534d1194
-
SHA512
aa62234dafae415329ce37f4425e083cb179abd118ccf0ae9f1ea6ad7d710fa94a1c1252622ca28326907d477ec9666bdcff5fc43e96128861187ac7fd715788
-
SSDEEP
24576:5nWYXDaHMv6CorjqnyPQGzh0JONZejOuC+e4mOzrvxiI3ENyesg/jHLxQVIxX6Lb:tl1vqjdPQRw/D4mizA0dizLrB51vK
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in Program Files directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-04-22_dda55ffa9b136b8aba2adc6cbef38606_agent-tesla_amadey_backswap_elex_icedid_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2025-04-22_dda55ffa9b136b8aba2adc6cbef38606_agent-tesla_amadey_backswap_elex_icedid_rhadamanthys_smoke-loader.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Program Files\64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe"C:\Program Files\64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 C:\WINDOWS\Media\ActiveX.ocx /s2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
642KB
MD5d871f2c4088b8b4044a06352378e5f47
SHA11ac52a4fa15aaee20307c475ff0ef95351418074
SHA256bfc4f31183a35555e19d2095a743129b20949acbcb5ea43a5fbfaa0b7e624bfa
SHA512294a0cc0d8f89b077821ed97891dc693bdb6dd3f7b4436840f78e5663ece817cf6400d782f31ae33b8fdbbffa9c1691e2411fc9240d2100c2c1e2a4be71b2d68
-
Filesize
12B
MD563f7535c1e9af05c76b3e1f261ea623d
SHA16589367fa3358f1cfa73342975c2714432c1dfb7
SHA256d3c6f32c6760c7b7b0878038d3c32fc020de5604b039ba481782b2b3c4a7f2fa
SHA5125ec7ec839f89e24995853ae88ef4bc0c237a887db2eb1590962d8792a23022c42cca931ee937c3cfef59d22ad548bd7d375163ea9da62a7b9d2e271783e3db4d