Analysis
- max time kernel
152s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
03/10/2022, 08:51
Static task
static1
Behavioral task
behavioral1
Sample
5b450d641f813f87e7a24dd3b0fc622f.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
5b450d641f813f87e7a24dd3b0fc622f.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target 5b450d641f813f87e7a24dd3b0fc622f.exe
- Size 133KB
- Sample221003-kr6d6ahcdr
- SHA256 4d2921f38a5bbc12057aecb0e0a370ecf21035428fa2a8508f03023aabde3754
- MD5 5b450d641f813f87e7a24dd3b0fc622f
- SHA1 c80cbf1bd45eed49deee7dca9bc019d5f71e7dc4
- SHA512 581e553b67c229432595df01423b34c35f69c3e82647044ecf88ae4c1bf4ce411379bbe3581c95d67242cdd240087f4b09b6f251a96195e666d26a0c034d5b65
- SSDEEP 1536:jSbRDBnH5hk1WkORxZnb40L2IowCU5KZtVuLGTWbEq17TSoYNXrvO/hQKjj0nLxK:jSbRJiORXYImWKclbd17TSoeO7jGK
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/4820-133-0x00000000022B0000-0x00000000022B9000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 4 IoCs
pid Process 5016 727C.exe 4268 B080.exe 2908 1.exe 4200 BCE4.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 727C.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 126 checkip.amazonaws.com 128 checkip.amazonaws.com - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5b450d641f813f87e7a24dd3b0fc622f.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5b450d641f813f87e7a24dd3b0fc622f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5b450d641f813f87e7a24dd3b0fc622f.exe - GoLang User-Agent 5 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 114 Go-http-client/1.1 HTTP User-Agent header 117 Go-http-client/1.1 HTTP User-Agent header 120 Go-http-client/1.1 HTTP User-Agent header 123 Go-http-client/1.1 HTTP User-Agent header 124 Go-http-client/1.1 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4820 5b450d641f813f87e7a24dd3b0fc622f.exe 4820 5b450d641f813f87e7a24dd3b0fc622f.exe 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2456 Process not Found - Suspicious behavior: MapViewOfSection 15 IoCs
pid Process 4820 5b450d641f813f87e7a24dd3b0fc622f.exe 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found 2456 Process not Found - Suspicious use of AdjustPrivilegeToken 30 IoCs
description pid Process Token: SeShutdownPrivilege 2456 Process not Found Token: SeCreatePagefilePrivilege 2456 Process not Found Token: SeShutdownPrivilege 2456 Process not Found Token: SeCreatePagefilePrivilege 2456 Process not Found Token: SeShutdownPrivilege 2456 Process not Found Token: SeCreatePagefilePrivilege 2456 Process not Found Token: SeShutdownPrivilege 2456 Process not Found Token: SeCreatePagefilePrivilege 2456 Process not Found Token: SeShutdownPrivilege 2456 Process not Found Token: SeCreatePagefilePrivilege 2456 Process not Found Token: SeShutdownPrivilege 2456 Process not Found Token: SeCreatePagefilePrivilege 2456 Process not Found Token: SeShutdownPrivilege 2456 Process not Found Token: SeCreatePagefilePrivilege 2456 Process not Found Token: SeShutdownPrivilege 2456 Process not Found Token: SeCreatePagefilePrivilege 2456 Process not Found Token: SeShutdownPrivilege 2456 Process not Found Token: SeCreatePagefilePrivilege 2456 Process not Found Token: SeShutdownPrivilege 2456 Process not Found Token: SeCreatePagefilePrivilege 2456 Process not Found Token: SeShutdownPrivilege 2456 Process not Found Token: SeCreatePagefilePrivilege 2456 Process not Found Token: SeShutdownPrivilege 2456 Process not Found Token: SeCreatePagefilePrivilege 2456 Process not Found Token: SeShutdownPrivilege 2456 Process not Found Token: SeCreatePagefilePrivilege 2456 Process not Found Token: SeShutdownPrivilege 2456 Process not Found Token: SeCreatePagefilePrivilege 2456 Process not Found Token: SeShutdownPrivilege 2456 Process not Found Token: SeCreatePagefilePrivilege 2456 Process not Found - Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 2456 wrote to memory of 5016 2456 Process not Found 89 PID 2456 wrote to memory of 5016 2456 Process not Found 89 PID 2456 wrote to memory of 5016 2456 Process not Found 89 PID 2456 wrote to memory of 4268 2456 Process not Found 90 PID 2456 wrote to memory of 4268 2456 Process not Found 90 PID 2456 wrote to memory of 4268 2456 Process not Found 90 PID 5016 wrote to memory of 2908 5016 727C.exe 93 PID 5016 wrote to memory of 2908 5016 727C.exe 93 PID 5016 wrote to memory of 2908 5016 727C.exe 93 PID 2456 wrote to memory of 4200 2456 Process not Found 96 PID 2456 wrote to memory of 4200 2456 Process not Found 96 PID 2456 wrote to memory of 4200 2456 Process not Found 96 PID 2456 wrote to memory of 1968 2456 Process not Found 97 PID 2456 wrote to memory of 1968 2456 Process not Found 97 PID 2456 wrote to memory of 1968 2456 Process not Found 97 PID 2456 wrote to memory of 1968 2456 Process not Found 97 PID 2456 wrote to memory of 2292 2456 Process not Found 98 PID 2456 wrote to memory of 2292 2456 Process not Found 98 PID 2456 wrote to memory of 2292 2456 Process not Found 98 PID 2456 wrote to memory of 1820 2456 Process not Found 99 PID 2456 wrote to memory of 1820 2456 Process not Found 99 PID 2456 wrote to memory of 1820 2456 Process not Found 99 PID 2456 wrote to memory of 1820 2456 Process not Found 99 PID 2456 wrote to memory of 3400 2456 Process not Found 100 PID 2456 wrote to memory of 3400 2456 Process not Found 100 PID 2456 wrote to memory of 3400 2456 Process not Found 100 PID 2456 wrote to memory of 868 2456 Process not Found 101 PID 2456 wrote to memory of 868 2456 Process not Found 101 PID 2456 wrote to memory of 868 2456 Process not Found 101 PID 2456 wrote to memory of 868 2456 Process not Found 101 PID 4200 wrote to memory of 3716 4200 BCE4.exe 102 PID 4200 wrote to memory of 3716 4200 BCE4.exe 102 PID 4200 wrote to memory of 3716 4200 BCE4.exe 102 PID 3716 wrote to memory of 3496 3716 cmd.exe 104 PID 3716 wrote to memory of 3496 3716 cmd.exe 104 PID 3716 wrote to memory of 3496 3716 cmd.exe 104 PID 2456 wrote to memory of 2092 2456 Process not Found 105 PID 2456 wrote to memory of 2092 2456 Process not Found 105 PID 2456 wrote to memory of 2092 2456 Process not Found 105 PID 2456 wrote to memory of 2092 2456 Process not Found 105 PID 2456 wrote to memory of 3476 2456 Process not Found 106 PID 2456 wrote to memory of 3476 2456 Process not Found 106 PID 2456 wrote to memory of 3476 2456 Process not Found 106 PID 2456 wrote to memory of 3476 2456 Process not Found 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b450d641f813f87e7a24dd3b0fc622f.exe"C:\Users\Admin\AppData\Local\Temp\5b450d641f813f87e7a24dd3b0fc622f.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4820
-
C:\Users\Admin\AppData\Local\Temp\727C.exeC:\Users\Admin\AppData\Local\Temp\727C.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"2⤵
- Executes dropped EXE
PID:2908
-
-
C:\Users\Admin\AppData\Local\Temp\B080.exeC:\Users\Admin\AppData\Local\Temp\B080.exe1⤵
- Executes dropped EXE
PID:4268
-
C:\Users\Admin\AppData\Local\Temp\BCE4.exeC:\Users\Admin\AppData\Local\Temp\BCE4.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵PID:3496
-
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1968
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2292
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1820
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3400
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:868
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2092
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3476
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\727C.exe
- Size 466KB
- SHA256 3238f627cf753b195a814ad7a01bd16fa13616802e39f48a981c5c8703a2ff6f
- MD5 2955a7fdcda8c0768d106b135a352173
- SHA1 1de1f74183421d4f811af2dc469840c8d266eec9
- SHA512 c87bf10bc4eaaa912a74da441c3a3894535e54764e60a76c505c628e70e35822fcbe147aaabd117ddacbc88294ad16243c7f721400ac64178681633db8898bbb
- SSDEEP 12288:JcrNS33L10QdrXZT+tcWnv7E+CiOQF0V8eeZ4w3SV:0NA3R5drX/WTjjbF0V8VSV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\727C.exe
- Size 466KB
- SHA256 3238f627cf753b195a814ad7a01bd16fa13616802e39f48a981c5c8703a2ff6f
- MD5 2955a7fdcda8c0768d106b135a352173
- SHA1 1de1f74183421d4f811af2dc469840c8d266eec9
- SHA512 c87bf10bc4eaaa912a74da441c3a3894535e54764e60a76c505c628e70e35822fcbe147aaabd117ddacbc88294ad16243c7f721400ac64178681633db8898bbb
- SSDEEP 12288:JcrNS33L10QdrXZT+tcWnv7E+CiOQF0V8eeZ4w3SV:0NA3R5drX/WTjjbF0V8VSV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\B080.exe
- Size 315KB
- SHA256 6398a682b929077fa895ca80e77f5ada30103387b76cb0021712e33ab8122dde
- MD5 6b6cf541f7e8d8a4973afb7f212c9ddc
- SHA1 a7f1a3671295ce9016edf7f660c23f3ecf890e79
- SHA512 e3faa66f1feb93129e56937a0e232728ece6a1f17e36b8dd8baef94e4279e6f3cce00304711a64b2f8b74314699c2943de3ccd49a709f45d0934749b78485791
- SSDEEP 6144:lHKu6pyZPCtT0ICidHvnkJF3PwjW5AOJLN5mY8y7WXU8s4u6qSaATdnr887:YuI2PCtwICidPOnLNIY17WXU8s4DqRA7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\B080.exe
- Size 315KB
- SHA256 6398a682b929077fa895ca80e77f5ada30103387b76cb0021712e33ab8122dde
- MD5 6b6cf541f7e8d8a4973afb7f212c9ddc
- SHA1 a7f1a3671295ce9016edf7f660c23f3ecf890e79
- SHA512 e3faa66f1feb93129e56937a0e232728ece6a1f17e36b8dd8baef94e4279e6f3cce00304711a64b2f8b74314699c2943de3ccd49a709f45d0934749b78485791
- SSDEEP 6144:lHKu6pyZPCtT0ICidHvnkJF3PwjW5AOJLN5mY8y7WXU8s4u6qSaATdnr887:YuI2PCtwICidPOnLNIY17WXU8s4DqRA7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\BCE4.exe
- Size 4.3MB
- SHA256 ed14ed57c0a785e01024deffe5a05a79ed9d61a21c58ea8be136c79d31e2daa6
- MD5 06a1dc7aae769814998f99c0bca5ea41
- SHA1 81ea40089386bffadd0e0a6bb780b7ddd4dc71a9
- SHA512 aa4a4f8cfe7d7e68c6751e518763cbc509a7ba31699dc7541104170af1a19b439e9ae687d92c8b09450088317e58b5fc78b921646ddba0a28b1f080b7190f65b
- SSDEEP 49152:ctIRXyLObIrw7pLv1jcev/iCwiiR2h+B3OmB0TW6qcAb7/i:c+XIObGwNLtjcoGB/i
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\BCE4.exe
- Size 4.3MB
- SHA256 ed14ed57c0a785e01024deffe5a05a79ed9d61a21c58ea8be136c79d31e2daa6
- MD5 06a1dc7aae769814998f99c0bca5ea41
- SHA1 81ea40089386bffadd0e0a6bb780b7ddd4dc71a9
- SHA512 aa4a4f8cfe7d7e68c6751e518763cbc509a7ba31699dc7541104170af1a19b439e9ae687d92c8b09450088317e58b5fc78b921646ddba0a28b1f080b7190f65b
- SSDEEP 49152:ctIRXyLObIrw7pLv1jcev/iCwiiR2h+B3OmB0TW6qcAb7/i:c+XIObGwNLtjcoGB/i
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\1.exe
- Size 369KB
- SHA256 61059bd8f3bdb2b07ca01c87efe6284b8b3b77ca63e9a063e0e9010774a482a4
- MD5 4a32a16c5a3c79ade487c098ee71a2be
- SHA1 414b203eeb20ac7e74316fd2877ca4ebf52193df
- SHA512 6470c0269052bbccea48bfb5da80cdcf96fec71e0e45ae79a42acacd7c4d92139ccc6f122ab97e5b104fc93bee84891850a80aa9c835c0b31418f151517b1ee5
- SSDEEP 6144:pUPiPsF0WZlbCH5Wreqe3/Edq6XYAOR0BOi+ieaYNBtGNyE04g0Kzh4OcWy+W4Dw:pUa0F0WZlbCHwg+XY3HVyWI2SXw1hvb8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\1.exe
- Size 369KB
- SHA256 61059bd8f3bdb2b07ca01c87efe6284b8b3b77ca63e9a063e0e9010774a482a4
- MD5 4a32a16c5a3c79ade487c098ee71a2be
- SHA1 414b203eeb20ac7e74316fd2877ca4ebf52193df
- SHA512 6470c0269052bbccea48bfb5da80cdcf96fec71e0e45ae79a42acacd7c4d92139ccc6f122ab97e5b104fc93bee84891850a80aa9c835c0b31418f151517b1ee5
- SSDEEP 6144:pUPiPsF0WZlbCH5Wreqe3/Edq6XYAOR0BOi+ieaYNBtGNyE04g0Kzh4OcWy+W4Dw:pUa0F0WZlbCHwg+XY3HVyWI2SXw1hvb8
- MD5 SHA1 SHA512 SSDEEP