Analysis
-
max time kernel
152s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06-12-2022 03:27
Static task
static1
Behavioral task
behavioral1
Sample
e28cace4d5d2f8adf94c1795486afcd8264503ccae22901eb5b083f4b742a3a1.exe
Resource
win10v2004-20220812-en
General
-
Target
e28cace4d5d2f8adf94c1795486afcd8264503ccae22901eb5b083f4b742a3a1.exe
-
Size
274KB
-
MD5
3e03483592fc5f2853b6b05b295ca120
-
SHA1
1f29c5a265b1f228c0f1529377beb591d26681a1
-
SHA256
e28cace4d5d2f8adf94c1795486afcd8264503ccae22901eb5b083f4b742a3a1
-
SHA512
4aa0ce0a3725ac5c6edff0ac23d0b7aa6b9ead932ec463f83b17d51198d3ebc9fb19a79da94ee93853efd64f2e659a68f6d51772345df46853d7aaf0e68b9925
-
SSDEEP
3072:/JXVF6Yjy0WhRMI9LBWR5Q8iM1sgT9x7IvPP+PyE+sixFY0NiVRvJTcpTf8p2yNp:/ticI9LSR9RnPyLsiFNIDc1kp2acVS
Malware Config
Signatures
-
Detects Smokeloader packer 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1400-133-0x00000000004B0000-0x00000000004B9000-memory.dmp family_smokeloader behavioral1/memory/4416-135-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/4416-137-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/4416-138-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/4684-145-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/4684-146-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 2 IoCs
Processes:
hrasbvthrasbvtpid process 4412 hrasbvt 4684 hrasbvt -
Suspicious use of SetThreadContext 2 IoCs
Processes:
e28cace4d5d2f8adf94c1795486afcd8264503ccae22901eb5b083f4b742a3a1.exehrasbvtdescription pid process target process PID 1400 set thread context of 4416 1400 e28cace4d5d2f8adf94c1795486afcd8264503ccae22901eb5b083f4b742a3a1.exe e28cace4d5d2f8adf94c1795486afcd8264503ccae22901eb5b083f4b742a3a1.exe PID 4412 set thread context of 4684 4412 hrasbvt hrasbvt -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
hrasbvte28cace4d5d2f8adf94c1795486afcd8264503ccae22901eb5b083f4b742a3a1.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hrasbvt Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e28cace4d5d2f8adf94c1795486afcd8264503ccae22901eb5b083f4b742a3a1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e28cace4d5d2f8adf94c1795486afcd8264503ccae22901eb5b083f4b742a3a1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e28cace4d5d2f8adf94c1795486afcd8264503ccae22901eb5b083f4b742a3a1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hrasbvt Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hrasbvt -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e28cace4d5d2f8adf94c1795486afcd8264503ccae22901eb5b083f4b742a3a1.exepid process 4416 e28cace4d5d2f8adf94c1795486afcd8264503ccae22901eb5b083f4b742a3a1.exe 4416 e28cace4d5d2f8adf94c1795486afcd8264503ccae22901eb5b083f4b742a3a1.exe 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3032 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
e28cace4d5d2f8adf94c1795486afcd8264503ccae22901eb5b083f4b742a3a1.exehrasbvtpid process 4416 e28cace4d5d2f8adf94c1795486afcd8264503ccae22901eb5b083f4b742a3a1.exe 4684 hrasbvt -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 3032 Token: SeCreatePagefilePrivilege 3032 -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
e28cace4d5d2f8adf94c1795486afcd8264503ccae22901eb5b083f4b742a3a1.exehrasbvtdescription pid process target process PID 1400 wrote to memory of 4416 1400 e28cace4d5d2f8adf94c1795486afcd8264503ccae22901eb5b083f4b742a3a1.exe e28cace4d5d2f8adf94c1795486afcd8264503ccae22901eb5b083f4b742a3a1.exe PID 1400 wrote to memory of 4416 1400 e28cace4d5d2f8adf94c1795486afcd8264503ccae22901eb5b083f4b742a3a1.exe e28cace4d5d2f8adf94c1795486afcd8264503ccae22901eb5b083f4b742a3a1.exe PID 1400 wrote to memory of 4416 1400 e28cace4d5d2f8adf94c1795486afcd8264503ccae22901eb5b083f4b742a3a1.exe e28cace4d5d2f8adf94c1795486afcd8264503ccae22901eb5b083f4b742a3a1.exe PID 1400 wrote to memory of 4416 1400 e28cace4d5d2f8adf94c1795486afcd8264503ccae22901eb5b083f4b742a3a1.exe e28cace4d5d2f8adf94c1795486afcd8264503ccae22901eb5b083f4b742a3a1.exe PID 1400 wrote to memory of 4416 1400 e28cace4d5d2f8adf94c1795486afcd8264503ccae22901eb5b083f4b742a3a1.exe e28cace4d5d2f8adf94c1795486afcd8264503ccae22901eb5b083f4b742a3a1.exe PID 1400 wrote to memory of 4416 1400 e28cace4d5d2f8adf94c1795486afcd8264503ccae22901eb5b083f4b742a3a1.exe e28cace4d5d2f8adf94c1795486afcd8264503ccae22901eb5b083f4b742a3a1.exe PID 4412 wrote to memory of 4684 4412 hrasbvt hrasbvt PID 4412 wrote to memory of 4684 4412 hrasbvt hrasbvt PID 4412 wrote to memory of 4684 4412 hrasbvt hrasbvt PID 4412 wrote to memory of 4684 4412 hrasbvt hrasbvt PID 4412 wrote to memory of 4684 4412 hrasbvt hrasbvt PID 4412 wrote to memory of 4684 4412 hrasbvt hrasbvt
Processes
-
C:\Users\Admin\AppData\Local\Temp\e28cace4d5d2f8adf94c1795486afcd8264503ccae22901eb5b083f4b742a3a1.exe"C:\Users\Admin\AppData\Local\Temp\e28cace4d5d2f8adf94c1795486afcd8264503ccae22901eb5b083f4b742a3a1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e28cace4d5d2f8adf94c1795486afcd8264503ccae22901eb5b083f4b742a3a1.exe"C:\Users\Admin\AppData\Local\Temp\e28cace4d5d2f8adf94c1795486afcd8264503ccae22901eb5b083f4b742a3a1.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\hrasbvtC:\Users\Admin\AppData\Roaming\hrasbvt1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\hrasbvtC:\Users\Admin\AppData\Roaming\hrasbvt2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\hrasbvtFilesize
274KB
MD53e03483592fc5f2853b6b05b295ca120
SHA11f29c5a265b1f228c0f1529377beb591d26681a1
SHA256e28cace4d5d2f8adf94c1795486afcd8264503ccae22901eb5b083f4b742a3a1
SHA5124aa0ce0a3725ac5c6edff0ac23d0b7aa6b9ead932ec463f83b17d51198d3ebc9fb19a79da94ee93853efd64f2e659a68f6d51772345df46853d7aaf0e68b9925
-
C:\Users\Admin\AppData\Roaming\hrasbvtFilesize
274KB
MD53e03483592fc5f2853b6b05b295ca120
SHA11f29c5a265b1f228c0f1529377beb591d26681a1
SHA256e28cace4d5d2f8adf94c1795486afcd8264503ccae22901eb5b083f4b742a3a1
SHA5124aa0ce0a3725ac5c6edff0ac23d0b7aa6b9ead932ec463f83b17d51198d3ebc9fb19a79da94ee93853efd64f2e659a68f6d51772345df46853d7aaf0e68b9925
-
C:\Users\Admin\AppData\Roaming\hrasbvtFilesize
274KB
MD53e03483592fc5f2853b6b05b295ca120
SHA11f29c5a265b1f228c0f1529377beb591d26681a1
SHA256e28cace4d5d2f8adf94c1795486afcd8264503ccae22901eb5b083f4b742a3a1
SHA5124aa0ce0a3725ac5c6edff0ac23d0b7aa6b9ead932ec463f83b17d51198d3ebc9fb19a79da94ee93853efd64f2e659a68f6d51772345df46853d7aaf0e68b9925
-
memory/1400-133-0x00000000004B0000-0x00000000004B9000-memory.dmpFilesize
36KB
-
memory/1400-136-0x00000000004F8000-0x0000000000509000-memory.dmpFilesize
68KB
-
memory/1400-132-0x00000000004F8000-0x0000000000509000-memory.dmpFilesize
68KB
-
memory/4412-144-0x00000000007A8000-0x00000000007B8000-memory.dmpFilesize
64KB
-
memory/4416-138-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4416-137-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4416-135-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4416-134-0x0000000000000000-mapping.dmp
-
memory/4684-141-0x0000000000000000-mapping.dmp
-
memory/4684-145-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4684-146-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB