Analysis
-
max time kernel
191s -
max time network
194s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
24-11-2022 19:47
General
-
Target
file.exe
-
Size
188KB
-
MD5
3176f912c2e3e4f78174a080d134ce9e
-
SHA1
416bcf72c13385aa22c73ca1ba3945c8e86368a9
-
SHA256
2beea12d97df10502b1b0c38a6f08ce3f8c7c63fc7c46e5590ea0312537fd507
-
SHA512
44e5593d19a9458a2600c37de1e7149144ac411d5f34d79886628eb101645fff211833111b0bedf722e1fdf042c50f679177a279a74c31e0fc26d42ce0fed8c8
-
SSDEEP
3072:UsKqrPWyy4JadLD9uEZWsl5XWc3iji8n2Exsmplf70vwNy:CqsLD9u7zAif5lz0YA
Malware Config
Signatures
-
Detects Smokeloader packer 2 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\ujeheitC:\Users\Admin\AppData\Roaming\ujeheit1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ujeheitFilesize
188KB
MD53176f912c2e3e4f78174a080d134ce9e
SHA1416bcf72c13385aa22c73ca1ba3945c8e86368a9
SHA2562beea12d97df10502b1b0c38a6f08ce3f8c7c63fc7c46e5590ea0312537fd507
SHA51244e5593d19a9458a2600c37de1e7149144ac411d5f34d79886628eb101645fff211833111b0bedf722e1fdf042c50f679177a279a74c31e0fc26d42ce0fed8c8
-
C:\Users\Admin\AppData\Roaming\ujeheitFilesize
188KB
MD53176f912c2e3e4f78174a080d134ce9e
SHA1416bcf72c13385aa22c73ca1ba3945c8e86368a9
SHA2562beea12d97df10502b1b0c38a6f08ce3f8c7c63fc7c46e5590ea0312537fd507
SHA51244e5593d19a9458a2600c37de1e7149144ac411d5f34d79886628eb101645fff211833111b0bedf722e1fdf042c50f679177a279a74c31e0fc26d42ce0fed8c8
-
memory/4072-132-0x00000000008DD000-0x00000000008EE000-memory.dmpFilesize
68KB
-
memory/4072-133-0x00000000001C0000-0x00000000001C9000-memory.dmpFilesize
36KB
-
memory/4072-134-0x00000000008DD000-0x00000000008EE000-memory.dmpFilesize
68KB
-
memory/4072-135-0x0000000000400000-0x000000000064C000-memory.dmpFilesize
2.3MB
-
memory/4072-136-0x00000000008DD000-0x00000000008EE000-memory.dmpFilesize
68KB
-
memory/4072-137-0x00000000001C0000-0x00000000001C9000-memory.dmpFilesize
36KB
-
memory/4072-138-0x0000000000400000-0x000000000064C000-memory.dmpFilesize
2.3MB
-
memory/4468-141-0x00000000008FD000-0x000000000090E000-memory.dmpFilesize
68KB
-
memory/4468-142-0x0000000000400000-0x000000000064C000-memory.dmpFilesize
2.3MB
-
memory/4468-143-0x0000000000400000-0x000000000064C000-memory.dmpFilesize
2.3MB