Analysis
-
max time kernel
150s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
06-09-2022 12:59
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20220812-en
General
-
Target
tmp.exe
-
Size
37KB
-
MD5
b5930c6fbf0ecde4de2ba77415b97e18
-
SHA1
67cab99dc14822289f9b8d1f0fb0e9d73ff45825
-
SHA256
fe2a9057323a5a5d47a4ab3cf9f4f9f86037b395c440da7bfb1e4164bc10abc3
-
SHA512
63140881d7b03db395608b1fe095b0989aa2d87d017ae63eea34c8b3e04c3274ccc7ee31a4505c8334af1300844c4aec30a6a25dc692a34ec699b728a85620ea
-
SSDEEP
384:O9kt7+7uIb00ERLA6m8KXAX3H3JGm9bN1v5N9EJqgxWUrxMKQ4XyY:vNTIcI8tX9B55gqgxWFKQiH
Malware Config
Signatures
-
Detects Smokeloader packer 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1504-65-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/1504-66-0x0000000000402E0F-mapping.dmp family_smokeloader behavioral1/memory/1504-68-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/1504-69-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
tmp.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Amkufwqq = "\"C:\\Users\\Admin\\AppData\\Roaming\\Zsiicjamy\\Amkufwqq.exe\"" tmp.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
tmp.exedescription pid process target process PID 1600 set thread context of 1504 1600 tmp.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI InstallUtil.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI InstallUtil.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exeInstallUtil.exepid process 780 powershell.exe 1504 InstallUtil.exe 1504 InstallUtil.exe 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1208 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
InstallUtil.exepid process 1504 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
tmp.exepowershell.exedescription pid process Token: SeDebugPrivilege 1600 tmp.exe Token: SeDebugPrivilege 780 powershell.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
tmp.exedescription pid process target process PID 1600 wrote to memory of 780 1600 tmp.exe powershell.exe PID 1600 wrote to memory of 780 1600 tmp.exe powershell.exe PID 1600 wrote to memory of 780 1600 tmp.exe powershell.exe PID 1600 wrote to memory of 780 1600 tmp.exe powershell.exe PID 1600 wrote to memory of 1504 1600 tmp.exe InstallUtil.exe PID 1600 wrote to memory of 1504 1600 tmp.exe InstallUtil.exe PID 1600 wrote to memory of 1504 1600 tmp.exe InstallUtil.exe PID 1600 wrote to memory of 1504 1600 tmp.exe InstallUtil.exe PID 1600 wrote to memory of 1504 1600 tmp.exe InstallUtil.exe PID 1600 wrote to memory of 1504 1600 tmp.exe InstallUtil.exe PID 1600 wrote to memory of 1504 1600 tmp.exe InstallUtil.exe PID 1600 wrote to memory of 1504 1600 tmp.exe InstallUtil.exe PID 1600 wrote to memory of 1504 1600 tmp.exe InstallUtil.exe PID 1600 wrote to memory of 1504 1600 tmp.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:780 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1504