Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
21/09/2022, 05:18
Static task
static1
Behavioral task
behavioral1
Sample
ee0360136aa9f0c4da1919e1104912f2.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
ee0360136aa9f0c4da1919e1104912f2.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target ee0360136aa9f0c4da1919e1104912f2.exe
- Size 148KB
- Sample220921-fy9ypsfca3
- SHA256 2ba4a2e3c45155da93c5e1f38086e7a7b151fe75c42669f23a645a76d5589749
- MD5 ee0360136aa9f0c4da1919e1104912f2
- SHA1 cc054e4d0f812d9c5116311f30ce6f329e16ad22
- SHA512 aa0361296fe3d108efcac6eccb315cffdb0a442a3f583124dcd88eb706a06e9af8f16a0c7514a7b64be2bb0889075f1f4ed6d0f7cde9af310617f4f41699abbc
- SSDEEP 1536:+v3dWNiQn1PF5RIQUD9AEgwfZmVvsNsJayOnucWA6N6I2TThLdlFYtJgfjYj1jty:+v7c52JiFRv5JpcWu9VFYzBjrtfIn
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/1572-133-0x00000000022B0000-0x00000000022B9000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Executes dropped EXE 1 IoCs
pid Process 376 bjwcseh - Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bjwcseh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ee0360136aa9f0c4da1919e1104912f2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ee0360136aa9f0c4da1919e1104912f2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ee0360136aa9f0c4da1919e1104912f2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bjwcseh Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bjwcseh - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1572 ee0360136aa9f0c4da1919e1104912f2.exe 1572 ee0360136aa9f0c4da1919e1104912f2.exe 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2456 Process not Found - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1572 ee0360136aa9f0c4da1919e1104912f2.exe 376 bjwcseh
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee0360136aa9f0c4da1919e1104912f2.exe"C:\Users\Admin\AppData\Local\Temp\ee0360136aa9f0c4da1919e1104912f2.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1572
-
C:\Users\Admin\AppData\Roaming\bjwcsehC:\Users\Admin\AppData\Roaming\bjwcseh1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:376
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\bjwcseh
- Size 148KB
- SHA256 2ba4a2e3c45155da93c5e1f38086e7a7b151fe75c42669f23a645a76d5589749
- MD5 ee0360136aa9f0c4da1919e1104912f2
- SHA1 cc054e4d0f812d9c5116311f30ce6f329e16ad22
- SHA512 aa0361296fe3d108efcac6eccb315cffdb0a442a3f583124dcd88eb706a06e9af8f16a0c7514a7b64be2bb0889075f1f4ed6d0f7cde9af310617f4f41699abbc
- SSDEEP 1536:+v3dWNiQn1PF5RIQUD9AEgwfZmVvsNsJayOnucWA6N6I2TThLdlFYtJgfjYj1jty:+v7c52JiFRv5JpcWu9VFYzBjrtfIn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\bjwcseh
- Size 148KB
- SHA256 2ba4a2e3c45155da93c5e1f38086e7a7b151fe75c42669f23a645a76d5589749
- MD5 ee0360136aa9f0c4da1919e1104912f2
- SHA1 cc054e4d0f812d9c5116311f30ce6f329e16ad22
- SHA512 aa0361296fe3d108efcac6eccb315cffdb0a442a3f583124dcd88eb706a06e9af8f16a0c7514a7b64be2bb0889075f1f4ed6d0f7cde9af310617f4f41699abbc
- SSDEEP 1536:+v3dWNiQn1PF5RIQUD9AEgwfZmVvsNsJayOnucWA6N6I2TThLdlFYtJgfjYj1jty:+v7c52JiFRv5JpcWu9VFYzBjrtfIn
- MD5 SHA1 SHA512 SSDEEP