Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
28/08/2022, 03:26
Static task
static1
Behavioral task
behavioral1
Sample
1c1bbac4bfe1864619b6bc98c8e841ec.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
1c1bbac4bfe1864619b6bc98c8e841ec.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 1c1bbac4bfe1864619b6bc98c8e841ec.exe
- Size 131KB
- Sample220828-dy66psbfhl
- SHA256 6013a5fa7bb3261df7610b42485b5b4ae86dc04b7474206feec4c776b73eb9b3
- MD5 1c1bbac4bfe1864619b6bc98c8e841ec
- SHA1 1cd70f523f2e0efc739978248e361659fd2009d4
- SHA512 4d5ae45233fa3925e40e6e11523e7dca2f0807502bf824d13c88423bb6e9f4290a593201081435305e3ef2cfd41a5d53bfbccb9c6e3b21ddf6b5d1180d4ffa28
- SSDEEP 3072:dLGrXmkbOO3KNyBWE8tFt8gW8CveQOV5qRx:mXmkboyIEwFthW81QOV5qR
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 4 IoCs
resource yara_rule behavioral2/memory/3344-133-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral2/memory/4896-135-0x00000000004F0000-0x00000000004F9000-memory.dmp family_smokeloader behavioral2/memory/3344-136-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral2/memory/3344-137-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4896 set thread context of 3344 4896 1c1bbac4bfe1864619b6bc98c8e841ec.exe 82 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1c1bbac4bfe1864619b6bc98c8e841ec.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1c1bbac4bfe1864619b6bc98c8e841ec.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1c1bbac4bfe1864619b6bc98c8e841ec.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3344 1c1bbac4bfe1864619b6bc98c8e841ec.exe 3344 1c1bbac4bfe1864619b6bc98c8e841ec.exe 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2596 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3344 1c1bbac4bfe1864619b6bc98c8e841ec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4896 wrote to memory of 3344 4896 1c1bbac4bfe1864619b6bc98c8e841ec.exe 82 PID 4896 wrote to memory of 3344 4896 1c1bbac4bfe1864619b6bc98c8e841ec.exe 82 PID 4896 wrote to memory of 3344 4896 1c1bbac4bfe1864619b6bc98c8e841ec.exe 82 PID 4896 wrote to memory of 3344 4896 1c1bbac4bfe1864619b6bc98c8e841ec.exe 82 PID 4896 wrote to memory of 3344 4896 1c1bbac4bfe1864619b6bc98c8e841ec.exe 82 PID 4896 wrote to memory of 3344 4896 1c1bbac4bfe1864619b6bc98c8e841ec.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c1bbac4bfe1864619b6bc98c8e841ec.exe"C:\Users\Admin\AppData\Local\Temp\1c1bbac4bfe1864619b6bc98c8e841ec.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\1c1bbac4bfe1864619b6bc98c8e841ec.exe"C:\Users\Admin\AppData\Local\Temp\1c1bbac4bfe1864619b6bc98c8e841ec.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3344
-