Analysis
- max time kernel
150s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system - submitted
22/11/2022, 09:37
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20221111-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target file.exe
- Size 316KB
- Sample221122-llgdhscc9t
- SHA256 e7d3d06f6affb4914434bcc5610348732ef1e36fc0c00df0c64538e9c424edb7
- MD5 fc07297b72e3b3731d82f1e8f3fe5387
- SHA1 4432ac12529925380f785f986be69d84daf7973c
- SHA512 48e7e74ff2ef66952a57736804cd16e9e1f2edd36d2449e51def68507fa039c42781e5d4c37f6afc01abc4434de672a247ba046ca7dd1d861d8030159f350376
- SSDEEP 6144:gmuPqQvIJuqtIcfeYOOPIgY22tThsIeGjY6YML:UqijqtIuO4G22ZVEpML
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/3404-133-0x00000000005C0000-0x00000000005C9000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Blocklisted process makes network request 2 IoCs
flow pid Process 29 1844 rundll32.exe 31 1844 rundll32.exe - Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
pid Process 2300 3B53.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2300 set thread context of 3712 2300 3B53.exe 91 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 2 IoCs
pid pid_target Process procid_target 1756 3712 WerFault.exe 91 964 2300 WerFault.exe 89 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe - Checks processor information in registry 2 TTPs 48 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor 3B53.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier 3B53.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status 3B53.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 3B53.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision 3B53.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information 3B53.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data 3B53.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 3B53.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 3B53.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision 3B53.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision 3B53.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status 3B53.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor 3B53.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 3B53.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 3B53.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 3B53.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision 3B53.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet 3B53.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 3B53.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz 3B53.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 3B53.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data 3B53.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 3B53.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier rundll32.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3404 file.exe 3404 file.exe 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 652 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3404 file.exe - Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeShutdownPrivilege 652 Process not Found Token: SeCreatePagefilePrivilege 652 Process not Found Token: SeShutdownPrivilege 652 Process not Found Token: SeCreatePagefilePrivilege 652 Process not Found Token: SeShutdownPrivilege 652 Process not Found Token: SeCreatePagefilePrivilege 652 Process not Found Token: SeShutdownPrivilege 652 Process not Found Token: SeCreatePagefilePrivilege 652 Process not Found Token: SeShutdownPrivilege 652 Process not Found Token: SeCreatePagefilePrivilege 652 Process not Found Token: SeShutdownPrivilege 652 Process not Found Token: SeCreatePagefilePrivilege 652 Process not Found Token: SeShutdownPrivilege 652 Process not Found Token: SeCreatePagefilePrivilege 652 Process not Found Token: SeShutdownPrivilege 652 Process not Found Token: SeCreatePagefilePrivilege 652 Process not Found - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3712 rundll32.exe - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 652 wrote to memory of 2300 652 Process not Found 89 PID 652 wrote to memory of 2300 652 Process not Found 89 PID 652 wrote to memory of 2300 652 Process not Found 89 PID 2300 wrote to memory of 1844 2300 3B53.exe 90 PID 2300 wrote to memory of 1844 2300 3B53.exe 90 PID 2300 wrote to memory of 1844 2300 3B53.exe 90 PID 2300 wrote to memory of 1844 2300 3B53.exe 90 PID 2300 wrote to memory of 1844 2300 3B53.exe 90 PID 2300 wrote to memory of 1844 2300 3B53.exe 90 PID 2300 wrote to memory of 1844 2300 3B53.exe 90 PID 2300 wrote to memory of 1844 2300 3B53.exe 90 PID 2300 wrote to memory of 1844 2300 3B53.exe 90 PID 2300 wrote to memory of 3712 2300 3B53.exe 91 PID 2300 wrote to memory of 3712 2300 3B53.exe 91 PID 2300 wrote to memory of 3712 2300 3B53.exe 91 PID 2300 wrote to memory of 3712 2300 3B53.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3404
-
C:\Users\Admin\AppData\Local\Temp\3B53.exeC:\Users\Admin\AppData\Local\Temp\3B53.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Blocklisted process makes network request
PID:1844
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
PID:3712 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3712 -s 14803⤵
- Program crash
PID:1756
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 4722⤵
- Program crash
PID:964
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3712 -ip 37121⤵PID:2984
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2300 -ip 23001⤵PID:2016
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\3B53.exe
- Size 845KB
- SHA256 10a830795423be29eb4be4903c9bae96605303bbc8b87dd8b8482dd22b7d5f5e
- MD5 1f6b583bc23a648e7281f32cbddd1a08
- SHA1 f23bb7733bdb734f8004b1eb8ad257ddcc478e49
- SHA512 0ef00d04ebe88058517c1366c384c65f29c43a21f3880a84f9f51cd80206a8d9e9c34a502e194d0cb771e163b71094acfc61588f443e5e0962a6a5d8f7b7cb8a
- SSDEEP 12288:tBVqQwpmDwIYpCt6gSLX2a3pWSEWW/p/4jluoC8CiQVhoZcAvgNCd22ZVEpML:DVlWkP7/+7S/p/f/LV+ZcEd22ZVgM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\3B53.exe
- Size 845KB
- SHA256 10a830795423be29eb4be4903c9bae96605303bbc8b87dd8b8482dd22b7d5f5e
- MD5 1f6b583bc23a648e7281f32cbddd1a08
- SHA1 f23bb7733bdb734f8004b1eb8ad257ddcc478e49
- SHA512 0ef00d04ebe88058517c1366c384c65f29c43a21f3880a84f9f51cd80206a8d9e9c34a502e194d0cb771e163b71094acfc61588f443e5e0962a6a5d8f7b7cb8a
- SSDEEP 12288:tBVqQwpmDwIYpCt6gSLX2a3pWSEWW/p/4jluoC8CiQVhoZcAvgNCd22ZVEpML:DVlWkP7/+7S/p/f/LV+ZcEd22ZVgM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Iriaiusduwe..tmp
- Size 3.5MB
- SHA256 7b5982b10f78e11bff55c748717eb889923589e7bb8900d4c4930390ac047bdf
- MD5 db3baeb998d079c88c022bb95ca02558
- SHA1 1c6f44ea8cb895ef1e7b00152456c3438036ec0c
- SHA512 be10ffd29debfd05ff4cec6b775d72ecd052e0cd86eff77c46321ca12877db0d8a922080777ac15c1152e157594eeb941a81dce8e2e4f9e686ba9b003cc90ee0
- SSDEEP 49152:MvY0dc/xbj4EUTePOwP12ggnerfkhCtADA1GjYKC5sLBNmN3lfyQOEVec6m:MdWp14COrJeLkWAD9dC5stN8/LeTm
- MD5 SHA1 SHA512 SSDEEP