Analysis
-
max time kernel
160s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06-10-2022 02:29
Static task
static1
Behavioral task
behavioral1
Sample
7eb4d64a7d16f78d7cc76d68a709cb08a3b78cfa865ef19aa6a16a78183f850f.exe
Resource
win10v2004-20220812-en
General
-
Target
7eb4d64a7d16f78d7cc76d68a709cb08a3b78cfa865ef19aa6a16a78183f850f.exe
-
Size
145KB
-
MD5
4102ef39f1a8cf2fea949454582cf44e
-
SHA1
07bc1d5d7e7ce2cd5fab221cddf2f5ddea26ba9c
-
SHA256
7eb4d64a7d16f78d7cc76d68a709cb08a3b78cfa865ef19aa6a16a78183f850f
-
SHA512
30b622e67fa0e1674b27e6d2d2fe3951a25f2d3283ba860deede7437e32419cd73d55e2d2a9977e58844a0588ddd0ec6b16d147c0dadb92a36f0e358981487c2
-
SSDEEP
3072:kbZY1phfezV6ieQ+a6tD8xlFdUkIuGptO:cmK5Ahs1yPt
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1960-133-0x0000000002170000-0x0000000002179000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
2FBB.exe3634.exe4306.exepid process 3056 2FBB.exe 1440 3634.exe 3184 4306.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
7eb4d64a7d16f78d7cc76d68a709cb08a3b78cfa865ef19aa6a16a78183f850f.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 7eb4d64a7d16f78d7cc76d68a709cb08a3b78cfa865ef19aa6a16a78183f850f.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 7eb4d64a7d16f78d7cc76d68a709cb08a3b78cfa865ef19aa6a16a78183f850f.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 7eb4d64a7d16f78d7cc76d68a709cb08a3b78cfa865ef19aa6a16a78183f850f.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
7eb4d64a7d16f78d7cc76d68a709cb08a3b78cfa865ef19aa6a16a78183f850f.exepid process 1960 7eb4d64a7d16f78d7cc76d68a709cb08a3b78cfa865ef19aa6a16a78183f850f.exe 1960 7eb4d64a7d16f78d7cc76d68a709cb08a3b78cfa865ef19aa6a16a78183f850f.exe 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 372 -
Suspicious behavior: MapViewOfSection 19 IoCs
Processes:
7eb4d64a7d16f78d7cc76d68a709cb08a3b78cfa865ef19aa6a16a78183f850f.exepid process 1960 7eb4d64a7d16f78d7cc76d68a709cb08a3b78cfa865ef19aa6a16a78183f850f.exe 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 372 -
Suspicious use of AdjustPrivilegeToken 30 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 372 Token: SeCreatePagefilePrivilege 372 Token: SeShutdownPrivilege 372 Token: SeCreatePagefilePrivilege 372 Token: SeShutdownPrivilege 372 Token: SeCreatePagefilePrivilege 372 Token: SeShutdownPrivilege 372 Token: SeCreatePagefilePrivilege 372 Token: SeShutdownPrivilege 372 Token: SeCreatePagefilePrivilege 372 Token: SeShutdownPrivilege 372 Token: SeCreatePagefilePrivilege 372 Token: SeShutdownPrivilege 372 Token: SeCreatePagefilePrivilege 372 Token: SeShutdownPrivilege 372 Token: SeCreatePagefilePrivilege 372 Token: SeShutdownPrivilege 372 Token: SeCreatePagefilePrivilege 372 Token: SeShutdownPrivilege 372 Token: SeCreatePagefilePrivilege 372 Token: SeShutdownPrivilege 372 Token: SeCreatePagefilePrivilege 372 Token: SeShutdownPrivilege 372 Token: SeCreatePagefilePrivilege 372 Token: SeShutdownPrivilege 372 Token: SeCreatePagefilePrivilege 372 Token: SeShutdownPrivilege 372 Token: SeCreatePagefilePrivilege 372 Token: SeShutdownPrivilege 372 Token: SeCreatePagefilePrivilege 372 -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
description pid process target process PID 372 wrote to memory of 3056 372 2FBB.exe PID 372 wrote to memory of 3056 372 2FBB.exe PID 372 wrote to memory of 3056 372 2FBB.exe PID 372 wrote to memory of 1440 372 3634.exe PID 372 wrote to memory of 1440 372 3634.exe PID 372 wrote to memory of 1440 372 3634.exe PID 372 wrote to memory of 3184 372 4306.exe PID 372 wrote to memory of 3184 372 4306.exe PID 372 wrote to memory of 3184 372 4306.exe PID 372 wrote to memory of 4712 372 explorer.exe PID 372 wrote to memory of 4712 372 explorer.exe PID 372 wrote to memory of 4712 372 explorer.exe PID 372 wrote to memory of 4712 372 explorer.exe PID 372 wrote to memory of 2412 372 explorer.exe PID 372 wrote to memory of 2412 372 explorer.exe PID 372 wrote to memory of 2412 372 explorer.exe PID 372 wrote to memory of 5012 372 explorer.exe PID 372 wrote to memory of 5012 372 explorer.exe PID 372 wrote to memory of 5012 372 explorer.exe PID 372 wrote to memory of 5012 372 explorer.exe PID 372 wrote to memory of 716 372 explorer.exe PID 372 wrote to memory of 716 372 explorer.exe PID 372 wrote to memory of 716 372 explorer.exe PID 372 wrote to memory of 2068 372 explorer.exe PID 372 wrote to memory of 2068 372 explorer.exe PID 372 wrote to memory of 2068 372 explorer.exe PID 372 wrote to memory of 2068 372 explorer.exe PID 372 wrote to memory of 2000 372 explorer.exe PID 372 wrote to memory of 2000 372 explorer.exe PID 372 wrote to memory of 2000 372 explorer.exe PID 372 wrote to memory of 2000 372 explorer.exe PID 372 wrote to memory of 1148 372 explorer.exe PID 372 wrote to memory of 1148 372 explorer.exe PID 372 wrote to memory of 1148 372 explorer.exe PID 372 wrote to memory of 1148 372 explorer.exe PID 372 wrote to memory of 3248 372 explorer.exe PID 372 wrote to memory of 3248 372 explorer.exe PID 372 wrote to memory of 3248 372 explorer.exe PID 372 wrote to memory of 4732 372 explorer.exe PID 372 wrote to memory of 4732 372 explorer.exe PID 372 wrote to memory of 4732 372 explorer.exe PID 372 wrote to memory of 4732 372 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7eb4d64a7d16f78d7cc76d68a709cb08a3b78cfa865ef19aa6a16a78183f850f.exe"C:\Users\Admin\AppData\Local\Temp\7eb4d64a7d16f78d7cc76d68a709cb08a3b78cfa865ef19aa6a16a78183f850f.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\2FBB.exeC:\Users\Admin\AppData\Local\Temp\2FBB.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3634.exeC:\Users\Admin\AppData\Local\Temp\3634.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\4306.exeC:\Users\Admin\AppData\Local\Temp\4306.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\2FBB.exeFilesize
316KB
MD527cdcc66310e8a239ef822684833efd2
SHA17f3e3055ba30047819094b0121b316d9364e2707
SHA25607c94a43d67cc347c043105b104a8ccc57eb97f7ffe4f5114ea6c13dcf07aba2
SHA5126b0e4811dba1fd6afab3a074da9a440bd318f5eb74ab48cb8d57913c410115e6811f51dc5f3bd04240821dcee84db772accf3af858ab0db18e6dcd9ef2de9a54
-
C:\Users\Admin\AppData\Local\Temp\2FBB.exeFilesize
316KB
MD527cdcc66310e8a239ef822684833efd2
SHA17f3e3055ba30047819094b0121b316d9364e2707
SHA25607c94a43d67cc347c043105b104a8ccc57eb97f7ffe4f5114ea6c13dcf07aba2
SHA5126b0e4811dba1fd6afab3a074da9a440bd318f5eb74ab48cb8d57913c410115e6811f51dc5f3bd04240821dcee84db772accf3af858ab0db18e6dcd9ef2de9a54
-
C:\Users\Admin\AppData\Local\Temp\3634.exeFilesize
363KB
MD5e292a6cbeb112872c04796311b52ae30
SHA18ecefecab9231e42429a33256f5db84eff302948
SHA25639c4fa10490d1f6e5f909786dee9ab0d8e8eb79bb04a9c541d2209224367ad16
SHA512c506b3c796d99f8fb3e70d36596720bd1a6328a653c77769e20cbb358da122e576d72518508f63217e80985eb9abaa79abaa681312e9100445e391828029577e
-
C:\Users\Admin\AppData\Local\Temp\3634.exeFilesize
363KB
MD5e292a6cbeb112872c04796311b52ae30
SHA18ecefecab9231e42429a33256f5db84eff302948
SHA25639c4fa10490d1f6e5f909786dee9ab0d8e8eb79bb04a9c541d2209224367ad16
SHA512c506b3c796d99f8fb3e70d36596720bd1a6328a653c77769e20cbb358da122e576d72518508f63217e80985eb9abaa79abaa681312e9100445e391828029577e
-
C:\Users\Admin\AppData\Local\Temp\4306.exeFilesize
363KB
MD5ad170ecbf3579649162c3cb67d398672
SHA1838306ef60ae4286030be9b395c866abd0c8ff47
SHA2565e924125ff6aeb76684f4fb7f578c6d9278b243ed18e9a9eff8b2b28045ec5a5
SHA51283a5511b668f49d4361a4a9dd5c8944c6395504f8f31c3a0ab94a9ea1d75d4b17c72c433c53d73cd9dfbb641c34b2741ef15474bacc7c6728e889511ffafc185
-
C:\Users\Admin\AppData\Local\Temp\4306.exeFilesize
363KB
MD5ad170ecbf3579649162c3cb67d398672
SHA1838306ef60ae4286030be9b395c866abd0c8ff47
SHA2565e924125ff6aeb76684f4fb7f578c6d9278b243ed18e9a9eff8b2b28045ec5a5
SHA51283a5511b668f49d4361a4a9dd5c8944c6395504f8f31c3a0ab94a9ea1d75d4b17c72c433c53d73cd9dfbb641c34b2741ef15474bacc7c6728e889511ffafc185
-
memory/716-156-0x0000000000350000-0x000000000035C000-memory.dmpFilesize
48KB
-
memory/716-175-0x0000000000360000-0x0000000000366000-memory.dmpFilesize
24KB
-
memory/716-155-0x0000000000360000-0x0000000000366000-memory.dmpFilesize
24KB
-
memory/716-154-0x0000000000000000-mapping.dmp
-
memory/1148-178-0x0000000000F70000-0x0000000000F76000-memory.dmpFilesize
24KB
-
memory/1148-163-0x0000000000000000-mapping.dmp
-
memory/1148-164-0x0000000000F70000-0x0000000000F76000-memory.dmpFilesize
24KB
-
memory/1148-165-0x0000000000F60000-0x0000000000F6B000-memory.dmpFilesize
44KB
-
memory/1440-139-0x0000000000000000-mapping.dmp
-
memory/1960-133-0x0000000002170000-0x0000000002179000-memory.dmpFilesize
36KB
-
memory/1960-132-0x00000000005DD000-0x00000000005ED000-memory.dmpFilesize
64KB
-
memory/1960-135-0x0000000000400000-0x0000000000580000-memory.dmpFilesize
1.5MB
-
memory/1960-134-0x0000000000400000-0x0000000000580000-memory.dmpFilesize
1.5MB
-
memory/2000-162-0x0000000000180000-0x0000000000189000-memory.dmpFilesize
36KB
-
memory/2000-161-0x0000000000190000-0x0000000000195000-memory.dmpFilesize
20KB
-
memory/2000-160-0x0000000000000000-mapping.dmp
-
memory/2000-177-0x0000000000190000-0x0000000000195000-memory.dmpFilesize
20KB
-
memory/2068-176-0x0000000000660000-0x0000000000682000-memory.dmpFilesize
136KB
-
memory/2068-159-0x0000000000630000-0x0000000000657000-memory.dmpFilesize
156KB
-
memory/2068-157-0x0000000000000000-mapping.dmp
-
memory/2068-158-0x0000000000660000-0x0000000000682000-memory.dmpFilesize
136KB
-
memory/2412-149-0x0000000000F70000-0x0000000000F79000-memory.dmpFilesize
36KB
-
memory/2412-150-0x0000000000F60000-0x0000000000F6F000-memory.dmpFilesize
60KB
-
memory/2412-146-0x0000000000000000-mapping.dmp
-
memory/2412-173-0x0000000000F70000-0x0000000000F79000-memory.dmpFilesize
36KB
-
memory/3056-136-0x0000000000000000-mapping.dmp
-
memory/3184-142-0x0000000000000000-mapping.dmp
-
memory/3248-168-0x00000000009E0000-0x00000000009ED000-memory.dmpFilesize
52KB
-
memory/3248-166-0x0000000000000000-mapping.dmp
-
memory/3248-167-0x00000000009F0000-0x00000000009F7000-memory.dmpFilesize
28KB
-
memory/4712-147-0x0000000000F90000-0x0000000000F97000-memory.dmpFilesize
28KB
-
memory/4712-172-0x0000000000F90000-0x0000000000F97000-memory.dmpFilesize
28KB
-
memory/4712-148-0x0000000000F80000-0x0000000000F8B000-memory.dmpFilesize
44KB
-
memory/4712-145-0x0000000000000000-mapping.dmp
-
memory/4732-169-0x0000000000000000-mapping.dmp
-
memory/4732-170-0x0000000000F70000-0x0000000000F78000-memory.dmpFilesize
32KB
-
memory/4732-171-0x0000000000F60000-0x0000000000F6B000-memory.dmpFilesize
44KB
-
memory/4732-179-0x0000000000F70000-0x0000000000F78000-memory.dmpFilesize
32KB
-
memory/5012-153-0x00000000007E0000-0x00000000007E9000-memory.dmpFilesize
36KB
-
memory/5012-174-0x00000000007F0000-0x00000000007F5000-memory.dmpFilesize
20KB
-
memory/5012-151-0x0000000000000000-mapping.dmp
-
memory/5012-152-0x00000000007F0000-0x00000000007F5000-memory.dmpFilesize
20KB