Analysis
-
max time kernel
190s -
max time network
200s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 19:34
Static task
static1
Behavioral task
behavioral1
Sample
e6095c66d27cc8ae85a7873aa49659d3f67f44f1134c0041551c8a0ea609bdf1.exe
Resource
win10v2004-20221111-en
General
-
Target
e6095c66d27cc8ae85a7873aa49659d3f67f44f1134c0041551c8a0ea609bdf1.exe
-
Size
188KB
-
MD5
14b6b36943defce777ef30258d5dde27
-
SHA1
eb468c764fa0959cec0368c841d1946aedd20e5a
-
SHA256
e6095c66d27cc8ae85a7873aa49659d3f67f44f1134c0041551c8a0ea609bdf1
-
SHA512
06ffc4f54e3cba0b4a7cf9434536b55bb715b6249877d36012ff22a35675ce6b4ae3b39f6482227fc92bcd76cf91f1015223533b4a9bd18b5125557964c6c8e9
-
SSDEEP
3072:+s2zSBiuPT41QLlXngCol5buiMoKtdK8B6veHJD3B1CrQP+Ep3LkTwCXbA:ozSLlXvAtRKS8Ymp7BK2V3LkTR
Malware Config
Signatures
-
Detects Smokeloader packer 4 IoCs
Processes:
resource yara_rule behavioral1/memory/4092-133-0x00000000006D0000-0x00000000006D9000-memory.dmp family_smokeloader behavioral1/memory/1668-135-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/1668-137-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/1668-138-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
e6095c66d27cc8ae85a7873aa49659d3f67f44f1134c0041551c8a0ea609bdf1.exedescription pid process target process PID 4092 set thread context of 1668 4092 e6095c66d27cc8ae85a7873aa49659d3f67f44f1134c0041551c8a0ea609bdf1.exe e6095c66d27cc8ae85a7873aa49659d3f67f44f1134c0041551c8a0ea609bdf1.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
e6095c66d27cc8ae85a7873aa49659d3f67f44f1134c0041551c8a0ea609bdf1.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e6095c66d27cc8ae85a7873aa49659d3f67f44f1134c0041551c8a0ea609bdf1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e6095c66d27cc8ae85a7873aa49659d3f67f44f1134c0041551c8a0ea609bdf1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e6095c66d27cc8ae85a7873aa49659d3f67f44f1134c0041551c8a0ea609bdf1.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e6095c66d27cc8ae85a7873aa49659d3f67f44f1134c0041551c8a0ea609bdf1.exepid process 1668 e6095c66d27cc8ae85a7873aa49659d3f67f44f1134c0041551c8a0ea609bdf1.exe 1668 e6095c66d27cc8ae85a7873aa49659d3f67f44f1134c0041551c8a0ea609bdf1.exe 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 2644 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2644 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
e6095c66d27cc8ae85a7873aa49659d3f67f44f1134c0041551c8a0ea609bdf1.exepid process 1668 e6095c66d27cc8ae85a7873aa49659d3f67f44f1134c0041551c8a0ea609bdf1.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 2644 Token: SeCreatePagefilePrivilege 2644 Token: SeShutdownPrivilege 2644 Token: SeCreatePagefilePrivilege 2644 Token: SeShutdownPrivilege 2644 Token: SeCreatePagefilePrivilege 2644 Token: SeShutdownPrivilege 2644 Token: SeCreatePagefilePrivilege 2644 -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
e6095c66d27cc8ae85a7873aa49659d3f67f44f1134c0041551c8a0ea609bdf1.exedescription pid process target process PID 4092 wrote to memory of 1668 4092 e6095c66d27cc8ae85a7873aa49659d3f67f44f1134c0041551c8a0ea609bdf1.exe e6095c66d27cc8ae85a7873aa49659d3f67f44f1134c0041551c8a0ea609bdf1.exe PID 4092 wrote to memory of 1668 4092 e6095c66d27cc8ae85a7873aa49659d3f67f44f1134c0041551c8a0ea609bdf1.exe e6095c66d27cc8ae85a7873aa49659d3f67f44f1134c0041551c8a0ea609bdf1.exe PID 4092 wrote to memory of 1668 4092 e6095c66d27cc8ae85a7873aa49659d3f67f44f1134c0041551c8a0ea609bdf1.exe e6095c66d27cc8ae85a7873aa49659d3f67f44f1134c0041551c8a0ea609bdf1.exe PID 4092 wrote to memory of 1668 4092 e6095c66d27cc8ae85a7873aa49659d3f67f44f1134c0041551c8a0ea609bdf1.exe e6095c66d27cc8ae85a7873aa49659d3f67f44f1134c0041551c8a0ea609bdf1.exe PID 4092 wrote to memory of 1668 4092 e6095c66d27cc8ae85a7873aa49659d3f67f44f1134c0041551c8a0ea609bdf1.exe e6095c66d27cc8ae85a7873aa49659d3f67f44f1134c0041551c8a0ea609bdf1.exe PID 4092 wrote to memory of 1668 4092 e6095c66d27cc8ae85a7873aa49659d3f67f44f1134c0041551c8a0ea609bdf1.exe e6095c66d27cc8ae85a7873aa49659d3f67f44f1134c0041551c8a0ea609bdf1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e6095c66d27cc8ae85a7873aa49659d3f67f44f1134c0041551c8a0ea609bdf1.exe"C:\Users\Admin\AppData\Local\Temp\e6095c66d27cc8ae85a7873aa49659d3f67f44f1134c0041551c8a0ea609bdf1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e6095c66d27cc8ae85a7873aa49659d3f67f44f1134c0041551c8a0ea609bdf1.exe"C:\Users\Admin\AppData\Local\Temp\e6095c66d27cc8ae85a7873aa49659d3f67f44f1134c0041551c8a0ea609bdf1.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1668-134-0x0000000000000000-mapping.dmp
-
memory/1668-135-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1668-137-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1668-138-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2644-162-0x00000000030F0000-0x0000000003100000-memory.dmpFilesize
64KB
-
memory/2644-145-0x00000000030D0000-0x00000000030E0000-memory.dmpFilesize
64KB
-
memory/2644-141-0x00000000030D0000-0x00000000030E0000-memory.dmpFilesize
64KB
-
memory/2644-142-0x00000000030D0000-0x00000000030E0000-memory.dmpFilesize
64KB
-
memory/2644-143-0x00000000030D0000-0x00000000030E0000-memory.dmpFilesize
64KB
-
memory/2644-144-0x00000000030D0000-0x00000000030E0000-memory.dmpFilesize
64KB
-
memory/2644-164-0x00000000030D0000-0x00000000030E0000-memory.dmpFilesize
64KB
-
memory/2644-146-0x00000000030D0000-0x00000000030E0000-memory.dmpFilesize
64KB
-
memory/2644-150-0x00000000030D0000-0x00000000030E0000-memory.dmpFilesize
64KB
-
memory/2644-149-0x00000000030D0000-0x00000000030E0000-memory.dmpFilesize
64KB
-
memory/2644-148-0x00000000030D0000-0x00000000030E0000-memory.dmpFilesize
64KB
-
memory/2644-165-0x00000000030D0000-0x00000000030E0000-memory.dmpFilesize
64KB
-
memory/2644-151-0x00000000030D0000-0x00000000030E0000-memory.dmpFilesize
64KB
-
memory/2644-152-0x00000000030D0000-0x00000000030E0000-memory.dmpFilesize
64KB
-
memory/2644-153-0x00000000030D0000-0x00000000030E0000-memory.dmpFilesize
64KB
-
memory/2644-154-0x00000000030D0000-0x00000000030E0000-memory.dmpFilesize
64KB
-
memory/2644-155-0x00000000030D0000-0x00000000030E0000-memory.dmpFilesize
64KB
-
memory/2644-156-0x00000000030C0000-0x00000000030D0000-memory.dmpFilesize
64KB
-
memory/2644-157-0x00000000030F0000-0x0000000003100000-memory.dmpFilesize
64KB
-
memory/2644-158-0x00000000030F0000-0x0000000003100000-memory.dmpFilesize
64KB
-
memory/2644-163-0x00000000030D0000-0x00000000030E0000-memory.dmpFilesize
64KB
-
memory/2644-160-0x00000000030F0000-0x0000000003100000-memory.dmpFilesize
64KB
-
memory/2644-139-0x00000000030D0000-0x00000000030E0000-memory.dmpFilesize
64KB
-
memory/2644-161-0x00000000030F0000-0x0000000003100000-memory.dmpFilesize
64KB
-
memory/2644-159-0x00000000030F0000-0x0000000003100000-memory.dmpFilesize
64KB
-
memory/2644-140-0x00000000030D0000-0x00000000030E0000-memory.dmpFilesize
64KB
-
memory/2644-147-0x00000000030D0000-0x00000000030E0000-memory.dmpFilesize
64KB
-
memory/2644-166-0x00000000030D0000-0x00000000030E0000-memory.dmpFilesize
64KB
-
memory/2644-167-0x00000000030D0000-0x00000000030E0000-memory.dmpFilesize
64KB
-
memory/2644-168-0x00000000030D0000-0x00000000030E0000-memory.dmpFilesize
64KB
-
memory/2644-169-0x00000000030D0000-0x00000000030E0000-memory.dmpFilesize
64KB
-
memory/2644-170-0x00000000030D0000-0x00000000030E0000-memory.dmpFilesize
64KB
-
memory/2644-171-0x00000000030D0000-0x00000000030E0000-memory.dmpFilesize
64KB
-
memory/2644-172-0x00000000030D0000-0x00000000030E0000-memory.dmpFilesize
64KB
-
memory/2644-173-0x00000000030D0000-0x00000000030E0000-memory.dmpFilesize
64KB
-
memory/2644-174-0x00000000030D0000-0x00000000030E0000-memory.dmpFilesize
64KB
-
memory/2644-175-0x00000000030D0000-0x00000000030E0000-memory.dmpFilesize
64KB
-
memory/2644-176-0x00000000030D0000-0x00000000030E0000-memory.dmpFilesize
64KB
-
memory/2644-177-0x00000000030D0000-0x00000000030E0000-memory.dmpFilesize
64KB
-
memory/2644-178-0x00000000030D0000-0x00000000030E0000-memory.dmpFilesize
64KB
-
memory/2644-179-0x00000000030D0000-0x00000000030E0000-memory.dmpFilesize
64KB
-
memory/2644-180-0x0000000001300000-0x0000000001310000-memory.dmpFilesize
64KB
-
memory/2644-181-0x0000000000F60000-0x0000000000F70000-memory.dmpFilesize
64KB
-
memory/2644-182-0x0000000001300000-0x0000000001310000-memory.dmpFilesize
64KB
-
memory/2644-183-0x0000000001300000-0x0000000001310000-memory.dmpFilesize
64KB
-
memory/2644-184-0x0000000000F60000-0x0000000000F70000-memory.dmpFilesize
64KB
-
memory/4092-132-0x000000000075D000-0x000000000076D000-memory.dmpFilesize
64KB
-
memory/4092-133-0x00000000006D0000-0x00000000006D9000-memory.dmpFilesize
36KB
-
memory/4092-136-0x000000000075D000-0x000000000076D000-memory.dmpFilesize
64KB