Analysis
-
max time kernel
152s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2022 19:59
Static task
static1
Behavioral task
behavioral1
Sample
bb26de17ff25cdb4eac4b917b4bd4b50b763b87b3b39fd51942964340abc953d.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
bb26de17ff25cdb4eac4b917b4bd4b50b763b87b3b39fd51942964340abc953d.exe
-
Size
148KB
-
MD5
fc238498ebf2235a1c1502fb00cee44a
-
SHA1
de2fff4bfc1b3b8e2aa636bcfdd3890399bf025f
-
SHA256
bb26de17ff25cdb4eac4b917b4bd4b50b763b87b3b39fd51942964340abc953d
-
SHA512
879f5195e6781a0094859be69a8c680c26146bdbddc0359c83d801efc752cb6eff6a26ea77e69fe2963ceedb9be43208366204dee3af4651da5fab960ad1210d
-
SSDEEP
1536:20VufKL9YAqP788nqrcKOPf6PXPrqok5aDZTp8B+n7OfcYjwtlKV0jq5DtubukxT:20Vufa8PacKcw+ok5mBpJOfJMvUIDVT
Score
10/10
Malware Config
Signatures
-
Detects Smokeloader packer 4 IoCs
resource yara_rule behavioral1/memory/1944-133-0x00000000005C0000-0x00000000005C9000-memory.dmp family_smokeloader behavioral1/memory/2196-135-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/2196-136-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/2196-138-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1944 set thread context of 2196 1944 bb26de17ff25cdb4eac4b917b4bd4b50b763b87b3b39fd51942964340abc953d.exe 76 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bb26de17ff25cdb4eac4b917b4bd4b50b763b87b3b39fd51942964340abc953d.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bb26de17ff25cdb4eac4b917b4bd4b50b763b87b3b39fd51942964340abc953d.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bb26de17ff25cdb4eac4b917b4bd4b50b763b87b3b39fd51942964340abc953d.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2196 bb26de17ff25cdb4eac4b917b4bd4b50b763b87b3b39fd51942964340abc953d.exe 2196 bb26de17ff25cdb4eac4b917b4bd4b50b763b87b3b39fd51942964340abc953d.exe 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2688 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2196 bb26de17ff25cdb4eac4b917b4bd4b50b763b87b3b39fd51942964340abc953d.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2688 Process not Found 2688 Process not Found 2688 Process not Found -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2688 Process not Found 2688 Process not Found 2688 Process not Found -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1944 wrote to memory of 2196 1944 bb26de17ff25cdb4eac4b917b4bd4b50b763b87b3b39fd51942964340abc953d.exe 76 PID 1944 wrote to memory of 2196 1944 bb26de17ff25cdb4eac4b917b4bd4b50b763b87b3b39fd51942964340abc953d.exe 76 PID 1944 wrote to memory of 2196 1944 bb26de17ff25cdb4eac4b917b4bd4b50b763b87b3b39fd51942964340abc953d.exe 76 PID 1944 wrote to memory of 2196 1944 bb26de17ff25cdb4eac4b917b4bd4b50b763b87b3b39fd51942964340abc953d.exe 76 PID 1944 wrote to memory of 2196 1944 bb26de17ff25cdb4eac4b917b4bd4b50b763b87b3b39fd51942964340abc953d.exe 76 PID 1944 wrote to memory of 2196 1944 bb26de17ff25cdb4eac4b917b4bd4b50b763b87b3b39fd51942964340abc953d.exe 76
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb26de17ff25cdb4eac4b917b4bd4b50b763b87b3b39fd51942964340abc953d.exe"C:\Users\Admin\AppData\Local\Temp\bb26de17ff25cdb4eac4b917b4bd4b50b763b87b3b39fd51942964340abc953d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\bb26de17ff25cdb4eac4b917b4bd4b50b763b87b3b39fd51942964340abc953d.exe"C:\Users\Admin\AppData\Local\Temp\bb26de17ff25cdb4eac4b917b4bd4b50b763b87b3b39fd51942964340abc953d.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2196
-