Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
27/09/2022, 08:03
General
-
Target
010cf803e4769a7cea57443a1728e15a2e9041783c04905a3822a11d57dfca4c.exe
-
Size
317KB
-
MD5
85451987dd88c1337b6c0cab4777525a
-
SHA1
b2fd78bc76f8a2060bbde5c616418101014ebfe5
-
SHA256
010cf803e4769a7cea57443a1728e15a2e9041783c04905a3822a11d57dfca4c
-
SHA512
7ca4fe244739ae144481c3b287672a7c45f498c741c81bbc5b8e1e34f690ff6d8513eace345d3a4f1d07efb11757798cf8d97ca5fb20459be028a90dac3ee537
-
SSDEEP
3072:+AXQFNeXrbJ9ZG2QjVq57yR85fctEGTEQdHHaFxvqg0KcCfteV7pM/h3BsxkgaB8:+0ps2tJfcnDEFxig0nZBpnigabwVf
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Program crash 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\010cf803e4769a7cea57443a1728e15a2e9041783c04905a3822a11d57dfca4c.exe"C:\Users\Admin\AppData\Local\Temp\010cf803e4769a7cea57443a1728e15a2e9041783c04905a3822a11d57dfca4c.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\9DC6.exeC:\Users\Admin\AppData\Local\Temp\9DC6.exe1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\AppData\Local\Temp\B46C.exeC:\Users\Admin\AppData\Local\Temp\B46C.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 19442⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2804 -ip 28041⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
640KB
MD5f10c4c4b7a9c5e153236a66d863d1f1d
SHA18921c2a5368a80b69dc446af3670c07253f0bd31
SHA25639269811e69455544015bea98a34a9855be527c451cbb2c4a048fc39cb434804
SHA512245b377fb93a186e224404e6a1abe624f23779f314d370b6aca1e7e437ef4e886db51cfdb177e409e468c0a16b95446de1ff566ee1e14ad2a225a3f30c3cf178
-
Filesize
640KB
MD5f10c4c4b7a9c5e153236a66d863d1f1d
SHA18921c2a5368a80b69dc446af3670c07253f0bd31
SHA25639269811e69455544015bea98a34a9855be527c451cbb2c4a048fc39cb434804
SHA512245b377fb93a186e224404e6a1abe624f23779f314d370b6aca1e7e437ef4e886db51cfdb177e409e468c0a16b95446de1ff566ee1e14ad2a225a3f30c3cf178
-
Filesize
304KB
MD515f1517f0ceaaf9b6c78cf7625510c07
SHA18aabce20aff43476586a1b69b0b761a7f39d1e7e
SHA256d0d47dec11c63b6fa1a2dcac89e5a7352220e371b728781de041bf42fa8965fb
SHA512931a79a6e0d38c9b59b03a68d31e3c8fdb2b51e5eeed1df45790eba38f516f767ed67d9edd10bef16d169dc253c81ba6afb5d52738761cc2fa84f601f86b3516
-
Filesize
304KB
MD515f1517f0ceaaf9b6c78cf7625510c07
SHA18aabce20aff43476586a1b69b0b761a7f39d1e7e
SHA256d0d47dec11c63b6fa1a2dcac89e5a7352220e371b728781de041bf42fa8965fb
SHA512931a79a6e0d38c9b59b03a68d31e3c8fdb2b51e5eeed1df45790eba38f516f767ed67d9edd10bef16d169dc253c81ba6afb5d52738761cc2fa84f601f86b3516
-
Filesize
168KB
-
Filesize
1.6MB
-
Filesize
5.2MB
-
Filesize
120KB
-
Filesize
472KB
-
Filesize
320KB
-
Filesize
408KB
-
Filesize
168KB
-
Filesize
1.8MB
-
Filesize
168KB
-
Filesize
220KB
-
Filesize
5.6MB
-
Filesize
1.6MB
-
Filesize
6.1MB
-
Filesize
72KB
-
Filesize
1.0MB
-
Filesize
240KB
-
Filesize
584KB
-
Filesize
388KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
428KB
-
Filesize
664KB
-
Filesize
68KB
-
Filesize
336KB
-
Filesize
336KB
-
Filesize
36KB