Analysis
-
max time kernel
163s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 13:28
Static task
static1
Behavioral task
behavioral1
Sample
8e2e38bec6f01059884e471550d4fbb7d3fba46c6acd0dd6aa006eea5ceaad86.exe
Resource
win10v2004-20221111-en
General
-
Target
8e2e38bec6f01059884e471550d4fbb7d3fba46c6acd0dd6aa006eea5ceaad86.exe
-
Size
186KB
-
MD5
888dc548217a0fd0cc3c618b7fdeda41
-
SHA1
7af031a4cd00afd5d22722223a175b371c8e506c
-
SHA256
8e2e38bec6f01059884e471550d4fbb7d3fba46c6acd0dd6aa006eea5ceaad86
-
SHA512
4bf7f4e9c5edcb1938d5b297ec6c3b016ed422d6ecaacd2ea7ddf907ad303f2fcf8bd987e0122e89e6974980107fac0a545934a9521fc4450ea5b93697aee82b
-
SSDEEP
3072:rehYPAOPyHxLZUiWmOGs5BiVBqgQGdzI8UOyelVE6Lx45p0y:ChlLZUiZ3VBqB5626O5N
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/476-133-0x00000000006C0000-0x00000000006C9000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
cvbibdbpid process 432 cvbibdb -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
cvbibdb8e2e38bec6f01059884e471550d4fbb7d3fba46c6acd0dd6aa006eea5ceaad86.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cvbibdb Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8e2e38bec6f01059884e471550d4fbb7d3fba46c6acd0dd6aa006eea5ceaad86.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8e2e38bec6f01059884e471550d4fbb7d3fba46c6acd0dd6aa006eea5ceaad86.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8e2e38bec6f01059884e471550d4fbb7d3fba46c6acd0dd6aa006eea5ceaad86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cvbibdb Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cvbibdb -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
8e2e38bec6f01059884e471550d4fbb7d3fba46c6acd0dd6aa006eea5ceaad86.exepid process 476 8e2e38bec6f01059884e471550d4fbb7d3fba46c6acd0dd6aa006eea5ceaad86.exe 476 8e2e38bec6f01059884e471550d4fbb7d3fba46c6acd0dd6aa006eea5ceaad86.exe 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 2084 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2084 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
8e2e38bec6f01059884e471550d4fbb7d3fba46c6acd0dd6aa006eea5ceaad86.execvbibdbpid process 476 8e2e38bec6f01059884e471550d4fbb7d3fba46c6acd0dd6aa006eea5ceaad86.exe 432 cvbibdb
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e2e38bec6f01059884e471550d4fbb7d3fba46c6acd0dd6aa006eea5ceaad86.exe"C:\Users\Admin\AppData\Local\Temp\8e2e38bec6f01059884e471550d4fbb7d3fba46c6acd0dd6aa006eea5ceaad86.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:476
-
C:\Users\Admin\AppData\Roaming\cvbibdbC:\Users\Admin\AppData\Roaming\cvbibdb1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:432
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\cvbibdbFilesize
186KB
MD5888dc548217a0fd0cc3c618b7fdeda41
SHA17af031a4cd00afd5d22722223a175b371c8e506c
SHA2568e2e38bec6f01059884e471550d4fbb7d3fba46c6acd0dd6aa006eea5ceaad86
SHA5124bf7f4e9c5edcb1938d5b297ec6c3b016ed422d6ecaacd2ea7ddf907ad303f2fcf8bd987e0122e89e6974980107fac0a545934a9521fc4450ea5b93697aee82b
-
C:\Users\Admin\AppData\Roaming\cvbibdbFilesize
186KB
MD5888dc548217a0fd0cc3c618b7fdeda41
SHA17af031a4cd00afd5d22722223a175b371c8e506c
SHA2568e2e38bec6f01059884e471550d4fbb7d3fba46c6acd0dd6aa006eea5ceaad86
SHA5124bf7f4e9c5edcb1938d5b297ec6c3b016ed422d6ecaacd2ea7ddf907ad303f2fcf8bd987e0122e89e6974980107fac0a545934a9521fc4450ea5b93697aee82b
-
memory/432-138-0x000000000089D000-0x00000000008AD000-memory.dmpFilesize
64KB
-
memory/432-139-0x0000000000400000-0x000000000064C000-memory.dmpFilesize
2.3MB
-
memory/432-140-0x0000000000400000-0x000000000064C000-memory.dmpFilesize
2.3MB
-
memory/476-132-0x000000000092D000-0x000000000093D000-memory.dmpFilesize
64KB
-
memory/476-133-0x00000000006C0000-0x00000000006C9000-memory.dmpFilesize
36KB
-
memory/476-134-0x0000000000400000-0x000000000064C000-memory.dmpFilesize
2.3MB
-
memory/476-135-0x0000000000400000-0x000000000064C000-memory.dmpFilesize
2.3MB