Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
02/11/2022, 23:27
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target file.exe
- Size 323KB
- Sample221102-3fdtwacff6
- SHA256 51a2cbb548155430813ba255fdefea6c96630b0d007e2c3b507c0ab9f032abe7
- MD5 20b3b981f929bf3b5c84b07858aa5c88
- SHA1 76c683de2cf4dec4dfdcce2f403f301945e69648
- SHA512 409b0c4076fb56f01d668d9e8e420f595b599c6d91d4971e47e694c0918559eadf2a41d27bb37dd7d35fbef7ee9a768ff3d37edd2e9811f42f22b5c85982ef1c
- SSDEEP 3072:0O/GrLBf/IwWS5XyNOb/6a/he8th7JsvzbhPDdaSZ1NZVggjcGkNIVqILr:T/+LBI7P4bCMz7mzFAQb7ITsq
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/748-133-0x0000000002E90000-0x0000000002E99000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
pid Process 1628 5D81.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1628 set thread context of 4760 1628 5D81.exe 88 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
pid pid_target Process procid_target 4276 4760 WerFault.exe 88 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe - Checks processor information in registry 2 TTPs 52 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data 5D81.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 5D81.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision 5D81.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 5D81.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status 5D81.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information 5D81.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status 5D81.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information 5D81.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 5D81.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier 5D81.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz 5D81.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 5D81.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor 5D81.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor 5D81.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 5D81.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet 5D81.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data 5D81.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString 5D81.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 5D81.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier 5D81.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 5D81.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 5D81.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision 5D81.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision 5D81.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet 5D81.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 5D81.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 5D81.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 748 file.exe 748 file.exe 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found 3068 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3068 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 748 file.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeShutdownPrivilege 3068 Process not Found Token: SeCreatePagefilePrivilege 3068 Process not Found Token: SeShutdownPrivilege 3068 Process not Found Token: SeCreatePagefilePrivilege 3068 Process not Found Token: SeShutdownPrivilege 3068 Process not Found Token: SeCreatePagefilePrivilege 3068 Process not Found Token: SeShutdownPrivilege 3068 Process not Found Token: SeCreatePagefilePrivilege 3068 Process not Found Token: SeShutdownPrivilege 3068 Process not Found Token: SeCreatePagefilePrivilege 3068 Process not Found - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4760 rundll32.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3068 wrote to memory of 1628 3068 Process not Found 87 PID 3068 wrote to memory of 1628 3068 Process not Found 87 PID 3068 wrote to memory of 1628 3068 Process not Found 87 PID 1628 wrote to memory of 4760 1628 5D81.exe 88 PID 1628 wrote to memory of 4760 1628 5D81.exe 88 PID 1628 wrote to memory of 4760 1628 5D81.exe 88 PID 1628 wrote to memory of 4760 1628 5D81.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:748
-
C:\Users\Admin\AppData\Local\Temp\5D81.exeC:\Users\Admin\AppData\Local\Temp\5D81.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
PID:4760 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 14883⤵
- Program crash
PID:4276
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4760 -ip 47601⤵PID:4888
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\185a0208-d15a-42cc-a6bd-26fded261d7b.tmp
- Size 22KB
- SHA256 d6f11c606729d553e9c9b3d0db9e5d51567ea969bedd98008cce7b9415a17490
- MD5 99e972f6d63ded5a9f3d6a06ff481bec
- SHA1 b3c98ed6975c649454bce3d88806ad1883e22327
- SHA512 ecc322a906b25ea835fdfcb528fb0bc11ade80112b9d0783f0c02100a83368b718c45ca5bdbe38c106e3559db7723dc2fdf38e2bf473fb461ddade999d02f416
- SSDEEP 384:kP4jVvuNEsXSOS7H02hXspXoIEoUClPgZXhYmosVgSeZfB8/:Q42Eh97HbchoItUOEYsORBc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\53e6a9ff-6628-4c05-9f9e-5740d15f61de.tmp
- Size 19KB
- SHA256 bbe5def034f4c1e6c16beb775ecbbbbe5e6f1aa8100639e87997c9f656a002c6
- MD5 613b4d43b64a6d9630f389c4e12295b4
- SHA1 06bef00ff378997f9b05d77c78563e01fb713e2d
- SHA512 3d48d3dbd49750d6154a3ecde4f60b7ba0cdfbf4781357971102222707ff9a6ee34f5cdbbb64111e3b43bf3946c1fdfb5024d1bcf710e13a850b257c61e5a365
- SSDEEP 384:1gn7hj+vatvlNs3i0FoZijglZ0Sz7e9xyUVQRXCklWHG3uPTO10P6zqEBp4z2jiC:1gUatvlNs3i0FoZijglZ0Sz7e9xyUVQz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\5D81.exe
- Size 4.9MB
- SHA256 ee567b386a184d75e4e4233dc50e5d19899ed3361c2e3f72afab0a7de22334ec
- MD5 05cf95862ffe818a9d0b45d81d2297dd
- SHA1 5ba689323e7bb8e581fe192a39168fdb074bcbdd
- SHA512 a60b777ec26078a0e1b88cb1377113bd0d6e0e198ca3ae28ba5b4c8435465f21a29decdeb1421d7ed27bdba2f0e1065f6ea0ad0d8544ebb61d95f3f4757bd940
- SSDEEP 98304:Ioi7dk1NB9czYu1Q31Yy/TH+R1LimTXavzTSq7KydV+Mae6T1xJzt:ZIgN/czZiJ/TH+TL1OeXydV2BhxJzt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\5D81.exe
- Size 4.9MB
- SHA256 ee567b386a184d75e4e4233dc50e5d19899ed3361c2e3f72afab0a7de22334ec
- MD5 05cf95862ffe818a9d0b45d81d2297dd
- SHA1 5ba689323e7bb8e581fe192a39168fdb074bcbdd
- SHA512 a60b777ec26078a0e1b88cb1377113bd0d6e0e198ca3ae28ba5b4c8435465f21a29decdeb1421d7ed27bdba2f0e1065f6ea0ad0d8544ebb61d95f3f4757bd940
- SSDEEP 98304:Ioi7dk1NB9czYu1Q31Yy/TH+R1LimTXavzTSq7KydV+Mae6T1xJzt:ZIgN/czZiJ/TH+TL1OeXydV2BhxJzt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Rpiidpytrto.tmp
- Size 3.5MB
- SHA256 8c67a70fe070595fda6ec977af7da0085d40df299f04cdd5669156752fee3f31
- MD5 c597ca48af580cb2755914474a787ddf
- SHA1 427cdbd19eadb94f1f89b51a7c3647a3ff7d3925
- SHA512 c41ab851b712c484184934b2dab7015d329ec485b454b645411f69a97ef4a46351fe892f86522abf19c08cf1b7b6a5212954053b8218046cdfab24ef734e47ab
- SSDEEP 98304:+8pOYyhtcnyr8HijecRnl+SjK+hN8B8NWdMJHfNEGp:+8pxyhi8K4emltTClKJHFvp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\XZIOFAVD-20220812-1951.log
- Size 56KB
- SHA256 2290c5fc19f04b088974b297c2677e0e848900c9188382d3b24611a02685ae03
- MD5 d431794afa91c4c3745055b53d795183
- SHA1 ca518aa0948e9e8af5ec5a89bc613d7e4fc6c9d5
- SHA512 1ae72c1da9b766b3bea44aa3244ab028f7ed8c6e715b284ca111f6f22d3300dbc54a89639f3af0b0371c62c7cab81d4b8b76d807e9738f9d5aa4b329f25fdd64
- SSDEEP 1536:9MQ4Qs8Y7nwyQ+QWmQ4Q5QxQZQoiQTQg+QIQLaQZQZZ9NADQiBQy0VSeQiQLQAQY:9xiwKjKZ9NAhf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\b702d486-654d-4716-aaa2-bc53c138b0f8.tmp
- Size 84KB
- SHA256 1f7a721b714f57504dab936b57f2d5dc7a0b5c1452eebbd44360705e2a636efa
- MD5 5d35b8c0588457da1f0ab69f754dc768
- SHA1 7f23363c2bf180c2300fd27a50d264b713c89c6c
- SHA512 2b0fd2ddd99d5ff7c3ed4df844ecace96b36c5903ea7d996b9d01cf433d012263e8c7f5dde8db4a9f67c49e1535d7a34c02eb295d637fb4809970a4c511a51c1
- SSDEEP 1536:Hm9nctpa+opbvxf8aQhQFDBFmFNyKS+eX3HWx/tdNzENMo3UzV87j:G9nTVQhsdoG3+w3atnwG6+Gj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI6492.txt
- Size 11KB
- SHA256 0cf9936341117c121cc50582950760d7b24f1117749b451d82a45202f5aad461
- MD5 3deb951d119c378dff3d7911fa48dd12
- SHA1 b74cbbddb4b37d46456da7a3e86260a3d8144e17
- SHA512 d9fc285be218af35e81d17b6bd78644d9bad8995cbfc466a0a671f171012f5ff760863e359ea49c9329c951a2280fa5b8e08e72c431e2c961e9fbc65bba7ce80
- SSDEEP 192:UMsnX16poYXBnpnDznpnLMjqGWK6nbnmJ2Z8/h4w8EX77:UMsnX16poYXBpvpLMjqGWK6bnyeEP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\wct8A4A.tmp
- Size 62KB
- SHA256 094754a618b102b7ad0800dd4c9c02c882cf2d1e7996ba864f422fa4312427e1
- MD5 7185e716980842db27c3b3a88e1fe804
- SHA1 e4615379cd4797629b4cc3da157f4d4a5412fb2b
- SHA512 dea331907f5f1de407ca07e24be7ad808fa43a0eef2d1b5009721f937ab2a8f77832e332d5ac3d9662e5b02ecaabbec0f4228af279fa6562be4dccb6c829246c
- SSDEEP 384:poaSLZTSy3x02SMU9mCzmT2zu/649Pji7iJI5TZCP56vS1xDR+dfUFv8WTT:WIyWcU9mCzmKu/JV2iP56vcDR+p0T
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\wctA999.tmp
- Size 62KB
- SHA256 094754a618b102b7ad0800dd4c9c02c882cf2d1e7996ba864f422fa4312427e1
- MD5 7185e716980842db27c3b3a88e1fe804
- SHA1 e4615379cd4797629b4cc3da157f4d4a5412fb2b
- SHA512 dea331907f5f1de407ca07e24be7ad808fa43a0eef2d1b5009721f937ab2a8f77832e332d5ac3d9662e5b02ecaabbec0f4228af279fa6562be4dccb6c829246c
- SSDEEP 384:poaSLZTSy3x02SMU9mCzmT2zu/649Pji7iJI5TZCP56vS1xDR+dfUFv8WTT:WIyWcU9mCzmKu/JV2iP56vcDR+p0T
- MD5 SHA1 SHA512 SSDEEP