Analysis
-
max time kernel
152s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
03/10/2022, 08:06
General
-
Target
e882606b1eb0719832fabbe3cae84d5f.exe
-
Size
134KB
-
MD5
e882606b1eb0719832fabbe3cae84d5f
-
SHA1
f404b58807ab7a37007d00c7f480dd1d6d07153f
-
SHA256
6a7d48f08212a61d9fc4202234cd290a42fdd8eebbb53d90c57dc971a159caf3
-
SHA512
8a432410bbb4f4174a05798c945799d6b09c38e77c6c337f857bfb8c191ce0fb74a6d11bb544ed4c6b66a23938022c30616638cfddbfbf625f09bfffac912a23
-
SSDEEP
3072:3l204dRK18bt4fjsa3TEaQ6F8j3D5uEG:jT1eKflLQzjduE
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 10 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e882606b1eb0719832fabbe3cae84d5f.exe"C:\Users\Admin\AppData\Local\Temp\e882606b1eb0719832fabbe3cae84d5f.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\388F.exeC:\Users\Admin\AppData\Local\Temp\388F.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\47A4.exeC:\Users\Admin\AppData\Local\Temp\47A4.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\57D1.exeC:\Users\Admin\AppData\Local\Temp\57D1.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
466KB
MD52955a7fdcda8c0768d106b135a352173
SHA11de1f74183421d4f811af2dc469840c8d266eec9
SHA2563238f627cf753b195a814ad7a01bd16fa13616802e39f48a981c5c8703a2ff6f
SHA512c87bf10bc4eaaa912a74da441c3a3894535e54764e60a76c505c628e70e35822fcbe147aaabd117ddacbc88294ad16243c7f721400ac64178681633db8898bbb
-
Filesize
315KB
MD56b6cf541f7e8d8a4973afb7f212c9ddc
SHA1a7f1a3671295ce9016edf7f660c23f3ecf890e79
SHA2566398a682b929077fa895ca80e77f5ada30103387b76cb0021712e33ab8122dde
SHA512e3faa66f1feb93129e56937a0e232728ece6a1f17e36b8dd8baef94e4279e6f3cce00304711a64b2f8b74314699c2943de3ccd49a709f45d0934749b78485791
-
Filesize
315KB
MD56b6cf541f7e8d8a4973afb7f212c9ddc
SHA1a7f1a3671295ce9016edf7f660c23f3ecf890e79
SHA2566398a682b929077fa895ca80e77f5ada30103387b76cb0021712e33ab8122dde
SHA512e3faa66f1feb93129e56937a0e232728ece6a1f17e36b8dd8baef94e4279e6f3cce00304711a64b2f8b74314699c2943de3ccd49a709f45d0934749b78485791
-
Filesize
4.3MB
MD506a1dc7aae769814998f99c0bca5ea41
SHA181ea40089386bffadd0e0a6bb780b7ddd4dc71a9
SHA256ed14ed57c0a785e01024deffe5a05a79ed9d61a21c58ea8be136c79d31e2daa6
SHA512aa4a4f8cfe7d7e68c6751e518763cbc509a7ba31699dc7541104170af1a19b439e9ae687d92c8b09450088317e58b5fc78b921646ddba0a28b1f080b7190f65b
-
Filesize
4.3MB
MD506a1dc7aae769814998f99c0bca5ea41
SHA181ea40089386bffadd0e0a6bb780b7ddd4dc71a9
SHA256ed14ed57c0a785e01024deffe5a05a79ed9d61a21c58ea8be136c79d31e2daa6
SHA512aa4a4f8cfe7d7e68c6751e518763cbc509a7ba31699dc7541104170af1a19b439e9ae687d92c8b09450088317e58b5fc78b921646ddba0a28b1f080b7190f65b
-
Filesize
68KB
-
Filesize
36KB
-
Filesize
1.5MB
-
Filesize
1.5MB