Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
16-10-2022 10:11
Static task
static1
Behavioral task
behavioral1
Sample
99b107bba532359c0d6be725904a1faeef4cafe566eee2dafda2a1e36b7ce025.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
99b107bba532359c0d6be725904a1faeef4cafe566eee2dafda2a1e36b7ce025.exe
-
Size
213KB
-
MD5
a4ed5cddedb5382fbefd94e5ee579598
-
SHA1
3128c82c4708cb4c29ba98d5e4d7a0aef240f412
-
SHA256
99b107bba532359c0d6be725904a1faeef4cafe566eee2dafda2a1e36b7ce025
-
SHA512
ec635f5a352a55956161ca3b42f97c04f325c87862d361bf2809090f1c281407e5f03d1ac642ca2024faa052ad01c81c016bf5107f2913ce7fd01b6d4b09dcd7
-
SSDEEP
3072:2XpSNH/irCLUFQnlk6f5U2MgrUzeehGxBWAvCyt0K5bJTo+G8r:eQH/irCLZ3xMdXAbt0Q/r
Score
10/10
Malware Config
Signatures
-
Detects Smokeloader packer 4 IoCs
resource yara_rule behavioral1/memory/2124-133-0x00000000009D0000-0x00000000009D9000-memory.dmp family_smokeloader behavioral1/memory/512-135-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/512-136-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/512-137-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2124 set thread context of 512 2124 99b107bba532359c0d6be725904a1faeef4cafe566eee2dafda2a1e36b7ce025.exe 83 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 99b107bba532359c0d6be725904a1faeef4cafe566eee2dafda2a1e36b7ce025.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 99b107bba532359c0d6be725904a1faeef4cafe566eee2dafda2a1e36b7ce025.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 99b107bba532359c0d6be725904a1faeef4cafe566eee2dafda2a1e36b7ce025.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 512 99b107bba532359c0d6be725904a1faeef4cafe566eee2dafda2a1e36b7ce025.exe 512 99b107bba532359c0d6be725904a1faeef4cafe566eee2dafda2a1e36b7ce025.exe 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3032 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 512 99b107bba532359c0d6be725904a1faeef4cafe566eee2dafda2a1e36b7ce025.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2124 wrote to memory of 512 2124 99b107bba532359c0d6be725904a1faeef4cafe566eee2dafda2a1e36b7ce025.exe 83 PID 2124 wrote to memory of 512 2124 99b107bba532359c0d6be725904a1faeef4cafe566eee2dafda2a1e36b7ce025.exe 83 PID 2124 wrote to memory of 512 2124 99b107bba532359c0d6be725904a1faeef4cafe566eee2dafda2a1e36b7ce025.exe 83 PID 2124 wrote to memory of 512 2124 99b107bba532359c0d6be725904a1faeef4cafe566eee2dafda2a1e36b7ce025.exe 83 PID 2124 wrote to memory of 512 2124 99b107bba532359c0d6be725904a1faeef4cafe566eee2dafda2a1e36b7ce025.exe 83 PID 2124 wrote to memory of 512 2124 99b107bba532359c0d6be725904a1faeef4cafe566eee2dafda2a1e36b7ce025.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\99b107bba532359c0d6be725904a1faeef4cafe566eee2dafda2a1e36b7ce025.exe"C:\Users\Admin\AppData\Local\Temp\99b107bba532359c0d6be725904a1faeef4cafe566eee2dafda2a1e36b7ce025.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\99b107bba532359c0d6be725904a1faeef4cafe566eee2dafda2a1e36b7ce025.exe"C:\Users\Admin\AppData\Local\Temp\99b107bba532359c0d6be725904a1faeef4cafe566eee2dafda2a1e36b7ce025.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:512
-