Analysis
-
max time kernel
150s -
max time network
67s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
06-10-2022 02:11
Static task
static1
Behavioral task
behavioral1
Sample
4332ca4ccec589a8a58e27bcdcd728d8776ea8ab1c882b3764e66cedcef86433.exe
Resource
win10-20220901-en
General
-
Target
4332ca4ccec589a8a58e27bcdcd728d8776ea8ab1c882b3764e66cedcef86433.exe
-
Size
145KB
-
MD5
6fb99c1a6eabaae2c39116bf1d51850a
-
SHA1
ffb86f76dcf53b96059c2d07a775c4d78607fc41
-
SHA256
4332ca4ccec589a8a58e27bcdcd728d8776ea8ab1c882b3764e66cedcef86433
-
SHA512
eae3de0f097ed35beb94677529b97867fdc2ec87363ea15b71f15da5e9f92ab55728f117937130b73fb5f0482afcbb1debe0da65f66c23e6b642089e7f573d0d
-
SSDEEP
3072:up1OVshfaSaBNvvgCqWncp2yiCgNd+/eO:wwBSaN3Dq50Cw4/e
Malware Config
Signatures
-
Detects Smokeloader packer 5 IoCs
Processes:
resource yara_rule behavioral1/memory/5084-151-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/2764-150-0x0000000002290000-0x0000000002299000-memory.dmp family_smokeloader behavioral1/memory/5084-152-0x0000000000402DD8-mapping.dmp family_smokeloader behavioral1/memory/5084-164-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/5084-183-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 2364 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
4332ca4ccec589a8a58e27bcdcd728d8776ea8ab1c882b3764e66cedcef86433.exedescription pid process target process PID 2764 set thread context of 5084 2764 4332ca4ccec589a8a58e27bcdcd728d8776ea8ab1c882b3764e66cedcef86433.exe 4332ca4ccec589a8a58e27bcdcd728d8776ea8ab1c882b3764e66cedcef86433.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
4332ca4ccec589a8a58e27bcdcd728d8776ea8ab1c882b3764e66cedcef86433.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4332ca4ccec589a8a58e27bcdcd728d8776ea8ab1c882b3764e66cedcef86433.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4332ca4ccec589a8a58e27bcdcd728d8776ea8ab1c882b3764e66cedcef86433.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4332ca4ccec589a8a58e27bcdcd728d8776ea8ab1c882b3764e66cedcef86433.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
4332ca4ccec589a8a58e27bcdcd728d8776ea8ab1c882b3764e66cedcef86433.exepid process 5084 4332ca4ccec589a8a58e27bcdcd728d8776ea8ab1c882b3764e66cedcef86433.exe 5084 4332ca4ccec589a8a58e27bcdcd728d8776ea8ab1c882b3764e66cedcef86433.exe 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 2364 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2364 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
4332ca4ccec589a8a58e27bcdcd728d8776ea8ab1c882b3764e66cedcef86433.exepid process 5084 4332ca4ccec589a8a58e27bcdcd728d8776ea8ab1c882b3764e66cedcef86433.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
4332ca4ccec589a8a58e27bcdcd728d8776ea8ab1c882b3764e66cedcef86433.exedescription pid process target process PID 2764 wrote to memory of 5084 2764 4332ca4ccec589a8a58e27bcdcd728d8776ea8ab1c882b3764e66cedcef86433.exe 4332ca4ccec589a8a58e27bcdcd728d8776ea8ab1c882b3764e66cedcef86433.exe PID 2764 wrote to memory of 5084 2764 4332ca4ccec589a8a58e27bcdcd728d8776ea8ab1c882b3764e66cedcef86433.exe 4332ca4ccec589a8a58e27bcdcd728d8776ea8ab1c882b3764e66cedcef86433.exe PID 2764 wrote to memory of 5084 2764 4332ca4ccec589a8a58e27bcdcd728d8776ea8ab1c882b3764e66cedcef86433.exe 4332ca4ccec589a8a58e27bcdcd728d8776ea8ab1c882b3764e66cedcef86433.exe PID 2764 wrote to memory of 5084 2764 4332ca4ccec589a8a58e27bcdcd728d8776ea8ab1c882b3764e66cedcef86433.exe 4332ca4ccec589a8a58e27bcdcd728d8776ea8ab1c882b3764e66cedcef86433.exe PID 2764 wrote to memory of 5084 2764 4332ca4ccec589a8a58e27bcdcd728d8776ea8ab1c882b3764e66cedcef86433.exe 4332ca4ccec589a8a58e27bcdcd728d8776ea8ab1c882b3764e66cedcef86433.exe PID 2764 wrote to memory of 5084 2764 4332ca4ccec589a8a58e27bcdcd728d8776ea8ab1c882b3764e66cedcef86433.exe 4332ca4ccec589a8a58e27bcdcd728d8776ea8ab1c882b3764e66cedcef86433.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4332ca4ccec589a8a58e27bcdcd728d8776ea8ab1c882b3764e66cedcef86433.exe"C:\Users\Admin\AppData\Local\Temp\4332ca4ccec589a8a58e27bcdcd728d8776ea8ab1c882b3764e66cedcef86433.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4332ca4ccec589a8a58e27bcdcd728d8776ea8ab1c882b3764e66cedcef86433.exe"C:\Users\Admin\AppData\Local\Temp\4332ca4ccec589a8a58e27bcdcd728d8776ea8ab1c882b3764e66cedcef86433.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2764-150-0x0000000002290000-0x0000000002299000-memory.dmpFilesize
36KB
-
memory/2764-121-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2764-122-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2764-123-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2764-124-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2764-125-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2764-126-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2764-127-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2764-128-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2764-129-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2764-130-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2764-131-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2764-132-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2764-133-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2764-134-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2764-136-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2764-135-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2764-137-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2764-138-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2764-139-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2764-140-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2764-141-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2764-143-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2764-144-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2764-145-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2764-146-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2764-147-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2764-148-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2764-149-0x0000000000660000-0x00000000007AA000-memory.dmpFilesize
1.3MB
-
memory/2764-120-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/5084-151-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/5084-152-0x0000000000402DD8-mapping.dmp
-
memory/5084-153-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/5084-154-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/5084-155-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/5084-156-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/5084-157-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/5084-158-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/5084-159-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/5084-161-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/5084-160-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/5084-162-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/5084-163-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/5084-165-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/5084-164-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/5084-166-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/5084-167-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/5084-168-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/5084-170-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/5084-171-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/5084-172-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/5084-173-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/5084-174-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/5084-169-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/5084-175-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/5084-176-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/5084-177-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/5084-178-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/5084-179-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/5084-180-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/5084-181-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/5084-182-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/5084-183-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB