Analysis
- max time kernel
151s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
07/10/2022, 13:31
Static task
static1
Behavioral task
behavioral1
Sample
271c3596fe8c26abeaea6d108965df20.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
271c3596fe8c26abeaea6d108965df20.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 271c3596fe8c26abeaea6d108965df20.exe
- Size 265KB
- Sample221007-qsc2wscggn
- SHA256 729d914a609b49dfda26f3d1603bcd870da1977e2fc85e837dfab546b8257ee1
- MD5 271c3596fe8c26abeaea6d108965df20
- SHA1 01149e0a9670927d409ed0d34053530f0ce0de63
- SHA512 72a2d166c805b2c4d677ab5e3e7a4fc9c76ec5cf43b00dee537b09d4a95a1a721a8afb461fb97cb842b3bef59b5cf2303e66aca764ec3c038c973e03f1713c1d
- SSDEEP 6144:XHE8Hy0xeS45ot+8nVB7duzbgwu63wVfs:XHHS0sSBZunnX9
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/1888-133-0x00000000005D0000-0x00000000005D9000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 2 IoCs
pid Process 4988 8BB5.exe 3680 8F9E.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 271c3596fe8c26abeaea6d108965df20.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 271c3596fe8c26abeaea6d108965df20.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 271c3596fe8c26abeaea6d108965df20.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1888 271c3596fe8c26abeaea6d108965df20.exe 1888 271c3596fe8c26abeaea6d108965df20.exe 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2560 Process not Found - Suspicious behavior: MapViewOfSection 19 IoCs
pid Process 1888 271c3596fe8c26abeaea6d108965df20.exe 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found - Suspicious use of AdjustPrivilegeToken 20 IoCs
description pid Process Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found Token: SeShutdownPrivilege 2560 Process not Found Token: SeCreatePagefilePrivilege 2560 Process not Found - Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 2560 wrote to memory of 4988 2560 Process not Found 90 PID 2560 wrote to memory of 4988 2560 Process not Found 90 PID 2560 wrote to memory of 4988 2560 Process not Found 90 PID 2560 wrote to memory of 3680 2560 Process not Found 92 PID 2560 wrote to memory of 3680 2560 Process not Found 92 PID 2560 wrote to memory of 3680 2560 Process not Found 92 PID 2560 wrote to memory of 4152 2560 Process not Found 94 PID 2560 wrote to memory of 4152 2560 Process not Found 94 PID 2560 wrote to memory of 4152 2560 Process not Found 94 PID 2560 wrote to memory of 4152 2560 Process not Found 94 PID 2560 wrote to memory of 4052 2560 Process not Found 95 PID 2560 wrote to memory of 4052 2560 Process not Found 95 PID 2560 wrote to memory of 4052 2560 Process not Found 95 PID 2560 wrote to memory of 1496 2560 Process not Found 96 PID 2560 wrote to memory of 1496 2560 Process not Found 96 PID 2560 wrote to memory of 1496 2560 Process not Found 96 PID 2560 wrote to memory of 1496 2560 Process not Found 96 PID 2560 wrote to memory of 396 2560 Process not Found 97 PID 2560 wrote to memory of 396 2560 Process not Found 97 PID 2560 wrote to memory of 396 2560 Process not Found 97 PID 2560 wrote to memory of 4500 2560 Process not Found 98 PID 2560 wrote to memory of 4500 2560 Process not Found 98 PID 2560 wrote to memory of 4500 2560 Process not Found 98 PID 2560 wrote to memory of 4500 2560 Process not Found 98 PID 2560 wrote to memory of 860 2560 Process not Found 99 PID 2560 wrote to memory of 860 2560 Process not Found 99 PID 2560 wrote to memory of 860 2560 Process not Found 99 PID 2560 wrote to memory of 860 2560 Process not Found 99 PID 2560 wrote to memory of 1928 2560 Process not Found 100 PID 2560 wrote to memory of 1928 2560 Process not Found 100 PID 2560 wrote to memory of 1928 2560 Process not Found 100 PID 2560 wrote to memory of 1928 2560 Process not Found 100 PID 2560 wrote to memory of 3128 2560 Process not Found 101 PID 2560 wrote to memory of 3128 2560 Process not Found 101 PID 2560 wrote to memory of 3128 2560 Process not Found 101 PID 2560 wrote to memory of 2904 2560 Process not Found 102 PID 2560 wrote to memory of 2904 2560 Process not Found 102 PID 2560 wrote to memory of 2904 2560 Process not Found 102 PID 2560 wrote to memory of 2904 2560 Process not Found 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\271c3596fe8c26abeaea6d108965df20.exe"C:\Users\Admin\AppData\Local\Temp\271c3596fe8c26abeaea6d108965df20.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1888
-
C:\Users\Admin\AppData\Local\Temp\8BB5.exeC:\Users\Admin\AppData\Local\Temp\8BB5.exe1⤵
- Executes dropped EXE
PID:4988
-
C:\Users\Admin\AppData\Local\Temp\8F9E.exeC:\Users\Admin\AppData\Local\Temp\8F9E.exe1⤵
- Executes dropped EXE
PID:3680
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4152
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4052
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1496
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:396
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4500
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:860
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1928
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3128
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2904
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\8BB5.exe
- Size 363KB
- SHA256 39c4fa10490d1f6e5f909786dee9ab0d8e8eb79bb04a9c541d2209224367ad16
- MD5 e292a6cbeb112872c04796311b52ae30
- SHA1 8ecefecab9231e42429a33256f5db84eff302948
- SHA512 c506b3c796d99f8fb3e70d36596720bd1a6328a653c77769e20cbb358da122e576d72518508f63217e80985eb9abaa79abaa681312e9100445e391828029577e
- SSDEEP 6144:SXdLGEo9jzEzaWuN4stWLqexuoZKfcjU6VAOWEY03RewjGfEgqSYHOeXZdRnSkkg:SNLGrlzEzVuN4sIRVoEY03XjGRoZjkL8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\8BB5.exe
- Size 363KB
- SHA256 39c4fa10490d1f6e5f909786dee9ab0d8e8eb79bb04a9c541d2209224367ad16
- MD5 e292a6cbeb112872c04796311b52ae30
- SHA1 8ecefecab9231e42429a33256f5db84eff302948
- SHA512 c506b3c796d99f8fb3e70d36596720bd1a6328a653c77769e20cbb358da122e576d72518508f63217e80985eb9abaa79abaa681312e9100445e391828029577e
- SSDEEP 6144:SXdLGEo9jzEzaWuN4stWLqexuoZKfcjU6VAOWEY03RewjGfEgqSYHOeXZdRnSkkg:SNLGrlzEzVuN4sIRVoEY03XjGRoZjkL8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\8F9E.exe
- Size 363KB
- SHA256 5e924125ff6aeb76684f4fb7f578c6d9278b243ed18e9a9eff8b2b28045ec5a5
- MD5 ad170ecbf3579649162c3cb67d398672
- SHA1 838306ef60ae4286030be9b395c866abd0c8ff47
- SHA512 83a5511b668f49d4361a4a9dd5c8944c6395504f8f31c3a0ab94a9ea1d75d4b17c72c433c53d73cd9dfbb641c34b2741ef15474bacc7c6728e889511ffafc185
- SSDEEP 6144:DgdakYVDzEzaBXdIctm7KOMsfcjaS6uAOpEY3ZwIkP0v9YzBKmbtQ9:D+a7NzEz6XdIc43XujEgcQG4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\8F9E.exe
- Size 363KB
- SHA256 5e924125ff6aeb76684f4fb7f578c6d9278b243ed18e9a9eff8b2b28045ec5a5
- MD5 ad170ecbf3579649162c3cb67d398672
- SHA1 838306ef60ae4286030be9b395c866abd0c8ff47
- SHA512 83a5511b668f49d4361a4a9dd5c8944c6395504f8f31c3a0ab94a9ea1d75d4b17c72c433c53d73cd9dfbb641c34b2741ef15474bacc7c6728e889511ffafc185
- SSDEEP 6144:DgdakYVDzEzaBXdIctm7KOMsfcjaS6uAOpEY3ZwIkP0v9YzBKmbtQ9:D+a7NzEz6XdIc43XujEgcQG4
- MD5 SHA1 SHA512 SSDEEP