Analysis

  • max time kernel
    151s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-11-2022 13:40

General

  • Target

    280f4d85243c72f582910876c7a9559f446bd106e0a7b5e6ed14a02f95298262.exe

  • Size

    146KB

  • MD5

    01e7b93ad52128ae0f068864623350c1

  • SHA1

    621e8ac72ac23d64cbd3188c7fadec91126625ae

  • SHA256

    280f4d85243c72f582910876c7a9559f446bd106e0a7b5e6ed14a02f95298262

  • SHA512

    ae99152a4787a8d1cf99e64338b8335f3c25a361482a956a49bd2a02c7f01769371db8401ee4a7c9bc9ae0125885aa2d5293cb0b8a4b627893f8666ff258076f

  • SSDEEP

    1536:IbLL3qxsbMdB0BoIdG2+yK2K3osN55TIXWgVr5fpe7h0TNLMkWm+j3iIWE0Wtdee:ayxkEylsN5uv/e9uum0SrsHTiu5

Malware Config

Signatures

  • Detects Smokeloader packer 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 26 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies registry class 30 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\280f4d85243c72f582910876c7a9559f446bd106e0a7b5e6ed14a02f95298262.exe
    "C:\Users\Admin\AppData\Local\Temp\280f4d85243c72f582910876c7a9559f446bd106e0a7b5e6ed14a02f95298262.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:3068
  • C:\Users\Admin\AppData\Local\Temp\70BB.exe
    C:\Users\Admin\AppData\Local\Temp\70BB.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:2896
    • C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Serpodtudpwhhta.dll,start
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Accesses Microsoft Outlook accounts
      • Accesses Microsoft Outlook profiles
      • Suspicious use of SetThreadContext
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:2004
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 13736
        3⤵
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        PID:1184
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
        3⤵
          PID:5104
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
          3⤵
            PID:4848
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 512
          2⤵
          • Program crash
          PID:4192
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2896 -ip 2896
        1⤵
          PID:1264
        • C:\Windows\System32\rundll32.exe
          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
          1⤵
            PID:3460

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Defense Evasion

          Modify Registry

          1
          T1112

          Credential Access

          Credentials in Files

          1
          T1081

          Discovery

          Query Registry

          3
          T1012

          System Information Discovery

          3
          T1082

          Peripheral Device Discovery

          1
          T1120

          Collection

          Data from Local System

          1
          T1005

          Email Collection

          2
          T1114

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\70BB.exe
            Filesize

            3.6MB

            MD5

            b96b968d91c4deb10f2d308dafd5bc6c

            SHA1

            9a5010b0fb98cf4d3eb07ff87aa0c03a312ae69a

            SHA256

            21ca1cbd90fe908437ba8a184f4468501e269ba3c0b2ee1486ef947d357d6cf5

            SHA512

            ea8f5bc343eeb2af5537962175dbf2c1ec374aaaaa8e1413c56b614c73f8bac8689b96ce3cf9f13068b778e21074f28fad0c90f8f85df8bf67ddcc2ccca8c01d

          • C:\Users\Admin\AppData\Local\Temp\70BB.exe
            Filesize

            3.6MB

            MD5

            b96b968d91c4deb10f2d308dafd5bc6c

            SHA1

            9a5010b0fb98cf4d3eb07ff87aa0c03a312ae69a

            SHA256

            21ca1cbd90fe908437ba8a184f4468501e269ba3c0b2ee1486ef947d357d6cf5

            SHA512

            ea8f5bc343eeb2af5537962175dbf2c1ec374aaaaa8e1413c56b614c73f8bac8689b96ce3cf9f13068b778e21074f28fad0c90f8f85df8bf67ddcc2ccca8c01d

          • C:\Users\Admin\AppData\Local\Temp\Serpodtudpwhhta.dll
            Filesize

            4.3MB

            MD5

            74eb659f383a09cc951a7d2b622aa881

            SHA1

            aff735ac45ebac03fd8f6c3ad0d87c37610dc533

            SHA256

            b8dc75a82c17406959b2641e3894473e5199c946ae52d8338d76fee25f579b71

            SHA512

            26a21878ad22ebd50c3ae91be39d035b3f1f55dd22654a9054d6b90cd8a5df19d3012710b4c6966f6efa02faff87178d3728d129b73cd2066c09e8176d6eb2b3

          • C:\Users\Admin\AppData\Local\Temp\Serpodtudpwhhta.dll
            Filesize

            4.3MB

            MD5

            74eb659f383a09cc951a7d2b622aa881

            SHA1

            aff735ac45ebac03fd8f6c3ad0d87c37610dc533

            SHA256

            b8dc75a82c17406959b2641e3894473e5199c946ae52d8338d76fee25f579b71

            SHA512

            26a21878ad22ebd50c3ae91be39d035b3f1f55dd22654a9054d6b90cd8a5df19d3012710b4c6966f6efa02faff87178d3728d129b73cd2066c09e8176d6eb2b3

          • C:\Users\Admin\AppData\Local\Temp\Serpodtudpwhhta.dll
            Filesize

            4.3MB

            MD5

            74eb659f383a09cc951a7d2b622aa881

            SHA1

            aff735ac45ebac03fd8f6c3ad0d87c37610dc533

            SHA256

            b8dc75a82c17406959b2641e3894473e5199c946ae52d8338d76fee25f579b71

            SHA512

            26a21878ad22ebd50c3ae91be39d035b3f1f55dd22654a9054d6b90cd8a5df19d3012710b4c6966f6efa02faff87178d3728d129b73cd2066c09e8176d6eb2b3

          • memory/1184-166-0x0000028AF6B80000-0x0000028AF6E28000-memory.dmp
            Filesize

            2.7MB

          • memory/1184-165-0x00000000008D0000-0x0000000000B66000-memory.dmp
            Filesize

            2.6MB

          • memory/1184-164-0x0000028AF85D0000-0x0000028AF8710000-memory.dmp
            Filesize

            1.2MB

          • memory/1184-163-0x0000028AF85D0000-0x0000028AF8710000-memory.dmp
            Filesize

            1.2MB

          • memory/1184-162-0x00007FF69B2D6890-mapping.dmp
          • memory/2004-144-0x0000000000000000-mapping.dmp
          • memory/2004-149-0x00000000023C0000-0x0000000002817000-memory.dmp
            Filesize

            4.3MB

          • memory/2004-156-0x0000000004170000-0x00000000042B0000-memory.dmp
            Filesize

            1.2MB

          • memory/2004-160-0x0000000004170000-0x00000000042B0000-memory.dmp
            Filesize

            1.2MB

          • memory/2004-161-0x0000000004170000-0x00000000042B0000-memory.dmp
            Filesize

            1.2MB

          • memory/2004-169-0x0000000003560000-0x00000000040AD000-memory.dmp
            Filesize

            11.3MB

          • memory/2004-148-0x00000000023C0000-0x0000000002817000-memory.dmp
            Filesize

            4.3MB

          • memory/2004-159-0x0000000004170000-0x00000000042B0000-memory.dmp
            Filesize

            1.2MB

          • memory/2004-158-0x0000000004170000-0x00000000042B0000-memory.dmp
            Filesize

            1.2MB

          • memory/2004-157-0x0000000004170000-0x00000000042B0000-memory.dmp
            Filesize

            1.2MB

          • memory/2004-152-0x00000000023C0000-0x0000000002817000-memory.dmp
            Filesize

            4.3MB

          • memory/2004-153-0x0000000003560000-0x00000000040AD000-memory.dmp
            Filesize

            11.3MB

          • memory/2004-154-0x0000000003560000-0x00000000040AD000-memory.dmp
            Filesize

            11.3MB

          • memory/2004-155-0x0000000003560000-0x00000000040AD000-memory.dmp
            Filesize

            11.3MB

          • memory/2896-141-0x0000000002714000-0x0000000002A99000-memory.dmp
            Filesize

            3.5MB

          • memory/2896-138-0x0000000000000000-mapping.dmp
          • memory/2896-150-0x0000000002714000-0x0000000002A99000-memory.dmp
            Filesize

            3.5MB

          • memory/2896-143-0x0000000000400000-0x00000000008F2000-memory.dmp
            Filesize

            4.9MB

          • memory/2896-142-0x0000000002AA0000-0x0000000002F85000-memory.dmp
            Filesize

            4.9MB

          • memory/2896-151-0x0000000000400000-0x00000000008F2000-memory.dmp
            Filesize

            4.9MB

          • memory/3068-137-0x0000000000400000-0x000000000045A000-memory.dmp
            Filesize

            360KB

          • memory/3068-132-0x000000000066D000-0x000000000067E000-memory.dmp
            Filesize

            68KB

          • memory/3068-136-0x00000000004D0000-0x00000000004D9000-memory.dmp
            Filesize

            36KB

          • memory/3068-135-0x000000000066D000-0x000000000067E000-memory.dmp
            Filesize

            68KB

          • memory/3068-134-0x0000000000400000-0x000000000045A000-memory.dmp
            Filesize

            360KB

          • memory/3068-133-0x00000000004D0000-0x00000000004D9000-memory.dmp
            Filesize

            36KB

          • memory/4848-168-0x0000000000000000-mapping.dmp
          • memory/5104-167-0x0000000000000000-mapping.dmp