Analysis
- max time kernel
150s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
11/11/2022, 01:55
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target file.exe
- Size 372KB
- Sample221111-cb476aabeq
- SHA256 365fe788aa3f4589a3cf5a5ffddf37d93baf301b2d953c804ad03164d21d41dd
- MD5 251096a423566f68e9c55091cfb2aeed
- SHA1 cc6b77f45f1042d8d5d42d080a72710377d3315e
- SHA512 a18607e96151d49c388567585bcab3b3647cb164c637237efc595119f0c8de45fef406ee57ce8befa36a2c9b2a5469b08a8f3b179209063ac89390e0839f3489
- SSDEEP 3072:n+XXZ/bnuRojyL7+sXHJD5RRErQ0NeAxt+Jd878pgo9OjXtKvPfH/oHulMftq/4E:GXRn2/LDXHJDweAxt3Iao9IEXwOu1ql
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/3140-133-0x00000000009A0000-0x00000000009A9000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
pid Process 1740 D362.exe - Program crash 1 IoCs
pid pid_target Process procid_target 3636 1740 WerFault.exe 86 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3140 file.exe 3140 file.exe 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2596 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3140 file.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 2596 Process not Found Token: SeCreatePagefilePrivilege 2596 Process not Found - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2596 wrote to memory of 1740 2596 Process not Found 86 PID 2596 wrote to memory of 1740 2596 Process not Found 86 PID 2596 wrote to memory of 1740 2596 Process not Found 86 PID 1740 wrote to memory of 3852 1740 D362.exe 89 PID 1740 wrote to memory of 3852 1740 D362.exe 89 PID 1740 wrote to memory of 3852 1740 D362.exe 89 PID 1740 wrote to memory of 3852 1740 D362.exe 89 PID 1740 wrote to memory of 3852 1740 D362.exe 89 PID 1740 wrote to memory of 3852 1740 D362.exe 89 PID 1740 wrote to memory of 3852 1740 D362.exe 89 PID 1740 wrote to memory of 3852 1740 D362.exe 89 PID 1740 wrote to memory of 3852 1740 D362.exe 89 PID 1740 wrote to memory of 3852 1740 D362.exe 89 PID 1740 wrote to memory of 3852 1740 D362.exe 89 PID 1740 wrote to memory of 3852 1740 D362.exe 89 PID 1740 wrote to memory of 3852 1740 D362.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3140
-
C:\Users\Admin\AppData\Local\Temp\D362.exeC:\Users\Admin\AppData\Local\Temp\D362.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵PID:3852
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 6082⤵
- Program crash
PID:3636
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1740 -ip 17401⤵PID:3652
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\D362.exe
- Size 1.4MB
- SHA256 4e94b98199ecb75a5643e717eb06e53fbe3cd3abe53604b9f1adf5ee2c177f72
- MD5 13b0d36e56230ed17b5fea02bf8c870b
- SHA1 77930494d59caa1418692cd147617e16ec6e4681
- SHA512 e33475b3ade362c0ba4630b1219d92a34d8352ba5cb1a5d23768cb90bb3412bd05012c1e2d9357c2844d322102230c7cca1d6a641c12d6a3597b19516318e156
- SSDEEP 24576:6Muo9JRITrQUfDaQpovNQKUzruS4WB3z3Vk1qXNX9NEH1kgl:6ItCrQULbpcaXkKz3u1qXRHEHt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\D362.exe
- Size 1.4MB
- SHA256 4e94b98199ecb75a5643e717eb06e53fbe3cd3abe53604b9f1adf5ee2c177f72
- MD5 13b0d36e56230ed17b5fea02bf8c870b
- SHA1 77930494d59caa1418692cd147617e16ec6e4681
- SHA512 e33475b3ade362c0ba4630b1219d92a34d8352ba5cb1a5d23768cb90bb3412bd05012c1e2d9357c2844d322102230c7cca1d6a641c12d6a3597b19516318e156
- SSDEEP 24576:6Muo9JRITrQUfDaQpovNQKUzruS4WB3z3Vk1qXNX9NEH1kgl:6ItCrQULbpcaXkKz3u1qXRHEHt
- MD5 SHA1 SHA512 SSDEEP