Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05-11-2022 15:20
Static task
static1
Behavioral task
behavioral1
Sample
1b0fd55f094821963a477b344116b1710a9e9a8b536321513ede6cf812c442e8.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
20 signatures
150 seconds
General
-
Target
1b0fd55f094821963a477b344116b1710a9e9a8b536321513ede6cf812c442e8.exe
-
Size
285KB
-
MD5
f526de6c51cf1993608007fb74cc7537
-
SHA1
06c3ff1ded6de234e55560540827a8b59ab9cfd6
-
SHA256
1b0fd55f094821963a477b344116b1710a9e9a8b536321513ede6cf812c442e8
-
SHA512
31788a0cfef556a8aa7f7248507a5ba670e1ae36a7b450dd9c3c4562d71d684de06386943509ee7e4a29c97a9623174d331c8bb1e15b5ed52af283297bebe1cb
-
SSDEEP
3072:TqdvxqiTZbrgg67lq65analtS7REPl1wHINMj71DPAsXek3cmBJ05BVZyF4zffBa:ujqQ2MZnuLPM6Mtcxko7VlzE
Score
10/10
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral1/memory/3648-134-0x0000000002440000-0x0000000002449000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Blocklisted process makes network request 2 IoCs
flow pid Process 32 3172 rundll32.exe 34 3172 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 3828 DBDE.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3828 set thread context of 2432 3828 DBDE.exe 89 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 2744 3828 WerFault.exe 87 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1b0fd55f094821963a477b344116b1710a9e9a8b536321513ede6cf812c442e8.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1b0fd55f094821963a477b344116b1710a9e9a8b536321513ede6cf812c442e8.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1b0fd55f094821963a477b344116b1710a9e9a8b536321513ede6cf812c442e8.exe -
Checks processor information in registry 2 TTPs 44 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data DBDE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 DBDE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier DBDE.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision DBDE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor DBDE.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 DBDE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision DBDE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz DBDE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz DBDE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information DBDE.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 DBDE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier DBDE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status DBDE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString DBDE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor DBDE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status DBDE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 DBDE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 DBDE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier DBDE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information DBDE.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Toolbar Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" Process not Found Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Process not Found -
Modifies registry class 19 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 Process not Found Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Process not Found Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Process not Found Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" Process not Found Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Process not Found -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2492 Process not Found -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3648 1b0fd55f094821963a477b344116b1710a9e9a8b536321513ede6cf812c442e8.exe 3648 1b0fd55f094821963a477b344116b1710a9e9a8b536321513ede6cf812c442e8.exe 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2492 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3648 1b0fd55f094821963a477b344116b1710a9e9a8b536321513ede6cf812c442e8.exe -
Suspicious use of AdjustPrivilegeToken 20 IoCs
description pid Process Token: SeShutdownPrivilege 2492 Process not Found Token: SeCreatePagefilePrivilege 2492 Process not Found Token: SeShutdownPrivilege 2492 Process not Found Token: SeCreatePagefilePrivilege 2492 Process not Found Token: SeShutdownPrivilege 2492 Process not Found Token: SeCreatePagefilePrivilege 2492 Process not Found Token: SeShutdownPrivilege 2492 Process not Found Token: SeCreatePagefilePrivilege 2492 Process not Found Token: SeShutdownPrivilege 2492 Process not Found Token: SeCreatePagefilePrivilege 2492 Process not Found Token: SeShutdownPrivilege 2492 Process not Found Token: SeCreatePagefilePrivilege 2492 Process not Found Token: SeShutdownPrivilege 2492 Process not Found Token: SeCreatePagefilePrivilege 2492 Process not Found Token: SeShutdownPrivilege 2492 Process not Found Token: SeCreatePagefilePrivilege 2492 Process not Found Token: SeShutdownPrivilege 2492 Process not Found Token: SeCreatePagefilePrivilege 2492 Process not Found Token: SeShutdownPrivilege 2492 Process not Found Token: SeCreatePagefilePrivilege 2492 Process not Found -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2432 rundll32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2492 Process not Found 2492 Process not Found -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 2492 wrote to memory of 3828 2492 Process not Found 87 PID 2492 wrote to memory of 3828 2492 Process not Found 87 PID 2492 wrote to memory of 3828 2492 Process not Found 87 PID 3828 wrote to memory of 3172 3828 DBDE.exe 88 PID 3828 wrote to memory of 3172 3828 DBDE.exe 88 PID 3828 wrote to memory of 3172 3828 DBDE.exe 88 PID 3828 wrote to memory of 3172 3828 DBDE.exe 88 PID 3828 wrote to memory of 3172 3828 DBDE.exe 88 PID 3828 wrote to memory of 3172 3828 DBDE.exe 88 PID 3828 wrote to memory of 3172 3828 DBDE.exe 88 PID 3828 wrote to memory of 3172 3828 DBDE.exe 88 PID 3828 wrote to memory of 3172 3828 DBDE.exe 88 PID 3828 wrote to memory of 3172 3828 DBDE.exe 88 PID 3828 wrote to memory of 3172 3828 DBDE.exe 88 PID 3828 wrote to memory of 3172 3828 DBDE.exe 88 PID 3828 wrote to memory of 3172 3828 DBDE.exe 88 PID 3828 wrote to memory of 3172 3828 DBDE.exe 88 PID 3828 wrote to memory of 3172 3828 DBDE.exe 88 PID 3828 wrote to memory of 3172 3828 DBDE.exe 88 PID 3828 wrote to memory of 3172 3828 DBDE.exe 88 PID 3828 wrote to memory of 3172 3828 DBDE.exe 88 PID 3828 wrote to memory of 3172 3828 DBDE.exe 88 PID 3828 wrote to memory of 3172 3828 DBDE.exe 88 PID 3828 wrote to memory of 3172 3828 DBDE.exe 88 PID 3828 wrote to memory of 3172 3828 DBDE.exe 88 PID 3828 wrote to memory of 2432 3828 DBDE.exe 89 PID 3828 wrote to memory of 2432 3828 DBDE.exe 89 PID 3828 wrote to memory of 2432 3828 DBDE.exe 89 PID 3828 wrote to memory of 2432 3828 DBDE.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b0fd55f094821963a477b344116b1710a9e9a8b536321513ede6cf812c442e8.exe"C:\Users\Admin\AppData\Local\Temp\1b0fd55f094821963a477b344116b1710a9e9a8b536321513ede6cf812c442e8.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3648
-
C:\Users\Admin\AppData\Local\Temp\DBDE.exeC:\Users\Admin\AppData\Local\Temp\DBDE.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Blocklisted process makes network request
PID:3172
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:2432
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 10402⤵
- Program crash
PID:2744
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3828 -ip 38281⤵PID:1744
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5f8244a0b3f8c2f695ca83fd57b559886
SHA131ca73ee87268a7e6aa7e89f441ce1c42829870d
SHA256edfce5aa7f69d4216ad9214519d0f50e75058fc074722b906d7beedf59ee1281
SHA51290cb17960849a182b328315523e5130d99bee1211a0e1f065f0c566d4626cb6bf33ab03c4b22f4daeaa363815276e69ceff4525d5142bdcdc99a96afca4bd9ea
-
Filesize
1.3MB
MD5f8244a0b3f8c2f695ca83fd57b559886
SHA131ca73ee87268a7e6aa7e89f441ce1c42829870d
SHA256edfce5aa7f69d4216ad9214519d0f50e75058fc074722b906d7beedf59ee1281
SHA51290cb17960849a182b328315523e5130d99bee1211a0e1f065f0c566d4626cb6bf33ab03c4b22f4daeaa363815276e69ceff4525d5142bdcdc99a96afca4bd9ea
-
Filesize
3.5MB
MD5a7d875022bb5e3a34d034b947003d1b3
SHA15905ca93fea101ce80e5bf8925eb2a7eec1e333d
SHA256bcdf4c540c4289f81c98448d0a4482a96522fb767ab6015e76288afce148226a
SHA512f2b78a100cf0fa84909629b892e548d7ef9797621623a96aa75f15241d7350eecca117c3793056c30dc317ade8ecc0023c2b875516d9c25ac9bb0d880bb3149a