Analysis
-
max time kernel
176s -
max time network
184s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 08:03
Static task
static1
Behavioral task
behavioral1
Sample
351b342b3cfc481a15e8b12039cc3330cab35c4f0a8545aee24c24ce33b20bc3.exe
Resource
win10v2004-20221111-en
General
-
Target
351b342b3cfc481a15e8b12039cc3330cab35c4f0a8545aee24c24ce33b20bc3.exe
-
Size
188KB
-
MD5
b591c5aa36bedb9a2a45970b4b0276c3
-
SHA1
96a13be47f590abd220dd9b4e5cf52a3fa24486e
-
SHA256
351b342b3cfc481a15e8b12039cc3330cab35c4f0a8545aee24c24ce33b20bc3
-
SHA512
ff0baee6975e99395fdac68968d897d7f73d44ffc36f2cace75e314449b4c8498d83b8853b185f2747a36f1374468549114702d0621b081d44d044f2966fe594
-
SSDEEP
3072:IyriBnkx6IDBCeLwTCuZUpZ+5n8gyZE+SYr/EnVycAZGIbQrrJx0:liYweLw+uZ0iyDsu+Q
Malware Config
Signatures
-
Detects Smokeloader packer 4 IoCs
Processes:
resource yara_rule behavioral1/memory/4592-133-0x00000000008E0000-0x00000000008E9000-memory.dmp family_smokeloader behavioral1/memory/892-135-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/892-138-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/892-139-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
351b342b3cfc481a15e8b12039cc3330cab35c4f0a8545aee24c24ce33b20bc3.exedescription pid process target process PID 4592 set thread context of 892 4592 351b342b3cfc481a15e8b12039cc3330cab35c4f0a8545aee24c24ce33b20bc3.exe 351b342b3cfc481a15e8b12039cc3330cab35c4f0a8545aee24c24ce33b20bc3.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
351b342b3cfc481a15e8b12039cc3330cab35c4f0a8545aee24c24ce33b20bc3.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 351b342b3cfc481a15e8b12039cc3330cab35c4f0a8545aee24c24ce33b20bc3.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 351b342b3cfc481a15e8b12039cc3330cab35c4f0a8545aee24c24ce33b20bc3.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 351b342b3cfc481a15e8b12039cc3330cab35c4f0a8545aee24c24ce33b20bc3.exe -
Modifies registry class 2 IoCs
Processes:
description ioc process Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
351b342b3cfc481a15e8b12039cc3330cab35c4f0a8545aee24c24ce33b20bc3.exepid process 892 351b342b3cfc481a15e8b12039cc3330cab35c4f0a8545aee24c24ce33b20bc3.exe 892 351b342b3cfc481a15e8b12039cc3330cab35c4f0a8545aee24c24ce33b20bc3.exe 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 2704 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2704 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
351b342b3cfc481a15e8b12039cc3330cab35c4f0a8545aee24c24ce33b20bc3.exepid process 892 351b342b3cfc481a15e8b12039cc3330cab35c4f0a8545aee24c24ce33b20bc3.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 2704 Token: SeCreatePagefilePrivilege 2704 Token: SeShutdownPrivilege 2704 Token: SeCreatePagefilePrivilege 2704 Token: SeShutdownPrivilege 2704 Token: SeCreatePagefilePrivilege 2704 Token: SeShutdownPrivilege 2704 Token: SeCreatePagefilePrivilege 2704 Token: SeShutdownPrivilege 2704 Token: SeCreatePagefilePrivilege 2704 Token: SeShutdownPrivilege 2704 Token: SeCreatePagefilePrivilege 2704 -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
351b342b3cfc481a15e8b12039cc3330cab35c4f0a8545aee24c24ce33b20bc3.exedescription pid process target process PID 4592 wrote to memory of 892 4592 351b342b3cfc481a15e8b12039cc3330cab35c4f0a8545aee24c24ce33b20bc3.exe 351b342b3cfc481a15e8b12039cc3330cab35c4f0a8545aee24c24ce33b20bc3.exe PID 4592 wrote to memory of 892 4592 351b342b3cfc481a15e8b12039cc3330cab35c4f0a8545aee24c24ce33b20bc3.exe 351b342b3cfc481a15e8b12039cc3330cab35c4f0a8545aee24c24ce33b20bc3.exe PID 4592 wrote to memory of 892 4592 351b342b3cfc481a15e8b12039cc3330cab35c4f0a8545aee24c24ce33b20bc3.exe 351b342b3cfc481a15e8b12039cc3330cab35c4f0a8545aee24c24ce33b20bc3.exe PID 4592 wrote to memory of 892 4592 351b342b3cfc481a15e8b12039cc3330cab35c4f0a8545aee24c24ce33b20bc3.exe 351b342b3cfc481a15e8b12039cc3330cab35c4f0a8545aee24c24ce33b20bc3.exe PID 4592 wrote to memory of 892 4592 351b342b3cfc481a15e8b12039cc3330cab35c4f0a8545aee24c24ce33b20bc3.exe 351b342b3cfc481a15e8b12039cc3330cab35c4f0a8545aee24c24ce33b20bc3.exe PID 4592 wrote to memory of 892 4592 351b342b3cfc481a15e8b12039cc3330cab35c4f0a8545aee24c24ce33b20bc3.exe 351b342b3cfc481a15e8b12039cc3330cab35c4f0a8545aee24c24ce33b20bc3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\351b342b3cfc481a15e8b12039cc3330cab35c4f0a8545aee24c24ce33b20bc3.exe"C:\Users\Admin\AppData\Local\Temp\351b342b3cfc481a15e8b12039cc3330cab35c4f0a8545aee24c24ce33b20bc3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\351b342b3cfc481a15e8b12039cc3330cab35c4f0a8545aee24c24ce33b20bc3.exe"C:\Users\Admin\AppData\Local\Temp\351b342b3cfc481a15e8b12039cc3330cab35c4f0a8545aee24c24ce33b20bc3.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/892-135-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/892-139-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/892-134-0x0000000000000000-mapping.dmp
-
memory/892-138-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2704-144-0x0000000002D00000-0x0000000002D10000-memory.dmpFilesize
64KB
-
memory/2704-145-0x0000000002CF0000-0x0000000002D00000-memory.dmpFilesize
64KB
-
memory/2704-155-0x0000000002D00000-0x0000000002D10000-memory.dmpFilesize
64KB
-
memory/2704-154-0x0000000002D00000-0x0000000002D10000-memory.dmpFilesize
64KB
-
memory/2704-140-0x0000000000BC0000-0x0000000000BD0000-memory.dmpFilesize
64KB
-
memory/2704-141-0x0000000002CF0000-0x0000000002D00000-memory.dmpFilesize
64KB
-
memory/2704-142-0x0000000002D00000-0x0000000002D10000-memory.dmpFilesize
64KB
-
memory/2704-143-0x0000000002D00000-0x0000000002D10000-memory.dmpFilesize
64KB
-
memory/2704-153-0x0000000002CF0000-0x0000000002D00000-memory.dmpFilesize
64KB
-
memory/2704-152-0x0000000002D00000-0x0000000002D10000-memory.dmpFilesize
64KB
-
memory/2704-146-0x0000000002D00000-0x0000000002D10000-memory.dmpFilesize
64KB
-
memory/2704-147-0x0000000002D00000-0x0000000002D10000-memory.dmpFilesize
64KB
-
memory/2704-148-0x0000000002D00000-0x0000000002D10000-memory.dmpFilesize
64KB
-
memory/2704-149-0x0000000000BC0000-0x0000000000BD0000-memory.dmpFilesize
64KB
-
memory/2704-150-0x0000000002CF0000-0x0000000002D00000-memory.dmpFilesize
64KB
-
memory/2704-151-0x0000000002D00000-0x0000000002D10000-memory.dmpFilesize
64KB
-
memory/4592-137-0x000000000099E000-0x00000000009AF000-memory.dmpFilesize
68KB
-
memory/4592-132-0x000000000099E000-0x00000000009AF000-memory.dmpFilesize
68KB
-
memory/4592-133-0x00000000008E0000-0x00000000008E9000-memory.dmpFilesize
36KB
-
memory/4592-136-0x000000000099E000-0x00000000009AF000-memory.dmpFilesize
68KB