Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
07/09/2022, 03:57
Static task
static1
Behavioral task
behavioral1
Sample
934b3e951a3fbe2aa624426fea6206dd112f2e1068ec1a0b779940704dbc75bc.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
934b3e951a3fbe2aa624426fea6206dd112f2e1068ec1a0b779940704dbc75bc.exe
-
Size
207KB
-
MD5
ba8fcce75ef8f44531d2cd8eb0d68e80
-
SHA1
54cd1cafacb49286c754ca31676776be47a1335a
-
SHA256
934b3e951a3fbe2aa624426fea6206dd112f2e1068ec1a0b779940704dbc75bc
-
SHA512
4a73b844667f719559a86dfa7e655343e64949b632b472f1b1f90fa76575a0c35dcbe631ddceb62f76cc818353ddf013b4284b70b6427e9ba3c2d3e077048127
-
SSDEEP
3072:EJHbP0VlR+eHqnMZeyu9qUSF0OdwWU65fAxRv4b+:VVgMZerlSF0Pa5fAx
Score
10/10
Malware Config
Signatures
-
Detects Smokeloader packer 4 IoCs
resource yara_rule behavioral1/memory/3604-133-0x0000000002E10000-0x0000000002E19000-memory.dmp family_smokeloader behavioral1/memory/4064-135-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/4064-137-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/4064-138-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3604 set thread context of 4064 3604 934b3e951a3fbe2aa624426fea6206dd112f2e1068ec1a0b779940704dbc75bc.exe 82 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 934b3e951a3fbe2aa624426fea6206dd112f2e1068ec1a0b779940704dbc75bc.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 934b3e951a3fbe2aa624426fea6206dd112f2e1068ec1a0b779940704dbc75bc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 934b3e951a3fbe2aa624426fea6206dd112f2e1068ec1a0b779940704dbc75bc.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4064 934b3e951a3fbe2aa624426fea6206dd112f2e1068ec1a0b779940704dbc75bc.exe 4064 934b3e951a3fbe2aa624426fea6206dd112f2e1068ec1a0b779940704dbc75bc.exe 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2724 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4064 934b3e951a3fbe2aa624426fea6206dd112f2e1068ec1a0b779940704dbc75bc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3604 wrote to memory of 4064 3604 934b3e951a3fbe2aa624426fea6206dd112f2e1068ec1a0b779940704dbc75bc.exe 82 PID 3604 wrote to memory of 4064 3604 934b3e951a3fbe2aa624426fea6206dd112f2e1068ec1a0b779940704dbc75bc.exe 82 PID 3604 wrote to memory of 4064 3604 934b3e951a3fbe2aa624426fea6206dd112f2e1068ec1a0b779940704dbc75bc.exe 82 PID 3604 wrote to memory of 4064 3604 934b3e951a3fbe2aa624426fea6206dd112f2e1068ec1a0b779940704dbc75bc.exe 82 PID 3604 wrote to memory of 4064 3604 934b3e951a3fbe2aa624426fea6206dd112f2e1068ec1a0b779940704dbc75bc.exe 82 PID 3604 wrote to memory of 4064 3604 934b3e951a3fbe2aa624426fea6206dd112f2e1068ec1a0b779940704dbc75bc.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\934b3e951a3fbe2aa624426fea6206dd112f2e1068ec1a0b779940704dbc75bc.exe"C:\Users\Admin\AppData\Local\Temp\934b3e951a3fbe2aa624426fea6206dd112f2e1068ec1a0b779940704dbc75bc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\934b3e951a3fbe2aa624426fea6206dd112f2e1068ec1a0b779940704dbc75bc.exe"C:\Users\Admin\AppData\Local\Temp\934b3e951a3fbe2aa624426fea6206dd112f2e1068ec1a0b779940704dbc75bc.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4064
-