Analysis
-
max time kernel
185s -
max time network
188s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2022 19:59
Static task
static1
Behavioral task
behavioral1
Sample
a23071ca8b7cb1a2a85fd54efe3a5cf2f80470c9846efce69dd72d659f2670ad.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a23071ca8b7cb1a2a85fd54efe3a5cf2f80470c9846efce69dd72d659f2670ad.exe
Resource
win10v2004-20220812-en
General
-
Target
a23071ca8b7cb1a2a85fd54efe3a5cf2f80470c9846efce69dd72d659f2670ad.exe
-
Size
167KB
-
MD5
da4afd549426c3e6295e9a72e3872cda
-
SHA1
5e523e4069b17263af7e96afa24efd2227ec2158
-
SHA256
a23071ca8b7cb1a2a85fd54efe3a5cf2f80470c9846efce69dd72d659f2670ad
-
SHA512
9c34bfe0ae72461e88c086aaac8746e5a6e730223fcd2788e889432ebd25eba1acd4dcdd9917b9d180989a604b90e1ac5272187252140ad7631a97331b1a5d2a
-
SSDEEP
3072:Wrd9Ya2ZukYxzS5baNcb/ZfnKIoq4+2pGSbAP:wPELYxwvBCIL4PGJP
Malware Config
Signatures
-
Detects Smokeloader packer 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2016-133-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral2/memory/4244-135-0x0000000000870000-0x0000000000879000-memory.dmp family_smokeloader behavioral2/memory/2016-136-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral2/memory/2016-137-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
a23071ca8b7cb1a2a85fd54efe3a5cf2f80470c9846efce69dd72d659f2670ad.exedescription pid process target process PID 4244 set thread context of 2016 4244 a23071ca8b7cb1a2a85fd54efe3a5cf2f80470c9846efce69dd72d659f2670ad.exe a23071ca8b7cb1a2a85fd54efe3a5cf2f80470c9846efce69dd72d659f2670ad.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
a23071ca8b7cb1a2a85fd54efe3a5cf2f80470c9846efce69dd72d659f2670ad.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a23071ca8b7cb1a2a85fd54efe3a5cf2f80470c9846efce69dd72d659f2670ad.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a23071ca8b7cb1a2a85fd54efe3a5cf2f80470c9846efce69dd72d659f2670ad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a23071ca8b7cb1a2a85fd54efe3a5cf2f80470c9846efce69dd72d659f2670ad.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a23071ca8b7cb1a2a85fd54efe3a5cf2f80470c9846efce69dd72d659f2670ad.exepid process 2016 a23071ca8b7cb1a2a85fd54efe3a5cf2f80470c9846efce69dd72d659f2670ad.exe 2016 a23071ca8b7cb1a2a85fd54efe3a5cf2f80470c9846efce69dd72d659f2670ad.exe 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3060 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
a23071ca8b7cb1a2a85fd54efe3a5cf2f80470c9846efce69dd72d659f2670ad.exepid process 2016 a23071ca8b7cb1a2a85fd54efe3a5cf2f80470c9846efce69dd72d659f2670ad.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
a23071ca8b7cb1a2a85fd54efe3a5cf2f80470c9846efce69dd72d659f2670ad.exedescription pid process target process PID 4244 wrote to memory of 2016 4244 a23071ca8b7cb1a2a85fd54efe3a5cf2f80470c9846efce69dd72d659f2670ad.exe a23071ca8b7cb1a2a85fd54efe3a5cf2f80470c9846efce69dd72d659f2670ad.exe PID 4244 wrote to memory of 2016 4244 a23071ca8b7cb1a2a85fd54efe3a5cf2f80470c9846efce69dd72d659f2670ad.exe a23071ca8b7cb1a2a85fd54efe3a5cf2f80470c9846efce69dd72d659f2670ad.exe PID 4244 wrote to memory of 2016 4244 a23071ca8b7cb1a2a85fd54efe3a5cf2f80470c9846efce69dd72d659f2670ad.exe a23071ca8b7cb1a2a85fd54efe3a5cf2f80470c9846efce69dd72d659f2670ad.exe PID 4244 wrote to memory of 2016 4244 a23071ca8b7cb1a2a85fd54efe3a5cf2f80470c9846efce69dd72d659f2670ad.exe a23071ca8b7cb1a2a85fd54efe3a5cf2f80470c9846efce69dd72d659f2670ad.exe PID 4244 wrote to memory of 2016 4244 a23071ca8b7cb1a2a85fd54efe3a5cf2f80470c9846efce69dd72d659f2670ad.exe a23071ca8b7cb1a2a85fd54efe3a5cf2f80470c9846efce69dd72d659f2670ad.exe PID 4244 wrote to memory of 2016 4244 a23071ca8b7cb1a2a85fd54efe3a5cf2f80470c9846efce69dd72d659f2670ad.exe a23071ca8b7cb1a2a85fd54efe3a5cf2f80470c9846efce69dd72d659f2670ad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a23071ca8b7cb1a2a85fd54efe3a5cf2f80470c9846efce69dd72d659f2670ad.exe"C:\Users\Admin\AppData\Local\Temp\a23071ca8b7cb1a2a85fd54efe3a5cf2f80470c9846efce69dd72d659f2670ad.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\a23071ca8b7cb1a2a85fd54efe3a5cf2f80470c9846efce69dd72d659f2670ad.exe"C:\Users\Admin\AppData\Local\Temp\a23071ca8b7cb1a2a85fd54efe3a5cf2f80470c9846efce69dd72d659f2670ad.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2016
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2016-132-0x0000000000000000-mapping.dmp
-
memory/2016-133-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2016-136-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2016-137-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4244-135-0x0000000000870000-0x0000000000879000-memory.dmpFilesize
36KB
-
memory/4244-134-0x00000000008AE000-0x00000000008BE000-memory.dmpFilesize
64KB