Analysis
- max time kernel
151s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
02/09/2022, 18:08
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target file.exe
- Size 282KB
- Sample220902-wqv3ksabcl
- SHA256 c5a960f514bdb54fb064a12f4c77e8fcc42bcb3fc1f0ef50f6c723faa173bf0c
- MD5 a0cc3de6d4f5d53294523e03bf25a44f
- SHA1 816fbba5681b2d039859bd20c556f7ecada5e3c4
- SHA512 d599102f23e2905979cd0cc4d3aac5a6c29a9360c98c7a9d4a93b6638c8602ffc12032340b22b6cbb28e6f83d61f31e25cf1ec8fd145c275b4cffeb5f8e4534a
- SSDEEP 6144:nAS1sUWXDGSU0SHwy+0lETWamuRbaJK8pjF4F:11IX6p7Hwy+0lE5muH8py
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/2412-133-0x0000000000910000-0x0000000000919000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 3 IoCs
pid Process 1728 77FF.exe 1288 rjgbtaf 1276 5947.exe - Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI rjgbtaf Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI rjgbtaf Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI rjgbtaf - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2412 file.exe 2412 file.exe 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2576 Process not Found - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2412 file.exe 1288 rjgbtaf - Suspicious use of AdjustPrivilegeToken 20 IoCs
description pid Process Token: SeShutdownPrivilege 2576 Process not Found Token: SeCreatePagefilePrivilege 2576 Process not Found Token: SeShutdownPrivilege 2576 Process not Found Token: SeCreatePagefilePrivilege 2576 Process not Found Token: SeShutdownPrivilege 2576 Process not Found Token: SeCreatePagefilePrivilege 2576 Process not Found Token: SeShutdownPrivilege 2576 Process not Found Token: SeCreatePagefilePrivilege 2576 Process not Found Token: SeShutdownPrivilege 2576 Process not Found Token: SeCreatePagefilePrivilege 2576 Process not Found Token: SeShutdownPrivilege 2576 Process not Found Token: SeCreatePagefilePrivilege 2576 Process not Found Token: SeShutdownPrivilege 2576 Process not Found Token: SeCreatePagefilePrivilege 2576 Process not Found Token: SeShutdownPrivilege 2576 Process not Found Token: SeCreatePagefilePrivilege 2576 Process not Found Token: SeShutdownPrivilege 2576 Process not Found Token: SeCreatePagefilePrivilege 2576 Process not Found Token: SeShutdownPrivilege 2576 Process not Found Token: SeCreatePagefilePrivilege 2576 Process not Found - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2576 wrote to memory of 1728 2576 Process not Found 87 PID 2576 wrote to memory of 1728 2576 Process not Found 87 PID 2576 wrote to memory of 1728 2576 Process not Found 87 PID 2576 wrote to memory of 1276 2576 Process not Found 97 PID 2576 wrote to memory of 1276 2576 Process not Found 97 PID 2576 wrote to memory of 1276 2576 Process not Found 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2412
-
C:\Users\Admin\AppData\Local\Temp\77FF.exeC:\Users\Admin\AppData\Local\Temp\77FF.exe1⤵
- Executes dropped EXE
PID:1728
-
C:\Users\Admin\AppData\Roaming\rjgbtafC:\Users\Admin\AppData\Roaming\rjgbtaf1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1288
-
C:\Users\Admin\AppData\Local\Temp\5947.exeC:\Users\Admin\AppData\Local\Temp\5947.exe1⤵
- Executes dropped EXE
PID:1276
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\5947.exe
- Size 607KB
- SHA256 c4a6b8ff9202be747aa1b2d663fec1c94f5d3fc856ce24785d3b03070f7561c7
- MD5 3eb3bf454410f45f23108b00c7f13ff6
- SHA1 a6818b33c83472c0ad77c8e663630244fddb889c
- SHA512 6969a8bf1a87a594b300152b9c7ea7f6330bc304f956e63672f20d5af412e9712bffe319c4da555edff8159fb8d7dfd08fc83a971be1eb33f7dbf6a901ef0f20
- SSDEEP 12288:s5Zu0mvMCQVnTKE6QQsL2g65P4ZgGngEiMH6puu1K4WCB4O3unAI+dNvPL4LsW:0w0mvMFNTKE6QQsTYEigju1KA4ObvusW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\5947.exe
- Size 607KB
- SHA256 c4a6b8ff9202be747aa1b2d663fec1c94f5d3fc856ce24785d3b03070f7561c7
- MD5 3eb3bf454410f45f23108b00c7f13ff6
- SHA1 a6818b33c83472c0ad77c8e663630244fddb889c
- SHA512 6969a8bf1a87a594b300152b9c7ea7f6330bc304f956e63672f20d5af412e9712bffe319c4da555edff8159fb8d7dfd08fc83a971be1eb33f7dbf6a901ef0f20
- SSDEEP 12288:s5Zu0mvMCQVnTKE6QQsL2g65P4ZgGngEiMH6puu1K4WCB4O3unAI+dNvPL4LsW:0w0mvMFNTKE6QQsTYEigju1KA4ObvusW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\77FF.exe
- Size 607KB
- SHA256 c4a6b8ff9202be747aa1b2d663fec1c94f5d3fc856ce24785d3b03070f7561c7
- MD5 3eb3bf454410f45f23108b00c7f13ff6
- SHA1 a6818b33c83472c0ad77c8e663630244fddb889c
- SHA512 6969a8bf1a87a594b300152b9c7ea7f6330bc304f956e63672f20d5af412e9712bffe319c4da555edff8159fb8d7dfd08fc83a971be1eb33f7dbf6a901ef0f20
- SSDEEP 12288:s5Zu0mvMCQVnTKE6QQsL2g65P4ZgGngEiMH6puu1K4WCB4O3unAI+dNvPL4LsW:0w0mvMFNTKE6QQsTYEigju1KA4ObvusW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\77FF.exe
- Size 607KB
- SHA256 c4a6b8ff9202be747aa1b2d663fec1c94f5d3fc856ce24785d3b03070f7561c7
- MD5 3eb3bf454410f45f23108b00c7f13ff6
- SHA1 a6818b33c83472c0ad77c8e663630244fddb889c
- SHA512 6969a8bf1a87a594b300152b9c7ea7f6330bc304f956e63672f20d5af412e9712bffe319c4da555edff8159fb8d7dfd08fc83a971be1eb33f7dbf6a901ef0f20
- SSDEEP 12288:s5Zu0mvMCQVnTKE6QQsL2g65P4ZgGngEiMH6puu1K4WCB4O3unAI+dNvPL4LsW:0w0mvMFNTKE6QQsTYEigju1KA4ObvusW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\rjgbtaf
- Size 282KB
- SHA256 c5a960f514bdb54fb064a12f4c77e8fcc42bcb3fc1f0ef50f6c723faa173bf0c
- MD5 a0cc3de6d4f5d53294523e03bf25a44f
- SHA1 816fbba5681b2d039859bd20c556f7ecada5e3c4
- SHA512 d599102f23e2905979cd0cc4d3aac5a6c29a9360c98c7a9d4a93b6638c8602ffc12032340b22b6cbb28e6f83d61f31e25cf1ec8fd145c275b4cffeb5f8e4534a
- SSDEEP 6144:nAS1sUWXDGSU0SHwy+0lETWamuRbaJK8pjF4F:11IX6p7Hwy+0lE5muH8py
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\rjgbtaf
- Size 282KB
- SHA256 c5a960f514bdb54fb064a12f4c77e8fcc42bcb3fc1f0ef50f6c723faa173bf0c
- MD5 a0cc3de6d4f5d53294523e03bf25a44f
- SHA1 816fbba5681b2d039859bd20c556f7ecada5e3c4
- SHA512 d599102f23e2905979cd0cc4d3aac5a6c29a9360c98c7a9d4a93b6638c8602ffc12032340b22b6cbb28e6f83d61f31e25cf1ec8fd145c275b4cffeb5f8e4534a
- SSDEEP 6144:nAS1sUWXDGSU0SHwy+0lETWamuRbaJK8pjF4F:11IX6p7Hwy+0lE5muH8py
- MD5 SHA1 SHA512 SSDEEP