Analysis
-
max time kernel
149s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
25-06-2022 17:45
Static task
static1
Behavioral task
behavioral1
Sample
3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe
Resource
win10v2004-20220414-en
General
-
Target
3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe
-
Size
1.5MB
-
MD5
e7418166327850a7fa1b63e83e608115
-
SHA1
ef5697e60c83b41953bb6f9f04cb3a0d3a71fc2e
-
SHA256
3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a
-
SHA512
c8b07a467ae66635b57b915b65b0a97d930183c0c3857f2e3b020079221b5ede1dd51f4f9b8ede661fc4dad8d4c5146870bc1480f64a1971c28cf70d4ffff3eb
Malware Config
Extracted
smokeloader
2017
http://dogewareservice.ru/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exedescription ioc process File created C:\Windows\assembly\Desktop.ini 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe File opened for modification C:\Windows\assembly\Desktop.ini 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exedescription pid process target process PID 552 set thread context of 2632 552 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe -
Drops file in Windows directory 3 IoCs
Processes:
3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exedescription ioc process File opened for modification C:\Windows\assembly 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe File created C:\Windows\assembly\Desktop.ini 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe File opened for modification C:\Windows\assembly\Desktop.ini 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4592 2432 WerFault.exe explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exepid process 552 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 552 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 552 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 552 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 552 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exepid process 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exedescription pid process Token: SeDebugPrivilege 552 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exedescription pid process target process PID 552 wrote to memory of 2632 552 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe PID 552 wrote to memory of 2632 552 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe PID 552 wrote to memory of 2632 552 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe PID 552 wrote to memory of 2632 552 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe PID 552 wrote to memory of 2632 552 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe PID 552 wrote to memory of 2632 552 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe PID 552 wrote to memory of 2632 552 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe PID 2632 wrote to memory of 2432 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe explorer.exe PID 2632 wrote to memory of 2432 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe explorer.exe PID 2632 wrote to memory of 2432 2632 3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe"C:\Users\Admin\AppData\Local\Temp\3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe"C:\Users\Admin\AppData\Local\Temp\3921ed60cb4c8f6f4f958de1c1c5c9461838f6bcb9f410bf8b5065723bd4144a.exe"2⤵
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 11164⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 2432 -ip 24321⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/552-130-0x0000000074A00000-0x0000000074FB1000-memory.dmpFilesize
5.7MB
-
memory/552-135-0x0000000074A00000-0x0000000074FB1000-memory.dmpFilesize
5.7MB
-
memory/552-137-0x0000000074A00000-0x0000000074FB1000-memory.dmpFilesize
5.7MB
-
memory/2432-136-0x0000000000000000-mapping.dmp
-
memory/2432-138-0x00000000009B0000-0x0000000000DE3000-memory.dmpFilesize
4.2MB
-
memory/2432-139-0x0000000000700000-0x000000000070A000-memory.dmpFilesize
40KB
-
memory/2432-141-0x0000000000700000-0x000000000070A000-memory.dmpFilesize
40KB
-
memory/2632-132-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/2632-131-0x0000000000000000-mapping.dmp
-
memory/2632-133-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/2632-134-0x0000000000B70000-0x0000000000B7A000-memory.dmpFilesize
40KB
-
memory/2632-140-0x0000000000B70000-0x0000000000B7A000-memory.dmpFilesize
40KB