Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
hOdgEiePTe.exe

Overview

General Information

Sample Name:hOdgEiePTe.exe
Analysis ID:654709
MD5:f3af35c6e121ff8fe96b0794e6f72d6b
SHA1:d9143edee2471a8205edadb5bf532bff3d9a88aa
SHA256:cef4f5f561b5c481c67e0a9a3dd751d18d696b61c7a5dab5ebb29535093741b4
Tags:exeTeamBot
Infos:

Detection

SmokeLoader, Vidar
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Benign windows process drops PE files
Detected unpacking (overwrites its own PE header)
Yara detected SmokeLoader
System process connects to network (likely due to code injection or exploit)
Yara detected Vidar stealer
Detected unpacking (changes PE section rights)
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Snort IDS alert for network traffic
Maps a DLL or memory area into another process
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Machine Learning detection for sample
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Deletes itself after installation
Machine Learning detection for dropped file
C2 URLs / IPs found in malware configuration
Creates a thread in another existing process (thread injection)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Found many strings related to Crypto-Wallets (likely being stolen)
Checks if the current machine is a virtual machine (disk enumeration)
Tries to harvest and steal browser information (history, passwords, etc)
Uses 32bit PE files
Drops PE files to the application program directory (C:\ProgramData)
Contains functionality to query locales information (e.g. system language)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Yara detected Credential Stealer
JA3 SSL client fingerprint seen in connection with other malware
Contains functionality to call native functions
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Creates a DirectInput object (often for capturing keystrokes)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Drops files with a non-matching file extension (content does not match file extension)
Found inlined nop instructions (likely shell or obfuscated code)
PE file contains strange resources
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Checks if the current process is being debugged
Registers a DLL

Classification

Process Tree

  • System is w10x64
  • hOdgEiePTe.exe (PID: 6352 cmdline: "C:\Users\user\Desktop\hOdgEiePTe.exe" MD5: F3AF35C6E121FF8FE96B0794E6F72D6B)
    • explorer.exe (PID: 3968 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)
      • 900B.exe (PID: 3076 cmdline: C:\Users\user\AppData\Local\Temp\900B.exe MD5: E1806DF573470FC02E4271A8AA1E9D95)
      • regsvr32.exe (PID: 412 cmdline: regsvr32 /s C:\Users\user\AppData\Local\Temp\5D03.dll MD5: D78B75FC68247E8A63ACBA846182740E)
        • regsvr32.exe (PID: 5984 cmdline: /s C:\Users\user\AppData\Local\Temp\5D03.dll MD5: 426E7499F6A7346F0410DEAD0805586B)
      • 7791.exe (PID: 1824 cmdline: C:\Users\user\AppData\Local\Temp\7791.exe MD5: 5AD1BEF6F9DF3C527F7217DCCD26C2D5)
  • hcthhbi (PID: 6328 cmdline: C:\Users\user\AppData\Roaming\hcthhbi MD5: F3AF35C6E121FF8FE96B0794E6F72D6B)
  • cleanup

Malware Configuration

Threatname: SmokeLoader

{"C2 list": ["http://piratia.su/tmp/", "http://piratia-life.ru/tmp/", "http://diewebseite.at/tmp/", "http://faktync.com/tmp/", "http://mupsin.ru/tmp/", "http://aingular.com/tmp/", "http://mordo.ru/tmp/"]}

Threatname: Vidar

{"C2 url": ["https://t.me/ch_inagroup", "https://mastodon.social/@olegf9844e"]}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000016.00000002.485561355.0000000000C80000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_SmokeLoader_2Yara detected SmokeLoaderJoe Security
    00000002.00000000.317713525.0000000002851000.00000020.80000000.00040000.00000000.sdmpJoeSecurity_SmokeLoader_2Yara detected SmokeLoaderJoe Security
      0000001D.00000003.515106259.00000000027E0000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_Vidar_1Yara detected Vidar stealerJoe Security
        0000001D.00000002.648449578.0000000002790000.00000040.00001000.00020000.00000000.sdmpJoeSecurity_Vidar_1Yara detected Vidar stealerJoe Security
          0000000D.00000002.382652287.00000000004C0000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_SmokeLoader_2Yara detected SmokeLoaderJoe Security
            Click to see the 8 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            29.3.7791.exe.27e0000.0.raw.unpackJoeSecurity_Vidar_1Yara detected Vidar stealerJoe Security
              29.2.7791.exe.400000.0.unpackJoeSecurity_Vidar_1Yara detected Vidar stealerJoe Security
                29.3.7791.exe.27e0000.0.unpackJoeSecurity_Vidar_1Yara detected Vidar stealerJoe Security
                  29.2.7791.exe.2790e67.1.raw.unpackJoeSecurity_Vidar_1Yara detected Vidar stealerJoe Security
                    29.2.7791.exe.400000.0.raw.unpackJoeSecurity_Vidar_1Yara detected Vidar stealerJoe Security
                      Click to see the 1 entries

                      Sigma Signatures

                      ⊘No Sigma rule has matched

                      Snort Signatures

                      Timestamp:159.69.101.170192.168.2.380497922035911 06/29/22-23:12:20.334596
                      SID:2035911
                      Source Port:80
                      Destination Port:49792
                      Protocol:TCP
                      Classtype:A Network Trojan was detected

                      Joe Sandbox Signatures

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection

                      barindex
                      Multi AV Scanner detection for submitted file
                      Source: hOdgEiePTe.exeVirustotal: Detection: 59%Perma Link
                      Source: hOdgEiePTe.exeMetadefender: Detection: 37%Perma Link
                      Source: hOdgEiePTe.exeReversingLabs: Detection: 80%
                      Antivirus detection for URL or domain
                      Source: http://piratia.su/tmp/Avira URL Cloud: Label: malware
                      Source: http://159.69.101.170/4798399205.zipAvira URL Cloud: Label: malware
                      Source: http://159.69.101.170/Avira URL Cloud: Label: malware
                      Source: http://159.69.101.170/4798399205.zip/1415Avira URL Cloud: Label: malware
                      Source: https://amarillavida.com/upload/chrome.exeAvira URL Cloud: Label: malware
                      Source: http://mupsin.ru/tmp/Avira URL Cloud: Label: malware
                      Source: http://159.69.101.170/1415Avira URL Cloud: Label: malware
                      Source: http://linislominyt11.at/Avira URL Cloud: Label: malware
                      Source: http://diewebseite.at/tmp/Avira URL Cloud: Label: malware
                      Multi AV Scanner detection for domain / URL
                      Source: monsutiur4.comVirustotal: Detection: 19%Perma Link
                      Multi AV Scanner detection for dropped file
                      Source: C:\Users\user\AppData\Local\Temp\5D03.dllReversingLabs: Detection: 27%
                      Source: C:\Users\user\AppData\Local\Temp\7791.exeReversingLabs: Detection: 69%
                      Machine Learning detection for sample
                      Source: hOdgEiePTe.exeJoe Sandbox ML: detected
                      Machine Learning detection for dropped file
                      Source: C:\Users\user\AppData\Roaming\efthhbiJoe Sandbox ML: detected
                      Source: C:\Users\user\AppData\Local\Temp\7791.exeJoe Sandbox ML: detected
                      Source: C:\Users\user\AppData\Local\Temp\900B.exeJoe Sandbox ML: detected
                      Source: C:\Users\user\AppData\Roaming\hcthhbiJoe Sandbox ML: detected
                      Source: C:\Users\user\AppData\Local\Temp\5D03.dllJoe Sandbox ML: detected
                      Source: 00000016.00000002.485561355.0000000000C80000.00000004.00000800.00020000.00000000.sdmpMalware Configuration Extractor: SmokeLoader {"C2 list": ["http://piratia.su/tmp/", "http://piratia-life.ru/tmp/", "http://diewebseite.at/tmp/", "http://faktync.com/tmp/", "http://mupsin.ru/tmp/", "http://aingular.com/tmp/", "http://mordo.ru/tmp/"]}
                      Source: 29.3.7791.exe.27e0000.0.raw.unpackMalware Configuration Extractor: Vidar {"C2 url": ["https://t.me/ch_inagroup", "https://mastodon.social/@olegf9844e"]}

                      Compliance

                      barindex
                      Detected unpacking (overwrites its own PE header)
                      Source: C:\Users\user\AppData\Local\Temp\7791.exeUnpacked PE file: 29.2.7791.exe.400000.0.unpack
                      Source: hOdgEiePTe.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
                      Source: C:\Users\user\Desktop\hOdgEiePTe.exeFile opened: C:\Windows\SysWOW64\msvcr100.dllJump to behavior
                      Source: unknownHTTPS traffic detected: 206.221.182.74:443 -> 192.168.2.3:49768 version: TLS 1.2
                      Source: unknownHTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.3:49789 version: TLS 1.2
                      Source: Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: 7791.exe, 0000001D.00000003.522252354.00000000278D1000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.29.dr
                      Source: Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: 7791.exe, 0000001D.00000003.526885473.00000000278D1000.00000004.00000800.00020000.00000000.sdmp, freebl3.dll.29.dr
                      Source: Binary string: C:\tezerevi\goxepupinob\cibuz.pdb source: efthhbi.2.dr, 900B.exe.2.dr
                      Source: Binary string: vcruntime140.i386.pdb source: vcruntime140.dll.29.dr
                      Source: Binary string: vcruntime140.i386.pdbGCTL source: vcruntime140.dll.29.dr
                      Source: Binary string: msvcp140.i386.pdbGCTL source: msvcp140.dll.29.dr
                      Source: Binary string: z:\task_1542148442\build\src\obj-thunderbird\mozglue\build\mozglue.pdb source: 7791.exe, 0000001D.00000003.525539795.00000000278D1000.00000004.00000800.00020000.00000000.sdmp, mozglue.dll.29.dr
                      Source: Binary string: JC:\vizujibuvu\gagaworavifiro\kivu\98-yodelatepi\piyon.pdb source: 7791.exe.2.dr
                      Source: Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: 7791.exe, 0000001D.00000003.522252354.00000000278D1000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.29.dr
                      Source: Binary string: z:\task_1542148442\build\src\obj-thunderbird\mozglue\build\mozglue.pdb22! source: 7791.exe, 0000001D.00000003.525539795.00000000278D1000.00000004.00000800.00020000.00000000.sdmp, mozglue.dll.29.dr
                      Source: Binary string: C:\vizujibuvu\gagaworavifiro\kivu\98-yodelatepi\piyon.pdb source: 7791.exe.2.dr
                      Source: Binary string: C:\fusiki13\yurijekal59\tusezox99\racibog.pdb source: hOdgEiePTe.exe, hcthhbi.2.dr
                      Source: Binary string: KC:\tezerevi\goxepupinob\cibuz.pdbX source: efthhbi.2.dr, 900B.exe.2.dr
                      Source: Binary string: dPfxMaQ.pdb source: 5D03.dll.2.dr
                      Source: Binary string: .+C:\fusiki13\yurijekal59\tusezox99\racibog.pdb source: hOdgEiePTe.exe, hcthhbi.2.dr
                      Source: Binary string: msvcp140.i386.pdb source: msvcp140.dll.29.dr
                      Source: Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss3.pdb source: nss3.dll.29.dr
                      Source: Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: 7791.exe, 0000001D.00000003.526885473.00000000278D1000.00000004.00000800.00020000.00000000.sdmp, freebl3.dll.29.dr
                      Source: C:\Users\user\AppData\Local\Temp\7791.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\Jump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\7791.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\Jump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\7791.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\bg\Jump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\7791.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\Jump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\7791.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\Jump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\7791.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\Jump to behavior
                      Source: C:\Users\user\AppData\Local\Temp\900B.exeCode function: 4x nop then into 22_2_00C614E1
                      Source: C:\Users\user\AppData\Local\Temp\900B.exeCode function: 4x nop then call FFFFFFFFFF57121Ch22_2_00C61BE9
                      Source: C:\Users\user\AppData\Local\Temp\900B.exeCode function: 4x nop then call FFFFFFFFFF57121Ch22_2_00C61BF6
                      Source: C:\Users\user\AppData\Local\Temp\900B.exeCode function: 4x nop then jnp 00C61D6Fh22_2_00C61DAD
                      Source: C:\Users\user\AppData\Local\Temp\900B.exeCode function: 4x nop then jnp 00C62135h22_2_00C621BA
                      Source: C:\Users\user\AppData\Local\Temp\900B.exeCode function: 4x nop then call FFFFFFFFFF57121Ch22_2_00C61C00
                      Source: C:\Users\user\AppData\Local\Temp\900B.exeCode function: 4x nop then jnp 00C62135h