Analysis
-
max time kernel
152s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2022 19:47
Static task
static1
Behavioral task
behavioral1
Sample
dbb5a1f87b3db55e2228f08b6d2f482db0452af05fe11d579cd4dc92c105086e.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
dbb5a1f87b3db55e2228f08b6d2f482db0452af05fe11d579cd4dc92c105086e.exe
Resource
win10v2004-20220812-en
General
-
Target
dbb5a1f87b3db55e2228f08b6d2f482db0452af05fe11d579cd4dc92c105086e.exe
-
Size
168KB
-
MD5
21dc7d54b5ccd1be83218d572b202010
-
SHA1
7a814c0bc1a767c18245121f6afb998da48b0b74
-
SHA256
dbb5a1f87b3db55e2228f08b6d2f482db0452af05fe11d579cd4dc92c105086e
-
SHA512
3a34bd23ff052fc285fc6baf81544eea74d36e0af27c85c9cc4afd05f42170cd6592786a2489406ab709a91cc654775cfcb1cb2e96cb2ee29124b5efe8b23baf
-
SSDEEP
3072:O4V1Ra/FLNhS55tYYKnK3QY3fwM6raEAyD:RodLNItYYmpZ2y
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2764-133-0x0000000002300000-0x0000000002309000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
tsurhew8B53.exepid process 3568 tsurhew 3916 8B53.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
dbb5a1f87b3db55e2228f08b6d2f482db0452af05fe11d579cd4dc92c105086e.exetsurhewdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dbb5a1f87b3db55e2228f08b6d2f482db0452af05fe11d579cd4dc92c105086e.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dbb5a1f87b3db55e2228f08b6d2f482db0452af05fe11d579cd4dc92c105086e.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dbb5a1f87b3db55e2228f08b6d2f482db0452af05fe11d579cd4dc92c105086e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tsurhew Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tsurhew Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tsurhew -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
dbb5a1f87b3db55e2228f08b6d2f482db0452af05fe11d579cd4dc92c105086e.exepid process 2764 dbb5a1f87b3db55e2228f08b6d2f482db0452af05fe11d579cd4dc92c105086e.exe 2764 dbb5a1f87b3db55e2228f08b6d2f482db0452af05fe11d579cd4dc92c105086e.exe 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 724 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 724 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
dbb5a1f87b3db55e2228f08b6d2f482db0452af05fe11d579cd4dc92c105086e.exetsurhewpid process 2764 dbb5a1f87b3db55e2228f08b6d2f482db0452af05fe11d579cd4dc92c105086e.exe 3568 tsurhew -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
description pid process target process PID 724 wrote to memory of 3916 724 8B53.exe PID 724 wrote to memory of 3916 724 8B53.exe PID 724 wrote to memory of 3916 724 8B53.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbb5a1f87b3db55e2228f08b6d2f482db0452af05fe11d579cd4dc92c105086e.exe"C:\Users\Admin\AppData\Local\Temp\dbb5a1f87b3db55e2228f08b6d2f482db0452af05fe11d579cd4dc92c105086e.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\tsurhewC:\Users\Admin\AppData\Roaming\tsurhew1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\8B53.exeC:\Users\Admin\AppData\Local\Temp\8B53.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\8B53.exeFilesize
3.6MB
MD5ae7a6e5474e6f83bd69291c89b322171
SHA1345fd599a443ac15d89df887121b602e40a375b5
SHA256bb263c2c0927449caf1a7a7fcb7d9665bc876d02977d9d8fec7665009e6e63e8
SHA5122154547451edd66a0b4adad43db0c909ed934ebf1ae14a667650184ae0bba55d00bb454759685b1ccc2c3fb5b04293e81c068e947c1998055b0bff720bc2c30e
-
C:\Users\Admin\AppData\Local\Temp\8B53.exeFilesize
3.6MB
MD5ae7a6e5474e6f83bd69291c89b322171
SHA1345fd599a443ac15d89df887121b602e40a375b5
SHA256bb263c2c0927449caf1a7a7fcb7d9665bc876d02977d9d8fec7665009e6e63e8
SHA5122154547451edd66a0b4adad43db0c909ed934ebf1ae14a667650184ae0bba55d00bb454759685b1ccc2c3fb5b04293e81c068e947c1998055b0bff720bc2c30e
-
C:\Users\Admin\AppData\Roaming\tsurhewFilesize
168KB
MD521dc7d54b5ccd1be83218d572b202010
SHA17a814c0bc1a767c18245121f6afb998da48b0b74
SHA256dbb5a1f87b3db55e2228f08b6d2f482db0452af05fe11d579cd4dc92c105086e
SHA5123a34bd23ff052fc285fc6baf81544eea74d36e0af27c85c9cc4afd05f42170cd6592786a2489406ab709a91cc654775cfcb1cb2e96cb2ee29124b5efe8b23baf
-
C:\Users\Admin\AppData\Roaming\tsurhewFilesize
168KB
MD521dc7d54b5ccd1be83218d572b202010
SHA17a814c0bc1a767c18245121f6afb998da48b0b74
SHA256dbb5a1f87b3db55e2228f08b6d2f482db0452af05fe11d579cd4dc92c105086e
SHA5123a34bd23ff052fc285fc6baf81544eea74d36e0af27c85c9cc4afd05f42170cd6592786a2489406ab709a91cc654775cfcb1cb2e96cb2ee29124b5efe8b23baf
-
memory/2764-133-0x0000000002300000-0x0000000002309000-memory.dmpFilesize
36KB
-
memory/2764-134-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/2764-135-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/2764-132-0x000000000073D000-0x000000000074E000-memory.dmpFilesize
68KB
-
memory/3568-138-0x00000000009AD000-0x00000000009BE000-memory.dmpFilesize
68KB
-
memory/3568-140-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/3568-139-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/3916-141-0x0000000000000000-mapping.dmp
-
memory/3916-144-0x00000000025AF000-0x0000000002931000-memory.dmpFilesize
3.5MB
-
memory/3916-145-0x0000000002940000-0x0000000002E22000-memory.dmpFilesize
4.9MB