Analysis
- max time kernel
167s - max time network
173s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
- submitted
22/11/2022, 09:07
General
- Target 671cd70c310c3a9f25b36067178a3af2.exe
- Size 315KB
- Sample221122-k3a3dsgc86
- SHA256 3f8b187bf2a282a58bf863f10fe7e7d9bf75c4e17db112c7d973139dbfcb0a3f
Malware Config
Signatures
- Detects Smokeloader packer 2 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Executes dropped EXE 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\671cd70c310c3a9f25b36067178a3af2.exe"C:\Users\Admin\AppData\Local\Temp\671cd70c310c3a9f25b36067178a3af2.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\feffrjbC:\Users\Admin\AppData\Roaming\feffrjb1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
feffrjb
feffrjb
memory/2120-132-0x000000000059C000-0x00000000005B2000-memory.dmp
memory/2120-133-0x0000000000570000-0x0000000000579000-memory.dmp
memory/2120-134-0x0000000000400000-0x0000000000454000-memory.dmp
memory/2120-135-0x000000000059C000-0x00000000005B2000-memory.dmp
memory/2120-136-0x0000000000570000-0x0000000000579000-memory.dmp
memory/2120-137-0x0000000000400000-0x0000000000454000-memory.dmp
memory/2572-138-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-139-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-140-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-141-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-142-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-143-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-144-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-145-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-146-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-147-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-148-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-149-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-150-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-151-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-152-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-153-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-154-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-155-0x00000000028E0000-0x00000000028F0000-memory.dmp
memory/2572-156-0x0000000002E90000-0x0000000002EA0000-memory.dmp
memory/2572-157-0x0000000002E90000-0x0000000002EA0000-memory.dmp
memory/2572-158-0x0000000002E90000-0x0000000002EA0000-memory.dmp
memory/2572-159-0x0000000002E90000-0x0000000002EA0000-memory.dmp
memory/2572-160-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-161-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-162-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-163-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-164-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-165-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-166-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-167-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-168-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-169-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-170-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-171-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-172-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-173-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-174-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-175-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-176-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-177-0x00000000023B0000-0x00000000023C0000-memory.dmp
memory/2572-178-0x00000000028F0000-0x0000000002900000-memory.dmp
memory/2572-179-0x00000000028F0000-0x0000000002900000-memory.dmp
memory/2572-180-0x00000000023B0000-0x00000000023C0000-memory.dmp
memory/2572-181-0x00000000028F0000-0x0000000002900000-memory.dmp
memory/2572-182-0x00000000028F0000-0x0000000002900000-memory.dmp
memory/2572-183-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-184-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-185-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-186-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-187-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-188-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-189-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-190-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-191-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-192-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-193-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-194-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-195-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-196-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-197-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-198-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-199-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2572-200-0x0000000000A80000-0x0000000000A90000-memory.dmp
memory/2572-201-0x0000000000A90000-0x0000000000AA0000-memory.dmp
memory/2572-202-0x0000000000A90000-0x0000000000AA0000-memory.dmp