Analysis
-
max time kernel
187s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 10:33
Static task
static1
Behavioral task
behavioral1
Sample
40dd71b109c1865a7e7bc32b73e796cce054c89871e36d99794400671a129aad.exe
Resource
win10v2004-20221111-en
General
-
Target
40dd71b109c1865a7e7bc32b73e796cce054c89871e36d99794400671a129aad.exe
-
Size
186KB
-
MD5
b1d0c0ce06d00c6247035af97ae95a79
-
SHA1
329942a0a839e8f03f8a814096882b6bcb3ac5ac
-
SHA256
40dd71b109c1865a7e7bc32b73e796cce054c89871e36d99794400671a129aad
-
SHA512
d5617a00f94c8c1908b4524f0636ec6413dbf3ee4f2ccdcc1b501343874f845392dd9ad90360cbaaea6f23f536abaf92f228033bc661ebc251f7c116953b4b39
-
SSDEEP
3072:Nqlo8DnTQYL76ZIWUaO5j+NZtCs9dY+0u+JVRyQUJ:MlrTZL76ZIX6h93NZ3
Malware Config
Signatures
-
Detects Smokeloader packer 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2860-133-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/1572-135-0x0000000002390000-0x0000000002399000-memory.dmp family_smokeloader behavioral1/memory/2860-136-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/2860-137-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
40dd71b109c1865a7e7bc32b73e796cce054c89871e36d99794400671a129aad.exedescription pid process target process PID 1572 set thread context of 2860 1572 40dd71b109c1865a7e7bc32b73e796cce054c89871e36d99794400671a129aad.exe 40dd71b109c1865a7e7bc32b73e796cce054c89871e36d99794400671a129aad.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
40dd71b109c1865a7e7bc32b73e796cce054c89871e36d99794400671a129aad.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 40dd71b109c1865a7e7bc32b73e796cce054c89871e36d99794400671a129aad.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 40dd71b109c1865a7e7bc32b73e796cce054c89871e36d99794400671a129aad.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 40dd71b109c1865a7e7bc32b73e796cce054c89871e36d99794400671a129aad.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
40dd71b109c1865a7e7bc32b73e796cce054c89871e36d99794400671a129aad.exepid process 2860 40dd71b109c1865a7e7bc32b73e796cce054c89871e36d99794400671a129aad.exe 2860 40dd71b109c1865a7e7bc32b73e796cce054c89871e36d99794400671a129aad.exe 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2716 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
40dd71b109c1865a7e7bc32b73e796cce054c89871e36d99794400671a129aad.exepid process 2860 40dd71b109c1865a7e7bc32b73e796cce054c89871e36d99794400671a129aad.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
40dd71b109c1865a7e7bc32b73e796cce054c89871e36d99794400671a129aad.exedescription pid process target process PID 1572 wrote to memory of 2860 1572 40dd71b109c1865a7e7bc32b73e796cce054c89871e36d99794400671a129aad.exe 40dd71b109c1865a7e7bc32b73e796cce054c89871e36d99794400671a129aad.exe PID 1572 wrote to memory of 2860 1572 40dd71b109c1865a7e7bc32b73e796cce054c89871e36d99794400671a129aad.exe 40dd71b109c1865a7e7bc32b73e796cce054c89871e36d99794400671a129aad.exe PID 1572 wrote to memory of 2860 1572 40dd71b109c1865a7e7bc32b73e796cce054c89871e36d99794400671a129aad.exe 40dd71b109c1865a7e7bc32b73e796cce054c89871e36d99794400671a129aad.exe PID 1572 wrote to memory of 2860 1572 40dd71b109c1865a7e7bc32b73e796cce054c89871e36d99794400671a129aad.exe 40dd71b109c1865a7e7bc32b73e796cce054c89871e36d99794400671a129aad.exe PID 1572 wrote to memory of 2860 1572 40dd71b109c1865a7e7bc32b73e796cce054c89871e36d99794400671a129aad.exe 40dd71b109c1865a7e7bc32b73e796cce054c89871e36d99794400671a129aad.exe PID 1572 wrote to memory of 2860 1572 40dd71b109c1865a7e7bc32b73e796cce054c89871e36d99794400671a129aad.exe 40dd71b109c1865a7e7bc32b73e796cce054c89871e36d99794400671a129aad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\40dd71b109c1865a7e7bc32b73e796cce054c89871e36d99794400671a129aad.exe"C:\Users\Admin\AppData\Local\Temp\40dd71b109c1865a7e7bc32b73e796cce054c89871e36d99794400671a129aad.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\40dd71b109c1865a7e7bc32b73e796cce054c89871e36d99794400671a129aad.exe"C:\Users\Admin\AppData\Local\Temp\40dd71b109c1865a7e7bc32b73e796cce054c89871e36d99794400671a129aad.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1572-134-0x00000000007DE000-0x00000000007EF000-memory.dmpFilesize
68KB
-
memory/1572-135-0x0000000002390000-0x0000000002399000-memory.dmpFilesize
36KB
-
memory/2860-132-0x0000000000000000-mapping.dmp
-
memory/2860-133-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2860-136-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2860-137-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB