Analysis
-
max time kernel
156s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 20:32
Static task
static1
Behavioral task
behavioral1
Sample
32aa10810985d2bb73d515ca8dfd54bebd9e3b3696dd95b2ee2f76374283eb77.exe
Resource
win10v2004-20220812-en
General
-
Target
32aa10810985d2bb73d515ca8dfd54bebd9e3b3696dd95b2ee2f76374283eb77.exe
-
Size
146KB
-
MD5
f0e99980a9097a15a7ee8bd566683a56
-
SHA1
bc99e399cf0f421bec4aac0afb1214dc99215b0d
-
SHA256
32aa10810985d2bb73d515ca8dfd54bebd9e3b3696dd95b2ee2f76374283eb77
-
SHA512
4b9933770fed08700d7caee92da27ae86b0ac7053fb06bf2137db5949caabee73bc7b14cada24c1be37754cb9b502cbccc22ae23542ed3ca799c97cac84d8d65
-
SSDEEP
3072:dD5YVbvU122Np5i/SiqmBS9h3el/Jc8o437Vg37:UVA12D/t7S9h6/28l747
Malware Config
Signatures
-
Detects Smokeloader packer 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1380-133-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/3836-135-0x0000000002190000-0x0000000002199000-memory.dmp family_smokeloader behavioral1/memory/1380-136-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/1380-137-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
32aa10810985d2bb73d515ca8dfd54bebd9e3b3696dd95b2ee2f76374283eb77.exedescription pid process target process PID 3836 set thread context of 1380 3836 32aa10810985d2bb73d515ca8dfd54bebd9e3b3696dd95b2ee2f76374283eb77.exe 32aa10810985d2bb73d515ca8dfd54bebd9e3b3696dd95b2ee2f76374283eb77.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
32aa10810985d2bb73d515ca8dfd54bebd9e3b3696dd95b2ee2f76374283eb77.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 32aa10810985d2bb73d515ca8dfd54bebd9e3b3696dd95b2ee2f76374283eb77.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 32aa10810985d2bb73d515ca8dfd54bebd9e3b3696dd95b2ee2f76374283eb77.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 32aa10810985d2bb73d515ca8dfd54bebd9e3b3696dd95b2ee2f76374283eb77.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
32aa10810985d2bb73d515ca8dfd54bebd9e3b3696dd95b2ee2f76374283eb77.exepid process 1380 32aa10810985d2bb73d515ca8dfd54bebd9e3b3696dd95b2ee2f76374283eb77.exe 1380 32aa10810985d2bb73d515ca8dfd54bebd9e3b3696dd95b2ee2f76374283eb77.exe 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 3060 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3060 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
32aa10810985d2bb73d515ca8dfd54bebd9e3b3696dd95b2ee2f76374283eb77.exepid process 1380 32aa10810985d2bb73d515ca8dfd54bebd9e3b3696dd95b2ee2f76374283eb77.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
32aa10810985d2bb73d515ca8dfd54bebd9e3b3696dd95b2ee2f76374283eb77.exedescription pid process target process PID 3836 wrote to memory of 1380 3836 32aa10810985d2bb73d515ca8dfd54bebd9e3b3696dd95b2ee2f76374283eb77.exe 32aa10810985d2bb73d515ca8dfd54bebd9e3b3696dd95b2ee2f76374283eb77.exe PID 3836 wrote to memory of 1380 3836 32aa10810985d2bb73d515ca8dfd54bebd9e3b3696dd95b2ee2f76374283eb77.exe 32aa10810985d2bb73d515ca8dfd54bebd9e3b3696dd95b2ee2f76374283eb77.exe PID 3836 wrote to memory of 1380 3836 32aa10810985d2bb73d515ca8dfd54bebd9e3b3696dd95b2ee2f76374283eb77.exe 32aa10810985d2bb73d515ca8dfd54bebd9e3b3696dd95b2ee2f76374283eb77.exe PID 3836 wrote to memory of 1380 3836 32aa10810985d2bb73d515ca8dfd54bebd9e3b3696dd95b2ee2f76374283eb77.exe 32aa10810985d2bb73d515ca8dfd54bebd9e3b3696dd95b2ee2f76374283eb77.exe PID 3836 wrote to memory of 1380 3836 32aa10810985d2bb73d515ca8dfd54bebd9e3b3696dd95b2ee2f76374283eb77.exe 32aa10810985d2bb73d515ca8dfd54bebd9e3b3696dd95b2ee2f76374283eb77.exe PID 3836 wrote to memory of 1380 3836 32aa10810985d2bb73d515ca8dfd54bebd9e3b3696dd95b2ee2f76374283eb77.exe 32aa10810985d2bb73d515ca8dfd54bebd9e3b3696dd95b2ee2f76374283eb77.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\32aa10810985d2bb73d515ca8dfd54bebd9e3b3696dd95b2ee2f76374283eb77.exe"C:\Users\Admin\AppData\Local\Temp\32aa10810985d2bb73d515ca8dfd54bebd9e3b3696dd95b2ee2f76374283eb77.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\32aa10810985d2bb73d515ca8dfd54bebd9e3b3696dd95b2ee2f76374283eb77.exe"C:\Users\Admin\AppData\Local\Temp\32aa10810985d2bb73d515ca8dfd54bebd9e3b3696dd95b2ee2f76374283eb77.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1380-132-0x0000000000000000-mapping.dmp
-
memory/1380-133-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1380-136-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1380-137-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3836-134-0x000000000048D000-0x000000000049D000-memory.dmpFilesize
64KB
-
memory/3836-135-0x0000000002190000-0x0000000002199000-memory.dmpFilesize
36KB