Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
27-11-2022 21:06
General
-
Target
05581c40ffe6b5631c5ecbbe13083483c272ad33339f102f8b4ffecb520f3512.exe
-
Size
167KB
-
MD5
4d8f8fdcaaf332e3376eaf4987d2f36c
-
SHA1
36f8b6b35407e6af3a23d57d82ef318bddf6bf75
-
SHA256
05581c40ffe6b5631c5ecbbe13083483c272ad33339f102f8b4ffecb520f3512
-
SHA512
af826f24d6e016e551162267ac70acb42959b5759616f3424edf00d4c72f158bd5b81bcec2e224c3df264f8ef9cd1b5b57e34d87bdeb31c83b4de3fd4e7ad86d
-
SSDEEP
3072:7ATLtJYUU4Cu5LS5KYNm4NaVDZvBA0mmjVpPaoUBS3dj:waUbf57QlY7vBA0Lh5Q+
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Blocklisted process makes network request 1 IoCs
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Program crash 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\05581c40ffe6b5631c5ecbbe13083483c272ad33339f102f8b4ffecb520f3512.exe"C:\Users\Admin\AppData\Local\Temp\05581c40ffe6b5631c5ecbbe13083483c272ad33339f102f8b4ffecb520f3512.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\F0F7.exeC:\Users\Admin\AppData\Local\Temp\F0F7.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Weheooup.dll,start2⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 4842⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4344 -ip 43441⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD5ae7a6e5474e6f83bd69291c89b322171
SHA1345fd599a443ac15d89df887121b602e40a375b5
SHA256bb263c2c0927449caf1a7a7fcb7d9665bc876d02977d9d8fec7665009e6e63e8
SHA5122154547451edd66a0b4adad43db0c909ed934ebf1ae14a667650184ae0bba55d00bb454759685b1ccc2c3fb5b04293e81c068e947c1998055b0bff720bc2c30e
-
Filesize
3.6MB
MD5ae7a6e5474e6f83bd69291c89b322171
SHA1345fd599a443ac15d89df887121b602e40a375b5
SHA256bb263c2c0927449caf1a7a7fcb7d9665bc876d02977d9d8fec7665009e6e63e8
SHA5122154547451edd66a0b4adad43db0c909ed934ebf1ae14a667650184ae0bba55d00bb454759685b1ccc2c3fb5b04293e81c068e947c1998055b0bff720bc2c30e
-
Filesize
4.2MB
MD56bbb5300608b4460448e90bc689edbbb
SHA1dbb3c393cb62dbe9d773b651f993112eaf6d79a5
SHA256f6d7e2848a15d8d670e673a5b8fd491192abde80f843297c77995e9ed902984d
SHA51234c5e6a58768c7bf8f20fdd5fa3fe316378a86d66b55aea86c9ba45520d0d4405822b29c82d3998695d1d2de18ab484808ab1d6a8b475976269e6087d17d93fa
-
Filesize
4.2MB
MD56bbb5300608b4460448e90bc689edbbb
SHA1dbb3c393cb62dbe9d773b651f993112eaf6d79a5
SHA256f6d7e2848a15d8d670e673a5b8fd491192abde80f843297c77995e9ed902984d
SHA51234c5e6a58768c7bf8f20fdd5fa3fe316378a86d66b55aea86c9ba45520d0d4405822b29c82d3998695d1d2de18ab484808ab1d6a8b475976269e6087d17d93fa
-
Filesize
4.3MB
-
-
Filesize
4.9MB
-
-
Filesize
3.5MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
36KB
-
Filesize
64KB
-
Filesize
3.0MB
-
Filesize
3.0MB