Analysis
-
max time kernel
152s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2022 07:17
Static task
static1
Behavioral task
behavioral1
Sample
8449af6ada1a321e74364304e658e57881a3c219baa8a18e41ca14ed428002d8.exe
Resource
win10v2004-20220812-en
General
-
Target
8449af6ada1a321e74364304e658e57881a3c219baa8a18e41ca14ed428002d8.exe
-
Size
133KB
-
MD5
b7c2f5f722c28743699f8422b11f47e3
-
SHA1
b54e0f2ca01c56e4adef77e45e3abbdc85247e7e
-
SHA256
8449af6ada1a321e74364304e658e57881a3c219baa8a18e41ca14ed428002d8
-
SHA512
2ba3bd415fccf1e154c1b76b6294152443e4ae62745bd463d602598bf06883538ef06c15b9d8f848a532d0e7101c12db0f00987ebbb0c5bede0fbff79bc1d427
-
SSDEEP
3072:ocrSrYORPbJRnn6SZmGDfFk6/qVOan9Btp:olL6QmGDp/qVO03
Malware Config
Signatures
-
Detects Smokeloader packer 6 IoCs
Processes:
resource yara_rule behavioral1/memory/5092-133-0x0000000000730000-0x0000000000739000-memory.dmp family_smokeloader behavioral1/memory/1232-135-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/1232-137-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/1232-138-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/1744-145-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/1744-146-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 2 IoCs
Processes:
fdgfewhfdgfewhpid process 544 fdgfewh 1744 fdgfewh -
Suspicious use of SetThreadContext 2 IoCs
Processes:
8449af6ada1a321e74364304e658e57881a3c219baa8a18e41ca14ed428002d8.exefdgfewhdescription pid process target process PID 5092 set thread context of 1232 5092 8449af6ada1a321e74364304e658e57881a3c219baa8a18e41ca14ed428002d8.exe 8449af6ada1a321e74364304e658e57881a3c219baa8a18e41ca14ed428002d8.exe PID 544 set thread context of 1744 544 fdgfewh fdgfewh -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
8449af6ada1a321e74364304e658e57881a3c219baa8a18e41ca14ed428002d8.exefdgfewhdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8449af6ada1a321e74364304e658e57881a3c219baa8a18e41ca14ed428002d8.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8449af6ada1a321e74364304e658e57881a3c219baa8a18e41ca14ed428002d8.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8449af6ada1a321e74364304e658e57881a3c219baa8a18e41ca14ed428002d8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fdgfewh Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fdgfewh Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fdgfewh -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
8449af6ada1a321e74364304e658e57881a3c219baa8a18e41ca14ed428002d8.exepid process 1232 8449af6ada1a321e74364304e658e57881a3c219baa8a18e41ca14ed428002d8.exe 1232 8449af6ada1a321e74364304e658e57881a3c219baa8a18e41ca14ed428002d8.exe 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2704 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
8449af6ada1a321e74364304e658e57881a3c219baa8a18e41ca14ed428002d8.exefdgfewhpid process 1232 8449af6ada1a321e74364304e658e57881a3c219baa8a18e41ca14ed428002d8.exe 1744 fdgfewh -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 2704 Token: SeCreatePagefilePrivilege 2704 -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
8449af6ada1a321e74364304e658e57881a3c219baa8a18e41ca14ed428002d8.exefdgfewhdescription pid process target process PID 5092 wrote to memory of 1232 5092 8449af6ada1a321e74364304e658e57881a3c219baa8a18e41ca14ed428002d8.exe 8449af6ada1a321e74364304e658e57881a3c219baa8a18e41ca14ed428002d8.exe PID 5092 wrote to memory of 1232 5092 8449af6ada1a321e74364304e658e57881a3c219baa8a18e41ca14ed428002d8.exe 8449af6ada1a321e74364304e658e57881a3c219baa8a18e41ca14ed428002d8.exe PID 5092 wrote to memory of 1232 5092 8449af6ada1a321e74364304e658e57881a3c219baa8a18e41ca14ed428002d8.exe 8449af6ada1a321e74364304e658e57881a3c219baa8a18e41ca14ed428002d8.exe PID 5092 wrote to memory of 1232 5092 8449af6ada1a321e74364304e658e57881a3c219baa8a18e41ca14ed428002d8.exe 8449af6ada1a321e74364304e658e57881a3c219baa8a18e41ca14ed428002d8.exe PID 5092 wrote to memory of 1232 5092 8449af6ada1a321e74364304e658e57881a3c219baa8a18e41ca14ed428002d8.exe 8449af6ada1a321e74364304e658e57881a3c219baa8a18e41ca14ed428002d8.exe PID 5092 wrote to memory of 1232 5092 8449af6ada1a321e74364304e658e57881a3c219baa8a18e41ca14ed428002d8.exe 8449af6ada1a321e74364304e658e57881a3c219baa8a18e41ca14ed428002d8.exe PID 544 wrote to memory of 1744 544 fdgfewh fdgfewh PID 544 wrote to memory of 1744 544 fdgfewh fdgfewh PID 544 wrote to memory of 1744 544 fdgfewh fdgfewh PID 544 wrote to memory of 1744 544 fdgfewh fdgfewh PID 544 wrote to memory of 1744 544 fdgfewh fdgfewh PID 544 wrote to memory of 1744 544 fdgfewh fdgfewh
Processes
-
C:\Users\Admin\AppData\Local\Temp\8449af6ada1a321e74364304e658e57881a3c219baa8a18e41ca14ed428002d8.exe"C:\Users\Admin\AppData\Local\Temp\8449af6ada1a321e74364304e658e57881a3c219baa8a18e41ca14ed428002d8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8449af6ada1a321e74364304e658e57881a3c219baa8a18e41ca14ed428002d8.exe"C:\Users\Admin\AppData\Local\Temp\8449af6ada1a321e74364304e658e57881a3c219baa8a18e41ca14ed428002d8.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\fdgfewhC:\Users\Admin\AppData\Roaming\fdgfewh1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\fdgfewhC:\Users\Admin\AppData\Roaming\fdgfewh2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\fdgfewhFilesize
133KB
MD5b7c2f5f722c28743699f8422b11f47e3
SHA1b54e0f2ca01c56e4adef77e45e3abbdc85247e7e
SHA2568449af6ada1a321e74364304e658e57881a3c219baa8a18e41ca14ed428002d8
SHA5122ba3bd415fccf1e154c1b76b6294152443e4ae62745bd463d602598bf06883538ef06c15b9d8f848a532d0e7101c12db0f00987ebbb0c5bede0fbff79bc1d427
-
C:\Users\Admin\AppData\Roaming\fdgfewhFilesize
133KB
MD5b7c2f5f722c28743699f8422b11f47e3
SHA1b54e0f2ca01c56e4adef77e45e3abbdc85247e7e
SHA2568449af6ada1a321e74364304e658e57881a3c219baa8a18e41ca14ed428002d8
SHA5122ba3bd415fccf1e154c1b76b6294152443e4ae62745bd463d602598bf06883538ef06c15b9d8f848a532d0e7101c12db0f00987ebbb0c5bede0fbff79bc1d427
-
C:\Users\Admin\AppData\Roaming\fdgfewhFilesize
133KB
MD5b7c2f5f722c28743699f8422b11f47e3
SHA1b54e0f2ca01c56e4adef77e45e3abbdc85247e7e
SHA2568449af6ada1a321e74364304e658e57881a3c219baa8a18e41ca14ed428002d8
SHA5122ba3bd415fccf1e154c1b76b6294152443e4ae62745bd463d602598bf06883538ef06c15b9d8f848a532d0e7101c12db0f00987ebbb0c5bede0fbff79bc1d427
-
memory/544-144-0x00000000006ED000-0x00000000006FE000-memory.dmpFilesize
68KB
-
memory/1232-138-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1232-137-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1232-135-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1232-134-0x0000000000000000-mapping.dmp
-
memory/1744-141-0x0000000000000000-mapping.dmp
-
memory/1744-145-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1744-146-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/5092-132-0x00000000005FD000-0x000000000060D000-memory.dmpFilesize
64KB
-
memory/5092-136-0x00000000005FD000-0x000000000060D000-memory.dmpFilesize
64KB
-
memory/5092-133-0x0000000000730000-0x0000000000739000-memory.dmpFilesize
36KB