Analysis
- max time kernel
180s - max time network
193s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
02/12/2022, 01:39
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20221111-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target file.exe
- Size 192KB
- Sample221202-b2z6fsef7w
- SHA256 a1262ba069d6bf2d8569a43a4387f8423547f6f704f873ff08a3ee49f9e026cc
- MD5 a1ecf380c9a58b950c629901a6328d29
- SHA1 1272d0565df66e6d58c7374368d0b5d3acf2be3a
- SHA512 9c42cfeee5ae1304bab671eb381bb0499f9546bf3dc14c15da8c671f4487faed138416b7edae035cba5678224cabbc8159dd5c39c499a2f469047843a83e420f
- SSDEEP 3072:9BPie3ee817I5mAYTwKdYMdnvHjW3BsnlhmD2zqTDRs9E3AZxpR/nIlSFYc:CC81EYEKdYMpSqHmiAOvpxnFY
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 2 IoCs
resource yara_rule behavioral2/memory/1764-133-0x00000000005B0000-0x00000000005B9000-memory.dmp family_smokeloader behavioral2/memory/1764-136-0x00000000005B0000-0x00000000005B9000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Blocklisted process makes network request 3 IoCs
flow pid Process 115 4180 rundll32.exe 116 4180 rundll32.exe 122 4180 rundll32.exe - Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
pid Process 2516 9ED0.exe - Loads dropped DLL 2 IoCs
pid Process 4180 rundll32.exe 4180 rundll32.exe - Program crash 1 IoCs
pid pid_target Process procid_target 2300 2516 WerFault.exe 85 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1764 file.exe 1764 file.exe 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2584 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1764 file.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeShutdownPrivilege 2584 Process not Found Token: SeCreatePagefilePrivilege 2584 Process not Found Token: SeShutdownPrivilege 2584 Process not Found Token: SeCreatePagefilePrivilege 2584 Process not Found Token: SeShutdownPrivilege 2584 Process not Found Token: SeCreatePagefilePrivilege 2584 Process not Found Token: SeShutdownPrivilege 2584 Process not Found Token: SeCreatePagefilePrivilege 2584 Process not Found Token: SeShutdownPrivilege 2584 Process not Found Token: SeCreatePagefilePrivilege 2584 Process not Found Token: SeShutdownPrivilege 2584 Process not Found Token: SeCreatePagefilePrivilege 2584 Process not Found - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2584 Process not Found 2584 Process not Found - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2584 wrote to memory of 2516 2584 Process not Found 85 PID 2584 wrote to memory of 2516 2584 Process not Found 85 PID 2584 wrote to memory of 2516 2584 Process not Found 85 PID 2516 wrote to memory of 4180 2516 9ED0.exe 86 PID 2516 wrote to memory of 4180 2516 9ED0.exe 86 PID 2516 wrote to memory of 4180 2516 9ED0.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1764
-
C:\Users\Admin\AppData\Local\Temp\9ED0.exeC:\Users\Admin\AppData\Local\Temp\9ED0.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Iqirrhrfhqh.dll,start2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:4180
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 4802⤵
- Program crash
PID:2300
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2516 -ip 25161⤵PID:1844
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\9ED0.exe
- Size 3.7MB
- SHA256 179c091d5ed7494f364c90b7d9fc3b9183d530e0633d8bf4e4c5ef067f761dcf
- MD5 b125c39077ee4699f28e05ec064d0945
- SHA1 8be18ded98b52b2455bee21fa4fcac928e0d0596
- SHA512 1847fa4c1d63036dc58d9b49a722a367368cab490a3a9683e580a7c957cb0324a20ed147809b9afb5e7d9f5a18708bb5454c29abd1bc6ebd34529e5d78b507c5
- SSDEEP 98304:rZddKa3voTUrWtUt+26AlkONZCF8kJLE+lrcu70UUQnv+8:rjd9MytTTpkVR66h
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\9ED0.exe
- Size 3.7MB
- SHA256 179c091d5ed7494f364c90b7d9fc3b9183d530e0633d8bf4e4c5ef067f761dcf
- MD5 b125c39077ee4699f28e05ec064d0945
- SHA1 8be18ded98b52b2455bee21fa4fcac928e0d0596
- SHA512 1847fa4c1d63036dc58d9b49a722a367368cab490a3a9683e580a7c957cb0324a20ed147809b9afb5e7d9f5a18708bb5454c29abd1bc6ebd34529e5d78b507c5
- SSDEEP 98304:rZddKa3voTUrWtUt+26AlkONZCF8kJLE+lrcu70UUQnv+8:rjd9MytTTpkVR66h
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Iqirrhrfhqh.dll
- Size 4.3MB
- SHA256 b7da91a527595f516a6b16b21a0ebada1bbe32ec3fec7ec4d22ce4ceaf338471
- MD5 ea19805b9c32195864c29d173b293447
- SHA1 e3f4d5dd03348f3256373a1a06acfc0f3dc0a0d3
- SHA512 8b73182e0f59e5c80075bb65bbf9bd26ef6e10e5c3a1fb9822755cc61f28f1aea6173ed9d72eccacabf04e87c0709f8144342f6a9515c22fd242f7f89c5fb424
- SSDEEP 98304:XiJLYXWlvCGLd8P47P8WBa1FsAREwlHFbzL:yJEX4CGLK47P+F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Iqirrhrfhqh.dll
- Size 4.3MB
- SHA256 b7da91a527595f516a6b16b21a0ebada1bbe32ec3fec7ec4d22ce4ceaf338471
- MD5 ea19805b9c32195864c29d173b293447
- SHA1 e3f4d5dd03348f3256373a1a06acfc0f3dc0a0d3
- SHA512 8b73182e0f59e5c80075bb65bbf9bd26ef6e10e5c3a1fb9822755cc61f28f1aea6173ed9d72eccacabf04e87c0709f8144342f6a9515c22fd242f7f89c5fb424
- SSDEEP 98304:XiJLYXWlvCGLd8P47P8WBa1FsAREwlHFbzL:yJEX4CGLK47P+F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Iqirrhrfhqh.dll
- Size 4.3MB
- SHA256 b7da91a527595f516a6b16b21a0ebada1bbe32ec3fec7ec4d22ce4ceaf338471
- MD5 ea19805b9c32195864c29d173b293447
- SHA1 e3f4d5dd03348f3256373a1a06acfc0f3dc0a0d3
- SHA512 8b73182e0f59e5c80075bb65bbf9bd26ef6e10e5c3a1fb9822755cc61f28f1aea6173ed9d72eccacabf04e87c0709f8144342f6a9515c22fd242f7f89c5fb424
- SSDEEP 98304:XiJLYXWlvCGLd8P47P8WBa1FsAREwlHFbzL:yJEX4CGLK47P+F
- MD5 SHA1 SHA512 SSDEEP