Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
- submitted
22/11/2022, 14:12
General
- Target file.exe
- Size 303KB
- Sample221122-rhtsbsae2y
- SHA256 894a882987a059912caf2f050e78c3cf2a470b7f3c2a4a8a0af9e9c4b66fd080
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1044-132-0x000000000076C000-0x0000000000781000-memory.dmp
memory/1044-133-0x00000000006B0000-0x00000000006B9000-memory.dmp
memory/1044-134-0x0000000000400000-0x0000000000451000-memory.dmp
memory/1044-135-0x0000000000400000-0x0000000000451000-memory.dmp
memory/2644-136-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-137-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-138-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-139-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-140-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-141-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-142-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-143-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-144-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-145-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-146-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-147-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-148-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-149-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-150-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-151-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-152-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-153-0x00000000030D0000-0x00000000030E0000-memory.dmp
memory/2644-154-0x00000000030F0000-0x0000000003100000-memory.dmp
memory/2644-155-0x00000000030F0000-0x0000000003100000-memory.dmp
memory/2644-156-0x00000000030F0000-0x0000000003100000-memory.dmp
memory/2644-157-0x00000000030F0000-0x0000000003100000-memory.dmp
memory/2644-158-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-159-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-160-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-161-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-162-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-163-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-164-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-165-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-166-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-167-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-168-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-169-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-170-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-171-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-172-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-173-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-174-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-175-0x0000000001310000-0x0000000001320000-memory.dmp
memory/2644-176-0x0000000001300000-0x0000000001310000-memory.dmp
memory/2644-177-0x0000000001320000-0x0000000001330000-memory.dmp
memory/2644-178-0x0000000001310000-0x0000000001320000-memory.dmp
memory/2644-179-0x0000000001300000-0x0000000001310000-memory.dmp
memory/2644-180-0x0000000001320000-0x0000000001330000-memory.dmp
memory/2644-181-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-182-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-183-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-184-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-185-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-186-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-187-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-188-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-189-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-190-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-191-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-192-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-194-0x00000000012D0000-0x00000000012E0000-memory.dmp
memory/2644-193-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-195-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-196-0x0000000001300000-0x0000000001310000-memory.dmp
memory/2644-197-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-198-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-199-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-200-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-201-0x0000000001300000-0x0000000001310000-memory.dmp
memory/2644-202-0x00000000030C0000-0x00000000030D0000-memory.dmp