Analysis
- max time kernel
151s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
05/10/2022, 16:21
Static task
static1
Behavioral task
behavioral1
Sample
0270fa061e64b90835ef1cfb28f08b35.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
0270fa061e64b90835ef1cfb28f08b35.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 0270fa061e64b90835ef1cfb28f08b35.exe
- Size 280KB
- Sample221005-ttm52afbar
- SHA256 be7a56309175609baadeef53fc65c6c7301c961fa9568a4e99c000e19ca3ce25
- MD5 0270fa061e64b90835ef1cfb28f08b35
- SHA1 9e81cc19a5364a1bb81cce8183ef43870448ff72
- SHA512 a2ace1aa409d91b07bb3221b02d5c0aab3649aa3ba7ca88b90ea3ddac8565c102e4681a70455ac9b230d6b6c5d67447edc620a84d992f1dc7a5c9617495b5050
- SSDEEP 6144:4yfKkCLvL8QjL5xjFXIfgomU/VduzbgwuxIacwVfU:4uKkCDL8QfbZt5U/unnwtU
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/4308-133-0x00000000005E0000-0x00000000005E9000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 3 IoCs
pid Process 228 E10E.exe 2056 E797.exe 3500 F469.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0270fa061e64b90835ef1cfb28f08b35.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0270fa061e64b90835ef1cfb28f08b35.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0270fa061e64b90835ef1cfb28f08b35.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4308 0270fa061e64b90835ef1cfb28f08b35.exe 4308 0270fa061e64b90835ef1cfb28f08b35.exe 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2560 Process not Found - Suspicious behavior: MapViewOfSection 19 IoCs
pid Process 4308 0270fa061e64b90835ef1cfb28f08b35.exe 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found - Suspicious use of AdjustPrivilegeToken 30 IoCs
description pid Process Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found - Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 2560 wrote to memory of 228 2560 Process not Found 90 PID 2560 wrote to memory of 228 2560 Process not Found 90 PID 2560 wrote to memory of 228 2560 Process not Found 90 PID 2560 wrote to memory of 2056 2560 Process not Found 92 PID 2560 wrote to memory of 2056 2560 Process not Found 92 PID 2560 wrote to memory of 2056 2560 Process not Found 92 PID 2560 wrote to memory of 3500 2560 Process not Found 94 PID 2560 wrote to memory of 3500 2560 Process not Found 94 PID 2560 wrote to memory of 3500 2560 Process not Found 94 PID 2560 wrote to memory of 3696 2560 Process not Found 96 PID 2560 wrote to memory of 3696 2560 Process not Found 96 PID 2560 wrote to memory of 3696 2560 Process not Found 96 PID 2560 wrote to memory of 3696 2560 Process not Found 96 PID 2560 wrote to memory of 3980 2560 Process not Found 97 PID 2560 wrote to memory of 3980 2560 Process not Found 97 PID 2560 wrote to memory of 3980 2560 Process not Found 97 PID 2560 wrote to memory of 4168 2560 Process not Found 98 PID 2560 wrote to memory of 4168 2560 Process not Found 98 PID 2560 wrote to memory of 4168 2560 Process not Found 98 PID 2560 wrote to memory of 4168 2560 Process not Found 98 PID 2560 wrote to memory of 3304 2560 Process not Found 99 PID 2560 wrote to memory of 3304 2560 Process not Found 99 PID 2560 wrote to memory of 3304 2560 Process not Found 99 PID 2560 wrote to memory of 3312 2560 Process not Found 100 PID 2560 wrote to memory of 3312 2560 Process not Found 100 PID 2560 wrote to memory of 3312 2560 Process not Found 100 PID 2560 wrote to memory of 3312 2560 Process not Found 100 PID 2560 wrote to memory of 1604 2560 Process not Found 101 PID 2560 wrote to memory of 1604 2560 Process not Found 101 PID 2560 wrote to memory of 1604 2560 Process not Found 101 PID 2560 wrote to memory of 1604 2560 Process not Found 101 PID 2560 wrote to memory of 2344 2560 Process not Found 102 PID 2560 wrote to memory of 2344 2560 Process not Found 102 PID 2560 wrote to memory of 2344 2560 Process not Found 102 PID 2560 wrote to memory of 2344 2560 Process not Found 102 PID 2560 wrote to memory of 2712 2560 Process not Found 103 PID 2560 wrote to memory of 2712 2560 Process not Found 103 PID 2560 wrote to memory of 2712 2560 Process not Found 103 PID 2560 wrote to memory of 3564 2560 Process not Found 104 PID 2560 wrote to memory of 3564 2560 Process not Found 104 PID 2560 wrote to memory of 3564 2560 Process not Found 104 PID 2560 wrote to memory of 3564 2560 Process not Found 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\0270fa061e64b90835ef1cfb28f08b35.exe"C:\Users\Admin\AppData\Local\Temp\0270fa061e64b90835ef1cfb28f08b35.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4308
-
C:\Users\Admin\AppData\Local\Temp\E10E.exeC:\Users\Admin\AppData\Local\Temp\E10E.exe1⤵
- Executes dropped EXE
PID:228
-
C:\Users\Admin\AppData\Local\Temp\E797.exeC:\Users\Admin\AppData\Local\Temp\E797.exe1⤵
- Executes dropped EXE
PID:2056
-
C:\Users\Admin\AppData\Local\Temp\F469.exeC:\Users\Admin\AppData\Local\Temp\F469.exe1⤵
- Executes dropped EXE
PID:3500
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3696
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3980
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4168
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3304
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3312
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1604
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2344
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2712
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3564
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\E10E.exe
- Size 316KB
- SHA256 35dd2001a2807d4fbb6b89626155090115ec3ba9b66e1fb33eef6756d69312c4
- MD5 22be3d12e39c6fe942c301f2d67717dd
- SHA1 2d3428bb2266074e2aa21942d10d913c48c4c6f7
- SHA512 4ec99cd953c36f0bafd6bc7e9743c5934d07017eb3276b2ac8e86242433be18bf8d6865568d8d914177f0ea21b925fd9ba5dd11050d9c3e2e6068624869c9ea1
- SSDEEP 6144:annqcXzZXEzabuCntbPIqlTOfwjUSdAOb2gQcfGVDxP+VAiCjho3q7ye9:anqAtXEz4uCntjbd92gkXP+V6o67ys
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\E10E.exe
- Size 316KB
- SHA256 35dd2001a2807d4fbb6b89626155090115ec3ba9b66e1fb33eef6756d69312c4
- MD5 22be3d12e39c6fe942c301f2d67717dd
- SHA1 2d3428bb2266074e2aa21942d10d913c48c4c6f7
- SHA512 4ec99cd953c36f0bafd6bc7e9743c5934d07017eb3276b2ac8e86242433be18bf8d6865568d8d914177f0ea21b925fd9ba5dd11050d9c3e2e6068624869c9ea1
- SSDEEP 6144:annqcXzZXEzabuCntbPIqlTOfwjUSdAOb2gQcfGVDxP+VAiCjho3q7ye9:anqAtXEz4uCntjbd92gkXP+V6o67ys
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\E797.exe
- Size 363KB
- SHA256 5b698dfd9cc6863c59ceec45ecbcc8c7024099eecf5ee7e640841d4c46afaf46
- MD5 ce404285413523eb7fcb0b8e452659c3
- SHA1 a4f55d1eb64c4a9da284e7c214eb155fc50cfe5c
- SHA512 28a495764e28915a9da7bf78e50d52383d9d041c7e9383de8ddd6a99e1cb99f85711daa15f5f084f88403da1055a7a24fd39f45f0879cd740737b4228cac28ad
- SSDEEP 6144:hOdakYVDzEzaBXdIctm7KOMsfcjaS6uAOXEAHxsOzSxZlrsg+3YtamdN0xDT9:hMa7NzEz6XdIc43Xu1ElOzyZlrv3C
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\E797.exe
- Size 363KB
- SHA256 5b698dfd9cc6863c59ceec45ecbcc8c7024099eecf5ee7e640841d4c46afaf46
- MD5 ce404285413523eb7fcb0b8e452659c3
- SHA1 a4f55d1eb64c4a9da284e7c214eb155fc50cfe5c
- SHA512 28a495764e28915a9da7bf78e50d52383d9d041c7e9383de8ddd6a99e1cb99f85711daa15f5f084f88403da1055a7a24fd39f45f0879cd740737b4228cac28ad
- SSDEEP 6144:hOdakYVDzEzaBXdIctm7KOMsfcjaS6uAOXEAHxsOzSxZlrsg+3YtamdN0xDT9:hMa7NzEz6XdIc43Xu1ElOzyZlrv3C
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\F469.exe
- Size 363KB
- SHA256 8571f6ca5c9ca91bbf7bb73a270c67748cb472b1f1d8020c99f2f866810382a0
- MD5 2f9b9af920930429ba2cf1d56a4454ef
- SHA1 86ac6f3d97c0aab1be72d5edd1213248be6f6074
- SHA512 fd02d44962dfe2e728b768434b912cd77f654d37703e147509c04818c489ae39016e06e76bd1d4899a57d055c684cdc9db829bc0d9311a89ac513e1d004e2ad4
- SSDEEP 6144:FHdLGEo9jzEzaWuN4stWLqexuoZKfcjU6VAOLElCWE3xzyfinqHNN6kMGe9:F9LGrlzEzVuN4sIRVxEl43xIinqHNN6L
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\F469.exe
- Size 363KB
- SHA256 8571f6ca5c9ca91bbf7bb73a270c67748cb472b1f1d8020c99f2f866810382a0
- MD5 2f9b9af920930429ba2cf1d56a4454ef
- SHA1 86ac6f3d97c0aab1be72d5edd1213248be6f6074
- SHA512 fd02d44962dfe2e728b768434b912cd77f654d37703e147509c04818c489ae39016e06e76bd1d4899a57d055c684cdc9db829bc0d9311a89ac513e1d004e2ad4
- SSDEEP 6144:FHdLGEo9jzEzaWuN4stWLqexuoZKfcjU6VAOLElCWE3xzyfinqHNN6kMGe9:F9LGrlzEzVuN4sIRVxEl43xIinqHNN6L
- MD5 SHA1 SHA512 SSDEEP