Analysis
- max time kernel
150s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system - submitted
06/10/2022, 07:31
Static task
static1
Behavioral task
behavioral1
Sample
c3b0bf7d0c11b5b2cf88a5a05879c649.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
c3b0bf7d0c11b5b2cf88a5a05879c649.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target c3b0bf7d0c11b5b2cf88a5a05879c649.exe
- Size 146KB
- Sample221006-jcdj6agfc2
- SHA256 53e91aa8e47dc26f0289b1800aa76bafe0b8274e99585d91e2da679d8353d6a3
- MD5 c3b0bf7d0c11b5b2cf88a5a05879c649
- SHA1 063791ec150bdc93c5af7768cc0deabec1aafebc
- SHA512 f0bd7f97b1c1be55da42a8c5eb644330806c7021765c78ae0780374ce02432334d3379b1198d0590a1ea2fd3bc43fcc0c713a06a9a5d3be9fc5d4fe4e8ab6416
- SSDEEP 1536:aJ2AD/fxK+FT+BN2++t4Bj8BkzCTl8XYiDraPCMu1iP+oo3r0ov1piQOuwluhOi:aJ2ADBlb++GB/2Tl8kCfXRZ4uhO
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/4328-133-0x0000000002180000-0x0000000002189000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 3 IoCs
pid Process 2932 2693.exe 380 2B08.exe 1408 33A5.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c3b0bf7d0c11b5b2cf88a5a05879c649.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c3b0bf7d0c11b5b2cf88a5a05879c649.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c3b0bf7d0c11b5b2cf88a5a05879c649.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4328 c3b0bf7d0c11b5b2cf88a5a05879c649.exe 4328 c3b0bf7d0c11b5b2cf88a5a05879c649.exe 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3056 Process not Found - Suspicious behavior: MapViewOfSection 19 IoCs
pid Process 4328 c3b0bf7d0c11b5b2cf88a5a05879c649.exe 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found 3056 Process not Found - Suspicious use of AdjustPrivilegeToken 30 IoCs
description pid Process Token: SeShutdownPrivilege 3056 Process not Found Token: SeCreatePagefilePrivilege 3056 Process not Found Token: SeShutdownPrivilege 3056 Process not Found Token: SeCreatePagefilePrivilege 3056 Process not Found Token: SeShutdownPrivilege 3056 Process not Found Token: SeCreatePagefilePrivilege 3056 Process not Found Token: SeShutdownPrivilege 3056 Process not Found Token: SeCreatePagefilePrivilege 3056 Process not Found Token: SeShutdownPrivilege 3056 Process not Found Token: SeCreatePagefilePrivilege 3056 Process not Found Token: SeShutdownPrivilege 3056 Process not Found Token: SeCreatePagefilePrivilege 3056 Process not Found Token: SeShutdownPrivilege 3056 Process not Found Token: SeCreatePagefilePrivilege 3056 Process not Found Token: SeShutdownPrivilege 3056 Process not Found Token: SeCreatePagefilePrivilege 3056 Process not Found Token: SeShutdownPrivilege 3056 Process not Found Token: SeCreatePagefilePrivilege 3056 Process not Found Token: SeShutdownPrivilege 3056 Process not Found Token: SeCreatePagefilePrivilege 3056 Process not Found Token: SeShutdownPrivilege 3056 Process not Found Token: SeCreatePagefilePrivilege 3056 Process not Found Token: SeShutdownPrivilege 3056 Process not Found Token: SeCreatePagefilePrivilege 3056 Process not Found Token: SeShutdownPrivilege 3056 Process not Found Token: SeCreatePagefilePrivilege 3056 Process not Found Token: SeShutdownPrivilege 3056 Process not Found Token: SeCreatePagefilePrivilege 3056 Process not Found Token: SeShutdownPrivilege 3056 Process not Found Token: SeCreatePagefilePrivilege 3056 Process not Found - Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 3056 wrote to memory of 2932 3056 Process not Found 86 PID 3056 wrote to memory of 2932 3056 Process not Found 86 PID 3056 wrote to memory of 2932 3056 Process not Found 86 PID 3056 wrote to memory of 380 3056 Process not Found 88 PID 3056 wrote to memory of 380 3056 Process not Found 88 PID 3056 wrote to memory of 380 3056 Process not Found 88 PID 3056 wrote to memory of 1408 3056 Process not Found 91 PID 3056 wrote to memory of 1408 3056 Process not Found 91 PID 3056 wrote to memory of 1408 3056 Process not Found 91 PID 3056 wrote to memory of 2776 3056 Process not Found 93 PID 3056 wrote to memory of 2776 3056 Process not Found 93 PID 3056 wrote to memory of 2776 3056 Process not Found 93 PID 3056 wrote to memory of 2776 3056 Process not Found 93 PID 3056 wrote to memory of 944 3056 Process not Found 94 PID 3056 wrote to memory of 944 3056 Process not Found 94 PID 3056 wrote to memory of 944 3056 Process not Found 94 PID 3056 wrote to memory of 1404 3056 Process not Found 95 PID 3056 wrote to memory of 1404 3056 Process not Found 95 PID 3056 wrote to memory of 1404 3056 Process not Found 95 PID 3056 wrote to memory of 1404 3056 Process not Found 95 PID 3056 wrote to memory of 548 3056 Process not Found 96 PID 3056 wrote to memory of 548 3056 Process not Found 96 PID 3056 wrote to memory of 548 3056 Process not Found 96 PID 3056 wrote to memory of 3128 3056 Process not Found 97 PID 3056 wrote to memory of 3128 3056 Process not Found 97 PID 3056 wrote to memory of 3128 3056 Process not Found 97 PID 3056 wrote to memory of 3128 3056 Process not Found 97 PID 3056 wrote to memory of 4048 3056 Process not Found 98 PID 3056 wrote to memory of 4048 3056 Process not Found 98 PID 3056 wrote to memory of 4048 3056 Process not Found 98 PID 3056 wrote to memory of 4048 3056 Process not Found 98 PID 3056 wrote to memory of 4476 3056 Process not Found 99 PID 3056 wrote to memory of 4476 3056 Process not Found 99 PID 3056 wrote to memory of 4476 3056 Process not Found 99 PID 3056 wrote to memory of 4476 3056 Process not Found 99 PID 3056 wrote to memory of 1572 3056 Process not Found 100 PID 3056 wrote to memory of 1572 3056 Process not Found 100 PID 3056 wrote to memory of 1572 3056 Process not Found 100 PID 3056 wrote to memory of 4364 3056 Process not Found 101 PID 3056 wrote to memory of 4364 3056 Process not Found 101 PID 3056 wrote to memory of 4364 3056 Process not Found 101 PID 3056 wrote to memory of 4364 3056 Process not Found 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\c3b0bf7d0c11b5b2cf88a5a05879c649.exe"C:\Users\Admin\AppData\Local\Temp\c3b0bf7d0c11b5b2cf88a5a05879c649.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4328
-
C:\Users\Admin\AppData\Local\Temp\2693.exeC:\Users\Admin\AppData\Local\Temp\2693.exe1⤵
- Executes dropped EXE
PID:2932
-
C:\Users\Admin\AppData\Local\Temp\2B08.exeC:\Users\Admin\AppData\Local\Temp\2B08.exe1⤵
- Executes dropped EXE
PID:380
-
C:\Users\Admin\AppData\Local\Temp\33A5.exeC:\Users\Admin\AppData\Local\Temp\33A5.exe1⤵
- Executes dropped EXE
PID:1408
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2776
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:944
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1404
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:548
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3128
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4048
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4476
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1572
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4364
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\2693.exe
- Size 316KB
- SHA256 07c94a43d67cc347c043105b104a8ccc57eb97f7ffe4f5114ea6c13dcf07aba2
- MD5 27cdcc66310e8a239ef822684833efd2
- SHA1 7f3e3055ba30047819094b0121b316d9364e2707
- SHA512 6b0e4811dba1fd6afab3a074da9a440bd318f5eb74ab48cb8d57913c410115e6811f51dc5f3bd04240821dcee84db772accf3af858ab0db18e6dcd9ef2de9a54
- SSDEEP 6144:SVnqcXzZXEzabuCntbPIqlTOfwjUSdAOD2CCGrJkaT07SPJl09:S9qAtXEz4uCntjbdJ2CBJJooe
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\2693.exe
- Size 316KB
- SHA256 07c94a43d67cc347c043105b104a8ccc57eb97f7ffe4f5114ea6c13dcf07aba2
- MD5 27cdcc66310e8a239ef822684833efd2
- SHA1 7f3e3055ba30047819094b0121b316d9364e2707
- SHA512 6b0e4811dba1fd6afab3a074da9a440bd318f5eb74ab48cb8d57913c410115e6811f51dc5f3bd04240821dcee84db772accf3af858ab0db18e6dcd9ef2de9a54
- SSDEEP 6144:SVnqcXzZXEzabuCntbPIqlTOfwjUSdAOD2CCGrJkaT07SPJl09:S9qAtXEz4uCntjbdJ2CBJJooe
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\2B08.exe
- Size 363KB
- SHA256 39c4fa10490d1f6e5f909786dee9ab0d8e8eb79bb04a9c541d2209224367ad16
- MD5 e292a6cbeb112872c04796311b52ae30
- SHA1 8ecefecab9231e42429a33256f5db84eff302948
- SHA512 c506b3c796d99f8fb3e70d36596720bd1a6328a653c77769e20cbb358da122e576d72518508f63217e80985eb9abaa79abaa681312e9100445e391828029577e
- SSDEEP 6144:SXdLGEo9jzEzaWuN4stWLqexuoZKfcjU6VAOWEY03RewjGfEgqSYHOeXZdRnSkkg:SNLGrlzEzVuN4sIRVoEY03XjGRoZjkL8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\2B08.exe
- Size 363KB
- SHA256 39c4fa10490d1f6e5f909786dee9ab0d8e8eb79bb04a9c541d2209224367ad16
- MD5 e292a6cbeb112872c04796311b52ae30
- SHA1 8ecefecab9231e42429a33256f5db84eff302948
- SHA512 c506b3c796d99f8fb3e70d36596720bd1a6328a653c77769e20cbb358da122e576d72518508f63217e80985eb9abaa79abaa681312e9100445e391828029577e
- SSDEEP 6144:SXdLGEo9jzEzaWuN4stWLqexuoZKfcjU6VAOWEY03RewjGfEgqSYHOeXZdRnSkkg:SNLGrlzEzVuN4sIRVoEY03XjGRoZjkL8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\33A5.exe
- Size 363KB
- SHA256 5e924125ff6aeb76684f4fb7f578c6d9278b243ed18e9a9eff8b2b28045ec5a5
- MD5 ad170ecbf3579649162c3cb67d398672
- SHA1 838306ef60ae4286030be9b395c866abd0c8ff47
- SHA512 83a5511b668f49d4361a4a9dd5c8944c6395504f8f31c3a0ab94a9ea1d75d4b17c72c433c53d73cd9dfbb641c34b2741ef15474bacc7c6728e889511ffafc185
- SSDEEP 6144:DgdakYVDzEzaBXdIctm7KOMsfcjaS6uAOpEY3ZwIkP0v9YzBKmbtQ9:D+a7NzEz6XdIc43XujEgcQG4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\33A5.exe
- Size 363KB
- SHA256 5e924125ff6aeb76684f4fb7f578c6d9278b243ed18e9a9eff8b2b28045ec5a5
- MD5 ad170ecbf3579649162c3cb67d398672
- SHA1 838306ef60ae4286030be9b395c866abd0c8ff47
- SHA512 83a5511b668f49d4361a4a9dd5c8944c6395504f8f31c3a0ab94a9ea1d75d4b17c72c433c53d73cd9dfbb641c34b2741ef15474bacc7c6728e889511ffafc185
- SSDEEP 6144:DgdakYVDzEzaBXdIctm7KOMsfcjaS6uAOpEY3ZwIkP0v9YzBKmbtQ9:D+a7NzEz6XdIc43XujEgcQG4
- MD5 SHA1 SHA512 SSDEEP