Analysis
-
max time kernel
157s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
25-11-2022 05:47
General
-
Target
1eb57c2fe1db10b6a28b048bf1e88b134c3ac13738be60b8f7a1aef4f3b446cc.exe
-
Size
188KB
-
MD5
eecb09fbcdc28262be91de5a17ab7a17
-
SHA1
468478d9b2a36be48b6a52c8e1c7776295591775
-
SHA256
1eb57c2fe1db10b6a28b048bf1e88b134c3ac13738be60b8f7a1aef4f3b446cc
-
SHA512
a8a785eb3ec52586f0d0e1826933ec66db9e6845b18bf464e79f3ed1aa7d6b25cc266e87885dbb4df2d07092e4c4ae887ed272a92aa51d38fca7d553236e3d32
-
SSDEEP
3072:IA3129DCD2K79/LPg8hOZ+5djM3w8FdgzyOmV:F3TLPgLrw8Fdgzn6
Malware Config
Signatures
-
Detects Smokeloader packer 2 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Blocklisted process makes network request 2 IoCs
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
-
Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 28 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies Internet Explorer settings 1 TTPs 4 IoCs
-
Modifies registry class 30 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
-
Suspicious use of FindShellTrayWindow 13 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1eb57c2fe1db10b6a28b048bf1e88b134c3ac13738be60b8f7a1aef4f3b446cc.exe"C:\Users\Admin\AppData\Local\Temp\1eb57c2fe1db10b6a28b048bf1e88b134c3ac13738be60b8f7a1aef4f3b446cc.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Local\Temp\ABA1.exeC:\Users\Admin\AppData\Local\Temp\ABA1.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Tdryuqayh.tmp",Worhdhqfpryr2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 201483⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 656 -s 5562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 656 -ip 6561⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Roaming\hhihjabC:\Users\Admin\AppData\Roaming\hhihjab1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1017KB
MD57feb4f9a41a2cf10e3a4224d8df77680
SHA1fb38df55155c58fd747773fe6446848f57b7eaf4
SHA256f792f45740a13416917ef6c05b664758f00d5d89dc84c31a55d139fb3809d26a
SHA512b228dea7ae2f1de5c0fae447fde3b822a928cd4ba7b42872d5173b3408d1aaff240be1787be78f24166a7e0767719d9ebc498c09846de7eea613ef2c77811c97
-
Filesize
1017KB
MD57feb4f9a41a2cf10e3a4224d8df77680
SHA1fb38df55155c58fd747773fe6446848f57b7eaf4
SHA256f792f45740a13416917ef6c05b664758f00d5d89dc84c31a55d139fb3809d26a
SHA512b228dea7ae2f1de5c0fae447fde3b822a928cd4ba7b42872d5173b3408d1aaff240be1787be78f24166a7e0767719d9ebc498c09846de7eea613ef2c77811c97
-
Filesize
767KB
MD5d8ca174a8f3f0c225429e1be1cb6d304
SHA10f2e738b1a35b6072e1d23894468e45fa7dee750
SHA2563d63ad175a34e4c89ea6eca4a1161bb5dd514a5e58302707edc03473eb1f656e
SHA512dbf999a9f0399b3cbf93484f2e665e3beb4de369dacf4678c7b7b3ff06f45c42879c544c2404d85b88fe3aaacf117a1e28ecb68ee7ea2553b736bad03619e527
-
Filesize
767KB
MD5d8ca174a8f3f0c225429e1be1cb6d304
SHA10f2e738b1a35b6072e1d23894468e45fa7dee750
SHA2563d63ad175a34e4c89ea6eca4a1161bb5dd514a5e58302707edc03473eb1f656e
SHA512dbf999a9f0399b3cbf93484f2e665e3beb4de369dacf4678c7b7b3ff06f45c42879c544c2404d85b88fe3aaacf117a1e28ecb68ee7ea2553b736bad03619e527
-
Filesize
188KB
MD5eecb09fbcdc28262be91de5a17ab7a17
SHA1468478d9b2a36be48b6a52c8e1c7776295591775
SHA2561eb57c2fe1db10b6a28b048bf1e88b134c3ac13738be60b8f7a1aef4f3b446cc
SHA512a8a785eb3ec52586f0d0e1826933ec66db9e6845b18bf464e79f3ed1aa7d6b25cc266e87885dbb4df2d07092e4c4ae887ed272a92aa51d38fca7d553236e3d32
-
Filesize
188KB
MD5eecb09fbcdc28262be91de5a17ab7a17
SHA1468478d9b2a36be48b6a52c8e1c7776295591775
SHA2561eb57c2fe1db10b6a28b048bf1e88b134c3ac13738be60b8f7a1aef4f3b446cc
SHA512a8a785eb3ec52586f0d0e1826933ec66db9e6845b18bf464e79f3ed1aa7d6b25cc266e87885dbb4df2d07092e4c4ae887ed272a92aa51d38fca7d553236e3d32
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
892KB
-
-
Filesize
3.1MB
-
Filesize
1.1MB
-
Filesize
3.1MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
-
-
-
Filesize
64KB
-
Filesize
2.3MB
-
Filesize
2.3MB