Analysis
- max time kernel
157s - max time network
159s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
12/10/2022, 16:17
General
- Target bfab8adba629a6f9c414e8ecb562766b.exe
- Size 294KB
- Sample221012-trcxaabagm
- SHA256 ca1230de5c5b8eddbe33c021a2a3537730962b7aae5d8622ce4d0a53dd98ba30
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Executes dropped EXE 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 20 IoCs
- Suspicious use of WriteProcessMemory 33 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfab8adba629a6f9c414e8ecb562766b.exe"C:\Users\Admin\AppData\Local\Temp\bfab8adba629a6f9c414e8ecb562766b.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Users\Admin\AppData\Roaming\gawtitrC:\Users\Admin\AppData\Roaming\gawtitr1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
gawtitr
gawtitr
memory/620-166-0x00000000008F0000-0x00000000008F6000-memory.dmp
memory/620-147-0x00000000008E0000-0x00000000008EC000-memory.dmp
memory/620-146-0x00000000008F0000-0x00000000008F6000-memory.dmp
memory/1328-165-0x0000000000570000-0x0000000000575000-memory.dmp
memory/1328-143-0x0000000000570000-0x0000000000575000-memory.dmp
memory/1328-144-0x0000000000560000-0x0000000000569000-memory.dmp
memory/1528-140-0x00000000009D0000-0x00000000009D9000-memory.dmp
memory/1528-141-0x00000000009C0000-0x00000000009CF000-memory.dmp
memory/1528-164-0x00000000009D0000-0x00000000009D9000-memory.dmp
memory/1556-170-0x0000000000BE0000-0x0000000000BE7000-memory.dmp
memory/1556-159-0x0000000000BD0000-0x0000000000BDD000-memory.dmp
memory/1556-158-0x0000000000BE0000-0x0000000000BE7000-memory.dmp
memory/1600-135-0x0000000000400000-0x000000000044E000-memory.dmp
memory/1600-132-0x000000000072E000-0x000000000073E000-memory.dmp
memory/1600-134-0x0000000000400000-0x000000000044E000-memory.dmp
memory/1600-133-0x00000000006A0000-0x00000000006A9000-memory.dmp
memory/2816-149-0x0000000000F50000-0x0000000000F72000-memory.dmp
memory/2816-167-0x0000000000F50000-0x0000000000F72000-memory.dmp
memory/2816-150-0x0000000000F20000-0x0000000000F47000-memory.dmp
memory/2968-169-0x0000000000820000-0x0000000000826000-memory.dmp
memory/2968-156-0x0000000000810000-0x000000000081B000-memory.dmp
memory/2968-155-0x0000000000820000-0x0000000000826000-memory.dmp
memory/3240-153-0x0000000000D90000-0x0000000000D95000-memory.dmp
memory/3240-154-0x0000000000D80000-0x0000000000D89000-memory.dmp
memory/3240-168-0x0000000000D90000-0x0000000000D95000-memory.dmp
memory/3796-176-0x0000000000400000-0x000000000044E000-memory.dmp
memory/3796-175-0x0000000000400000-0x000000000044E000-memory.dmp
memory/3796-174-0x00000000006EE000-0x00000000006FF000-memory.dmp
memory/3836-163-0x0000000000D90000-0x0000000000D97000-memory.dmp
memory/3836-138-0x0000000000D80000-0x0000000000D8B000-memory.dmp
memory/3836-137-0x0000000000D90000-0x0000000000D97000-memory.dmp
memory/4568-171-0x0000000000D40000-0x0000000000D48000-memory.dmp
memory/4568-162-0x0000000000D30000-0x0000000000D3B000-memory.dmp
memory/4568-161-0x0000000000D40000-0x0000000000D48000-memory.dmp