Analysis
-
max time kernel
165s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
28/11/2022, 05:32
General
-
Target
file.exe
-
Size
144KB
-
MD5
c1f8a4b2c2a1860ad80af57ea4669efa
-
SHA1
e52436d8d8d9ff8a4e41668ac7f4e2f49e495126
-
SHA256
df739f6af2b830e5494a89d291d6d75713383d015c2ac1b61c718d26270d1262
-
SHA512
854be658964b6c4360ad58424f81c565e6958a74276e1d539358de554bd7c71fa9565b199cf3c5354432069dd49f10801fc08ec37e9e123f3820242c23d450b2
-
SSDEEP
3072:wxzevrZuun1S+5nfxJv2CisQMuhJhuthLml/:+evQ41vlQMwhuW
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\B87D.exeC:\Users\Admin\AppData\Local\Temp\B87D.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD57d9db457b9ad7a4ba3e295d7d57aa700
SHA15b4d68862b7e28eb2db4f53633c28c97a9778bc1
SHA25661861d7235d4a8e8d56e6128865c4f27adb41b631723f79646839c8cc1148c66
SHA51293a7aa69c2906611fbacade03c726030d94bc80d666fa80e8bd7b4e1295482b034e5b77952bae40a9959090ba11fa849c437edddfbd05382f335e71815e0cb06
-
Filesize
3.4MB
MD53243a67484222542ec8730014aaeaad9
SHA1ec7751ea97e276e526ffd1e33d15649845220bb6
SHA256ed1a980332ed9dcf76c786de7104c0aa26dd768da973f9e5946c837d2e99b79d
SHA51283dd79ca2f49e701764110a0959bf9944257087e80b6a9336b6a49f80f491ebf0306371ec74c06916c4ce3afec89827e493dfb076a4c092c3eddc5f8ae8ab8fe
-
Filesize
64KB
-
Filesize
36KB
-
Filesize
360KB
-
Filesize
64KB
-
Filesize
360KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB