Analysis
-
max time kernel
153s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04-12-2022 02:50
Static task
static1
Behavioral task
behavioral1
Sample
79eb0de65e77c00a9574910ba6443770a37c872d9fc6865086f5ecfeed82e46e.exe
Resource
win7-20221111-en
General
-
Target
79eb0de65e77c00a9574910ba6443770a37c872d9fc6865086f5ecfeed82e46e.exe
-
Size
349KB
-
MD5
3c92e5261ce478c35357356eab2d02a6
-
SHA1
9621379903f13c177a2e53a0561a1b768a56ab59
-
SHA256
79eb0de65e77c00a9574910ba6443770a37c872d9fc6865086f5ecfeed82e46e
-
SHA512
5d48bb4e4e9915f7c3dcb394b8db743afd8e07bda0c4d6811168e770c9ea624d0f6f91f15904949a3fa2d069c343a62b2d7977780f29060d79d817a5fcd0ed4c
-
SSDEEP
6144:oOqIyHL+AiRYKRqtDfLKaHdMbPpwjaPuRjMgUt:o/7HsRY7hGauKRQg
Malware Config
Extracted
vidar
56
1148
https://t.me/asifrazatg
https://steamcommunity.com/profiles/76561199439929669
-
profile_id
1148
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3560-133-0x00000000001C0000-0x00000000001C9000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
E76D.exeE76D.exepid process 4740 E76D.exe 2416 E76D.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
E76D.exedescription pid process target process PID 4740 set thread context of 2416 4740 E76D.exe E76D.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2472 4740 WerFault.exe E76D.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
79eb0de65e77c00a9574910ba6443770a37c872d9fc6865086f5ecfeed82e46e.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 79eb0de65e77c00a9574910ba6443770a37c872d9fc6865086f5ecfeed82e46e.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 79eb0de65e77c00a9574910ba6443770a37c872d9fc6865086f5ecfeed82e46e.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 79eb0de65e77c00a9574910ba6443770a37c872d9fc6865086f5ecfeed82e46e.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
79eb0de65e77c00a9574910ba6443770a37c872d9fc6865086f5ecfeed82e46e.exepid process 3560 79eb0de65e77c00a9574910ba6443770a37c872d9fc6865086f5ecfeed82e46e.exe 3560 79eb0de65e77c00a9574910ba6443770a37c872d9fc6865086f5ecfeed82e46e.exe 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3092 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
79eb0de65e77c00a9574910ba6443770a37c872d9fc6865086f5ecfeed82e46e.exepid process 3560 79eb0de65e77c00a9574910ba6443770a37c872d9fc6865086f5ecfeed82e46e.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
E76D.exedescription pid process target process PID 3092 wrote to memory of 4740 3092 E76D.exe PID 3092 wrote to memory of 4740 3092 E76D.exe PID 3092 wrote to memory of 4740 3092 E76D.exe PID 4740 wrote to memory of 2416 4740 E76D.exe E76D.exe PID 4740 wrote to memory of 2416 4740 E76D.exe E76D.exe PID 4740 wrote to memory of 2416 4740 E76D.exe E76D.exe PID 4740 wrote to memory of 2416 4740 E76D.exe E76D.exe PID 4740 wrote to memory of 2416 4740 E76D.exe E76D.exe PID 4740 wrote to memory of 2416 4740 E76D.exe E76D.exe PID 4740 wrote to memory of 2416 4740 E76D.exe E76D.exe PID 4740 wrote to memory of 2416 4740 E76D.exe E76D.exe PID 4740 wrote to memory of 2416 4740 E76D.exe E76D.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\79eb0de65e77c00a9574910ba6443770a37c872d9fc6865086f5ecfeed82e46e.exe"C:\Users\Admin\AppData\Local\Temp\79eb0de65e77c00a9574910ba6443770a37c872d9fc6865086f5ecfeed82e46e.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\E76D.exeC:\Users\Admin\AppData\Local\Temp\E76D.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\E76D.exe"C:\Users\Admin\AppData\Local\Temp\E76D.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 2562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4740 -ip 47401⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\E76D.exeFilesize
401KB
MD537980aee9719695d908aa93cfe0b41a0
SHA1643d6b8bb8a38187711b6fe8a16806debd274c68
SHA25633b318b9a8752c39d56c842ee1d82dc01ee6f495ff7304f1ed81da18bacdcda0
SHA5126b7add23631f303387de82357c9fa29ba4f7deec184b18e58123d172ae6afdefd19cf4d336c16ed4e5c561e55a2420b65d34ddae00c69ea555ef428f5cfd0261
-
C:\Users\Admin\AppData\Local\Temp\E76D.exeFilesize
401KB
MD537980aee9719695d908aa93cfe0b41a0
SHA1643d6b8bb8a38187711b6fe8a16806debd274c68
SHA25633b318b9a8752c39d56c842ee1d82dc01ee6f495ff7304f1ed81da18bacdcda0
SHA5126b7add23631f303387de82357c9fa29ba4f7deec184b18e58123d172ae6afdefd19cf4d336c16ed4e5c561e55a2420b65d34ddae00c69ea555ef428f5cfd0261
-
C:\Users\Admin\AppData\Local\Temp\E76D.exeFilesize
401KB
MD537980aee9719695d908aa93cfe0b41a0
SHA1643d6b8bb8a38187711b6fe8a16806debd274c68
SHA25633b318b9a8752c39d56c842ee1d82dc01ee6f495ff7304f1ed81da18bacdcda0
SHA5126b7add23631f303387de82357c9fa29ba4f7deec184b18e58123d172ae6afdefd19cf4d336c16ed4e5c561e55a2420b65d34ddae00c69ea555ef428f5cfd0261
-
memory/2416-139-0x0000000000000000-mapping.dmp
-
memory/2416-140-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/2416-142-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/2416-143-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/2416-144-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/3560-135-0x0000000000400000-0x000000000045D000-memory.dmpFilesize
372KB
-
memory/3560-134-0x0000000000400000-0x000000000045D000-memory.dmpFilesize
372KB
-
memory/3560-133-0x00000000001C0000-0x00000000001C9000-memory.dmpFilesize
36KB
-
memory/3560-132-0x0000000000507000-0x000000000051D000-memory.dmpFilesize
88KB
-
memory/4740-136-0x0000000000000000-mapping.dmp