Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-09-2022 21:01
Static task
static1
Behavioral task
behavioral1
Sample
56c77e5efa069fdbea2beaf1cbb234735d6aa70eba0fe50b736ab5f9bbe6e69a.exe
Resource
win10v2004-20220812-en
General
-
Target
56c77e5efa069fdbea2beaf1cbb234735d6aa70eba0fe50b736ab5f9bbe6e69a.exe
-
Size
187KB
-
MD5
ed89332cb4fb426b7e9ad5d8853be58f
-
SHA1
4c6dbd10b19dd0a53d76bc8ca8c5df055a5f0ccc
-
SHA256
56c77e5efa069fdbea2beaf1cbb234735d6aa70eba0fe50b736ab5f9bbe6e69a
-
SHA512
9f23967e804be45bf892f7c1c1590efe633ae34ddb4d953f8a29ea14febdda51ae217e9c38e59acbbf9e578d5564fd50d6239d15b57495884adfd07ece988862
-
SSDEEP
3072:znz60aKL8S8oN5QLMMfSZ523EfCUMvgNZJBJG1Sy/Pk44x://L0oQLoC3EfCUVNG1
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/4436-133-0x0000000000710000-0x0000000000719000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
56c77e5efa069fdbea2beaf1cbb234735d6aa70eba0fe50b736ab5f9bbe6e69a.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 56c77e5efa069fdbea2beaf1cbb234735d6aa70eba0fe50b736ab5f9bbe6e69a.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 56c77e5efa069fdbea2beaf1cbb234735d6aa70eba0fe50b736ab5f9bbe6e69a.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 56c77e5efa069fdbea2beaf1cbb234735d6aa70eba0fe50b736ab5f9bbe6e69a.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
56c77e5efa069fdbea2beaf1cbb234735d6aa70eba0fe50b736ab5f9bbe6e69a.exepid process 4436 56c77e5efa069fdbea2beaf1cbb234735d6aa70eba0fe50b736ab5f9bbe6e69a.exe 4436 56c77e5efa069fdbea2beaf1cbb234735d6aa70eba0fe50b736ab5f9bbe6e69a.exe 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 1996 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1996 -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
56c77e5efa069fdbea2beaf1cbb234735d6aa70eba0fe50b736ab5f9bbe6e69a.exepid process 4436 56c77e5efa069fdbea2beaf1cbb234735d6aa70eba0fe50b736ab5f9bbe6e69a.exe 1996 1996 1996 1996 1996 1996 -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
description pid process target process PID 1996 wrote to memory of 4604 1996 explorer.exe PID 1996 wrote to memory of 4604 1996 explorer.exe PID 1996 wrote to memory of 4604 1996 explorer.exe PID 1996 wrote to memory of 4604 1996 explorer.exe PID 1996 wrote to memory of 2192 1996 explorer.exe PID 1996 wrote to memory of 2192 1996 explorer.exe PID 1996 wrote to memory of 2192 1996 explorer.exe PID 1996 wrote to memory of 1580 1996 explorer.exe PID 1996 wrote to memory of 1580 1996 explorer.exe PID 1996 wrote to memory of 1580 1996 explorer.exe PID 1996 wrote to memory of 1580 1996 explorer.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\56c77e5efa069fdbea2beaf1cbb234735d6aa70eba0fe50b736ab5f9bbe6e69a.exe"C:\Users\Admin\AppData\Local\Temp\56c77e5efa069fdbea2beaf1cbb234735d6aa70eba0fe50b736ab5f9bbe6e69a.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1580-141-0x0000000000000000-mapping.dmp
-
memory/1580-145-0x0000000000F40000-0x0000000000F62000-memory.dmpFilesize
136KB
-
memory/1580-143-0x0000000000AB0000-0x0000000000AD7000-memory.dmpFilesize
156KB
-
memory/1580-142-0x0000000000F40000-0x0000000000F62000-memory.dmpFilesize
136KB
-
memory/2192-138-0x00000000004D0000-0x00000000004DC000-memory.dmpFilesize
48KB
-
memory/2192-137-0x0000000000000000-mapping.dmp
-
memory/4436-132-0x0000000000848000-0x0000000000859000-memory.dmpFilesize
68KB
-
memory/4436-135-0x0000000000400000-0x0000000000589000-memory.dmpFilesize
1.5MB
-
memory/4436-134-0x0000000000400000-0x0000000000589000-memory.dmpFilesize
1.5MB
-
memory/4436-133-0x0000000000710000-0x0000000000719000-memory.dmpFilesize
36KB
-
memory/4604-139-0x0000000000570000-0x00000000005E5000-memory.dmpFilesize
468KB
-
memory/4604-140-0x0000000000500000-0x000000000056B000-memory.dmpFilesize
428KB
-
memory/4604-136-0x0000000000000000-mapping.dmp
-
memory/4604-144-0x0000000000500000-0x000000000056B000-memory.dmpFilesize
428KB