Analysis
-
max time kernel
150s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
13/09/2022, 17:48
General
-
Target
3daa1a973b309ee9945b6d3fe0f9246c.exe
-
Size
291KB
-
MD5
3daa1a973b309ee9945b6d3fe0f9246c
-
SHA1
e8b5304b0efb50c0b5b507f945bca17207369ec6
-
SHA256
9d07d42192235ca3b5ee879a2d81f28313a427862ae10931306406ae5965092d
-
SHA512
762335076958bab673f6fa0c46808fac193e7b30ca0319e756f5c74c5b7761d6020b6f43a24cab7586e3a833370fac3ed40880d5b5f50be5e8583178f417ef6e
-
SSDEEP
6144:MaJGzDo8b+xDXr+9zl/G85V9b+HmJCH0q0n8G:MHz6xDXq1l/G85V9Koq
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3daa1a973b309ee9945b6d3fe0f9246c.exe"C:\Users\Admin\AppData\Local\Temp\3daa1a973b309ee9945b6d3fe0f9246c.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\thvhudeC:\Users\Admin\AppData\Roaming\thvhude1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
291KB
MD53daa1a973b309ee9945b6d3fe0f9246c
SHA1e8b5304b0efb50c0b5b507f945bca17207369ec6
SHA2569d07d42192235ca3b5ee879a2d81f28313a427862ae10931306406ae5965092d
SHA512762335076958bab673f6fa0c46808fac193e7b30ca0319e756f5c74c5b7761d6020b6f43a24cab7586e3a833370fac3ed40880d5b5f50be5e8583178f417ef6e
-
Filesize
291KB
MD53daa1a973b309ee9945b6d3fe0f9246c
SHA1e8b5304b0efb50c0b5b507f945bca17207369ec6
SHA2569d07d42192235ca3b5ee879a2d81f28313a427862ae10931306406ae5965092d
SHA512762335076958bab673f6fa0c46808fac193e7b30ca0319e756f5c74c5b7761d6020b6f43a24cab7586e3a833370fac3ed40880d5b5f50be5e8583178f417ef6e
-
Filesize
64KB
-
Filesize
36KB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
64KB
-
Filesize
3.9MB
-
Filesize
3.9MB