Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
09/10/2022, 10:18
General
-
Target
3e36c51cb6a259e9ad0e4653ec29a22e885b8de969d5702ec64f1df75b760621.exe
-
Size
268KB
-
MD5
0d556d4346d55126a6d9e5a2c7b47971
-
SHA1
d5ee967bfc358fb8611dd4d3f098a876c8b50c1d
-
SHA256
3e36c51cb6a259e9ad0e4653ec29a22e885b8de969d5702ec64f1df75b760621
-
SHA512
58891754ce0dc7078e438ca175cb1813c1a8ac7e662cf11137dd24f0d03e070211ea55a224747901e3544e7a73df9a72d5bad16241624c42b378157161a05438
-
SSDEEP
3072:WXKt1zH/CfkZAi5eL0+iI8fCo53magj2vCyFjIRvIOX0DuiM/h3qpZa9uD6VdyhX:+m+YAc+iI87maS2vFjIRiyirwVfquSl
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 20 IoCs
-
Suspicious use of AdjustPrivilegeToken 30 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e36c51cb6a259e9ad0e4653ec29a22e885b8de969d5702ec64f1df75b760621.exe"C:\Users\Admin\AppData\Local\Temp\3e36c51cb6a259e9ad0e4653ec29a22e885b8de969d5702ec64f1df75b760621.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\2AF8.exeC:\Users\Admin\AppData\Local\Temp\2AF8.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\321D.exeC:\Users\Admin\AppData\Local\Temp\321D.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3848.exeC:\Users\Admin\AppData\Local\Temp\3848.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Users\Admin\AppData\Roaming\euwjbfeC:\Users\Admin\AppData\Roaming\euwjbfe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
720KB
MD593f7131afac711322ee65741c1a53b0c
SHA1d6b753c0ffc5c5013227c289bdeb8b32d897f97f
SHA2565c36010677019b2afa717ca73c958e336a6f857e6b2036e3fb5fbd5da9553c2c
SHA5124e9405dd3600856144f845fa2ceecf80a00bec3e096f6b13f5fe5edbb32561b335c412f387730f9b92a6bc02ea4a04405f2d36c78dfa496224f5993c0b8010e6
-
Filesize
720KB
MD593f7131afac711322ee65741c1a53b0c
SHA1d6b753c0ffc5c5013227c289bdeb8b32d897f97f
SHA2565c36010677019b2afa717ca73c958e336a6f857e6b2036e3fb5fbd5da9553c2c
SHA5124e9405dd3600856144f845fa2ceecf80a00bec3e096f6b13f5fe5edbb32561b335c412f387730f9b92a6bc02ea4a04405f2d36c78dfa496224f5993c0b8010e6
-
Filesize
783KB
MD524b8bff74481e0adc58c78be3a7235df
SHA16dd8a890031d1b6d50a044083dc3b37329602e48
SHA256caca9c1b017d7168afbd290311741734a1b0bbeb9f339bfc46bf068e68d0b845
SHA512bdc3abd91cca6b94efa47a4816af4b2877b9b5a63185884f026f8bcdb7b06134cd4b84b4c65cb5d7368349de07f0596360029b15fc505a419bf6e70cae13dde4
-
Filesize
783KB
MD524b8bff74481e0adc58c78be3a7235df
SHA16dd8a890031d1b6d50a044083dc3b37329602e48
SHA256caca9c1b017d7168afbd290311741734a1b0bbeb9f339bfc46bf068e68d0b845
SHA512bdc3abd91cca6b94efa47a4816af4b2877b9b5a63185884f026f8bcdb7b06134cd4b84b4c65cb5d7368349de07f0596360029b15fc505a419bf6e70cae13dde4
-
Filesize
720KB
MD5ce73f9e8803583ddad380ed911b405f6
SHA129c26c6355b2788015744172913365642991a800
SHA256b1c4b4ee2303af593e3c79f3f0b2323fc183e17d1524b91366c8d4528edfac54
SHA51242a26f13440a71139f8b6a2fe6901dc8104a79ab217d18a6cf628bea60f3fb7a0641fe291b40cfc381d75efc90a33cab9b17eeea2a99101f0063386b36097ad9
-
Filesize
720KB
MD5ce73f9e8803583ddad380ed911b405f6
SHA129c26c6355b2788015744172913365642991a800
SHA256b1c4b4ee2303af593e3c79f3f0b2323fc183e17d1524b91366c8d4528edfac54
SHA51242a26f13440a71139f8b6a2fe6901dc8104a79ab217d18a6cf628bea60f3fb7a0641fe291b40cfc381d75efc90a33cab9b17eeea2a99101f0063386b36097ad9
-
Filesize
268KB
MD50d556d4346d55126a6d9e5a2c7b47971
SHA1d5ee967bfc358fb8611dd4d3f098a876c8b50c1d
SHA2563e36c51cb6a259e9ad0e4653ec29a22e885b8de969d5702ec64f1df75b760621
SHA51258891754ce0dc7078e438ca175cb1813c1a8ac7e662cf11137dd24f0d03e070211ea55a224747901e3544e7a73df9a72d5bad16241624c42b378157161a05438
-
Filesize
268KB
MD50d556d4346d55126a6d9e5a2c7b47971
SHA1d5ee967bfc358fb8611dd4d3f098a876c8b50c1d
SHA2563e36c51cb6a259e9ad0e4653ec29a22e885b8de969d5702ec64f1df75b760621
SHA51258891754ce0dc7078e438ca175cb1813c1a8ac7e662cf11137dd24f0d03e070211ea55a224747901e3544e7a73df9a72d5bad16241624c42b378157161a05438
-
Filesize
64KB
-
Filesize
36KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
28KB
-
Filesize
52KB
-
Filesize
28KB
-
Filesize
36KB
-
Filesize
60KB
-
Filesize
36KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
20KB
-
Filesize
36KB
-
Filesize
20KB
-
Filesize
284KB
-
Filesize
284KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
48KB
-
Filesize
24KB
-
Filesize
20KB
-
Filesize
20KB
-
Filesize
36KB
-
Filesize
32KB
-
Filesize
44KB
-
Filesize
32KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
156KB
-
Filesize
28KB
-
Filesize
44KB
-
Filesize
28KB