Analysis
-
max time kernel
153s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
06/11/2022, 17:05
General
-
Target
c2d0e05fe40602957d0747f04c82abcb.exe
-
Size
286KB
-
MD5
c2d0e05fe40602957d0747f04c82abcb
-
SHA1
592d5bbd221938923a428532b854024044fbdf80
-
SHA256
6bc4e35ec25a914da558ec5057d0dde538e373411f137a5b15adca79200123b9
-
SHA512
b7bbcb8fa777dd4f832ae677b2c27fd61dc658b70c77d79168b81cfeea6ee4b1863d8f6a13c4dc500e70d23f198af12f6b64c6470439a7da2d7a29ea16f4d58d
-
SSDEEP
3072:0upJiecMVhA5LH6N9e8Y43cMCARrmT+l6gR:HiOzaa1Y/Gag
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2d0e05fe40602957d0747f04c82abcb.exe"C:\Users\Admin\AppData\Local\Temp\c2d0e05fe40602957d0747f04c82abcb.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\DA62.exeC:\Users\Admin\AppData\Local\Temp\DA62.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 18962⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4504 -ip 45041⤵
-
C:\Users\Admin\AppData\Local\Temp\DACC.exeC:\Users\Admin\AppData\Local\Temp\DACC.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
423KB
MD58473ad65e5580831f2b5bbc525df5997
SHA19e24ee00192421942066331fd95237533fc92606
SHA25673c25d7f17e31311b538cf935f2537c364b9f59195ba3f649f2cc92355995c02
SHA512ed770b885df72af54adcbbc2e3453214b7d9b378edbd1e80f3771f17c5e7f35a0e780cb7ff277240a4e59a2aba38a087e975b846b05303d404e54182e2cd389b
-
Filesize
423KB
MD58473ad65e5580831f2b5bbc525df5997
SHA19e24ee00192421942066331fd95237533fc92606
SHA25673c25d7f17e31311b538cf935f2537c364b9f59195ba3f649f2cc92355995c02
SHA512ed770b885df72af54adcbbc2e3453214b7d9b378edbd1e80f3771f17c5e7f35a0e780cb7ff277240a4e59a2aba38a087e975b846b05303d404e54182e2cd389b
-
Filesize
246KB
MD590c5b6a8ea281b28fc2ce880f09ea9c0
SHA1cab413b6c77b64eaf71b9fad566cc1be4606794f
SHA2567772483da80c14d62008b1f08517d7a61dbf477b895e7cb7c54edaf98b77a862
SHA512ebf3f1cdc1ea9bce41544a4e8cfbce5f55adb09a8de8ab7fdbb3140efc542ef02063b2a639e793506cb9e8abee72a41ae6b3e32ce1d45e326780f558f85dac79
-
Filesize
246KB
MD590c5b6a8ea281b28fc2ce880f09ea9c0
SHA1cab413b6c77b64eaf71b9fad566cc1be4606794f
SHA2567772483da80c14d62008b1f08517d7a61dbf477b895e7cb7c54edaf98b77a862
SHA512ebf3f1cdc1ea9bce41544a4e8cfbce5f55adb09a8de8ab7fdbb3140efc542ef02063b2a639e793506cb9e8abee72a41ae6b3e32ce1d45e326780f558f85dac79
-
Filesize
84KB
-
Filesize
36KB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
240KB
-
Filesize
320KB
-
Filesize
6.1MB
-
Filesize
72KB
-
Filesize
1.0MB
-
Filesize
356KB
-
Filesize
220KB
-
Filesize
408KB
-
Filesize
584KB
-
Filesize
40.3MB
-
Filesize
472KB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
120KB
-
Filesize
220KB
-
Filesize
40.3MB
-
Filesize
220KB
-
Filesize
5.6MB