Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
10/09/2022, 07:19
Static task
static1
Behavioral task
behavioral1
Sample
3ad22729734dc290ae32aba4d4389032713c4f6a5b92ced5f491480863e998fc.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
3ad22729734dc290ae32aba4d4389032713c4f6a5b92ced5f491480863e998fc.exe
-
Size
308KB
-
MD5
eacb0543d146e47c354ae8f75af13a62
-
SHA1
bf6491bee0efc78fa7fadc4949de0ce8ffe7bfd9
-
SHA256
3ad22729734dc290ae32aba4d4389032713c4f6a5b92ced5f491480863e998fc
-
SHA512
f79525f3901484b9b39a1b46aaa4c1336f1c027dd737531b3e65c9ebbb6f27b13dc9f3570d27e65853c731b2fd1f1d323e1c7fc0343a63b620e5afa66a688e29
-
SSDEEP
6144:5B1nyWGzio+In0rSK/tyvIULJIn53XwbGuMpW/cGPV7xX64:5aWGWTIn02K/kwULJInpOGulV7ZV
Score
10/10
Malware Config
Signatures
-
Detects Smokeloader packer 6 IoCs
resource yara_rule behavioral1/memory/2736-133-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/1928-135-0x0000000000A80000-0x0000000000A89000-memory.dmp family_smokeloader behavioral1/memory/2736-136-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/2736-137-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/816-144-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/816-145-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 2 IoCs
pid Process 1888 rajeefj 816 rajeefj -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1928 set thread context of 2736 1928 3ad22729734dc290ae32aba4d4389032713c4f6a5b92ced5f491480863e998fc.exe 84 PID 1888 set thread context of 816 1888 rajeefj 94 -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI rajeefj Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI rajeefj Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3ad22729734dc290ae32aba4d4389032713c4f6a5b92ced5f491480863e998fc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3ad22729734dc290ae32aba4d4389032713c4f6a5b92ced5f491480863e998fc.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3ad22729734dc290ae32aba4d4389032713c4f6a5b92ced5f491480863e998fc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI rajeefj -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Process not Found -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2736 3ad22729734dc290ae32aba4d4389032713c4f6a5b92ced5f491480863e998fc.exe 2736 3ad22729734dc290ae32aba4d4389032713c4f6a5b92ced5f491480863e998fc.exe 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2576 Process not Found -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2736 3ad22729734dc290ae32aba4d4389032713c4f6a5b92ced5f491480863e998fc.exe 816 rajeefj -
Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeShutdownPrivilege 2576 Process not Found Token: SeCreatePagefilePrivilege 2576 Process not Found Token: SeShutdownPrivilege 2576 Process not Found Token: SeCreatePagefilePrivilege 2576 Process not Found Token: SeShutdownPrivilege 2576 Process not Found Token: SeCreatePagefilePrivilege 2576 Process not Found Token: SeShutdownPrivilege 2576 Process not Found Token: SeCreatePagefilePrivilege 2576 Process not Found Token: SeShutdownPrivilege 2576 Process not Found Token: SeCreatePagefilePrivilege 2576 Process not Found -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2576 Process not Found 2576 Process not Found -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1928 wrote to memory of 2736 1928 3ad22729734dc290ae32aba4d4389032713c4f6a5b92ced5f491480863e998fc.exe 84 PID 1928 wrote to memory of 2736 1928 3ad22729734dc290ae32aba4d4389032713c4f6a5b92ced5f491480863e998fc.exe 84 PID 1928 wrote to memory of 2736 1928 3ad22729734dc290ae32aba4d4389032713c4f6a5b92ced5f491480863e998fc.exe 84 PID 1928 wrote to memory of 2736 1928 3ad22729734dc290ae32aba4d4389032713c4f6a5b92ced5f491480863e998fc.exe 84 PID 1928 wrote to memory of 2736 1928 3ad22729734dc290ae32aba4d4389032713c4f6a5b92ced5f491480863e998fc.exe 84 PID 1928 wrote to memory of 2736 1928 3ad22729734dc290ae32aba4d4389032713c4f6a5b92ced5f491480863e998fc.exe 84 PID 1888 wrote to memory of 816 1888 rajeefj 94 PID 1888 wrote to memory of 816 1888 rajeefj 94 PID 1888 wrote to memory of 816 1888 rajeefj 94 PID 1888 wrote to memory of 816 1888 rajeefj 94 PID 1888 wrote to memory of 816 1888 rajeefj 94 PID 1888 wrote to memory of 816 1888 rajeefj 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ad22729734dc290ae32aba4d4389032713c4f6a5b92ced5f491480863e998fc.exe"C:\Users\Admin\AppData\Local\Temp\3ad22729734dc290ae32aba4d4389032713c4f6a5b92ced5f491480863e998fc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\3ad22729734dc290ae32aba4d4389032713c4f6a5b92ced5f491480863e998fc.exe"C:\Users\Admin\AppData\Local\Temp\3ad22729734dc290ae32aba4d4389032713c4f6a5b92ced5f491480863e998fc.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2736
-
-
C:\Users\Admin\AppData\Roaming\rajeefjC:\Users\Admin\AppData\Roaming\rajeefj1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Roaming\rajeefjC:\Users\Admin\AppData\Roaming\rajeefj2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:816
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
308KB
MD5eacb0543d146e47c354ae8f75af13a62
SHA1bf6491bee0efc78fa7fadc4949de0ce8ffe7bfd9
SHA2563ad22729734dc290ae32aba4d4389032713c4f6a5b92ced5f491480863e998fc
SHA512f79525f3901484b9b39a1b46aaa4c1336f1c027dd737531b3e65c9ebbb6f27b13dc9f3570d27e65853c731b2fd1f1d323e1c7fc0343a63b620e5afa66a688e29
-
Filesize
308KB
MD5eacb0543d146e47c354ae8f75af13a62
SHA1bf6491bee0efc78fa7fadc4949de0ce8ffe7bfd9
SHA2563ad22729734dc290ae32aba4d4389032713c4f6a5b92ced5f491480863e998fc
SHA512f79525f3901484b9b39a1b46aaa4c1336f1c027dd737531b3e65c9ebbb6f27b13dc9f3570d27e65853c731b2fd1f1d323e1c7fc0343a63b620e5afa66a688e29
-
Filesize
308KB
MD5eacb0543d146e47c354ae8f75af13a62
SHA1bf6491bee0efc78fa7fadc4949de0ce8ffe7bfd9
SHA2563ad22729734dc290ae32aba4d4389032713c4f6a5b92ced5f491480863e998fc
SHA512f79525f3901484b9b39a1b46aaa4c1336f1c027dd737531b3e65c9ebbb6f27b13dc9f3570d27e65853c731b2fd1f1d323e1c7fc0343a63b620e5afa66a688e29