Analysis
-
max time kernel
307s -
max time network
314s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
06-12-2022 04:42
Static task
static1
Behavioral task
behavioral1
Sample
678c3cb6321c1c53cbce223c051e6a2a9c197c1e5bdfb6b6509d24a2cf16e61f.exe
Resource
win10v2004-20221111-en
General
-
Target
678c3cb6321c1c53cbce223c051e6a2a9c197c1e5bdfb6b6509d24a2cf16e61f.exe
-
Size
274KB
-
MD5
d95b0eb0faf68ca64b35d208d8d5742b
-
SHA1
b26101b79b9d6baee13e2f18e111dac86bcd3137
-
SHA256
678c3cb6321c1c53cbce223c051e6a2a9c197c1e5bdfb6b6509d24a2cf16e61f
-
SHA512
7fab2e2e6537d0b2e53ef8b6c07a10b842725358960739ca82a1b83fd30d5699a62446a184e6eb774550fab0a210e568ad908f3c97c812de74cb12489178edba
-
SSDEEP
3072:CxXVhAYG3R3bcdlrCWR5aYIomc454wVbfFV1tFjlz9oafiVRvJTcpfaVtOYgV2qI:CVLdlrSYuVjV1tFF9oafIDcBVS
Malware Config
Signatures
-
Detects Smokeloader packer 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2488-133-0x00000000004E0000-0x00000000004E9000-memory.dmp family_smokeloader behavioral1/memory/3228-135-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/3228-137-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/3228-138-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
678c3cb6321c1c53cbce223c051e6a2a9c197c1e5bdfb6b6509d24a2cf16e61f.exedescription pid process target process PID 2488 set thread context of 3228 2488 678c3cb6321c1c53cbce223c051e6a2a9c197c1e5bdfb6b6509d24a2cf16e61f.exe 678c3cb6321c1c53cbce223c051e6a2a9c197c1e5bdfb6b6509d24a2cf16e61f.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
678c3cb6321c1c53cbce223c051e6a2a9c197c1e5bdfb6b6509d24a2cf16e61f.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 678c3cb6321c1c53cbce223c051e6a2a9c197c1e5bdfb6b6509d24a2cf16e61f.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 678c3cb6321c1c53cbce223c051e6a2a9c197c1e5bdfb6b6509d24a2cf16e61f.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 678c3cb6321c1c53cbce223c051e6a2a9c197c1e5bdfb6b6509d24a2cf16e61f.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
678c3cb6321c1c53cbce223c051e6a2a9c197c1e5bdfb6b6509d24a2cf16e61f.exepid process 3228 678c3cb6321c1c53cbce223c051e6a2a9c197c1e5bdfb6b6509d24a2cf16e61f.exe 3228 678c3cb6321c1c53cbce223c051e6a2a9c197c1e5bdfb6b6509d24a2cf16e61f.exe 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 1936 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1936 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
678c3cb6321c1c53cbce223c051e6a2a9c197c1e5bdfb6b6509d24a2cf16e61f.exepid process 3228 678c3cb6321c1c53cbce223c051e6a2a9c197c1e5bdfb6b6509d24a2cf16e61f.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 1936 Token: SeCreatePagefilePrivilege 1936 -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
678c3cb6321c1c53cbce223c051e6a2a9c197c1e5bdfb6b6509d24a2cf16e61f.exedescription pid process target process PID 2488 wrote to memory of 3228 2488 678c3cb6321c1c53cbce223c051e6a2a9c197c1e5bdfb6b6509d24a2cf16e61f.exe 678c3cb6321c1c53cbce223c051e6a2a9c197c1e5bdfb6b6509d24a2cf16e61f.exe PID 2488 wrote to memory of 3228 2488 678c3cb6321c1c53cbce223c051e6a2a9c197c1e5bdfb6b6509d24a2cf16e61f.exe 678c3cb6321c1c53cbce223c051e6a2a9c197c1e5bdfb6b6509d24a2cf16e61f.exe PID 2488 wrote to memory of 3228 2488 678c3cb6321c1c53cbce223c051e6a2a9c197c1e5bdfb6b6509d24a2cf16e61f.exe 678c3cb6321c1c53cbce223c051e6a2a9c197c1e5bdfb6b6509d24a2cf16e61f.exe PID 2488 wrote to memory of 3228 2488 678c3cb6321c1c53cbce223c051e6a2a9c197c1e5bdfb6b6509d24a2cf16e61f.exe 678c3cb6321c1c53cbce223c051e6a2a9c197c1e5bdfb6b6509d24a2cf16e61f.exe PID 2488 wrote to memory of 3228 2488 678c3cb6321c1c53cbce223c051e6a2a9c197c1e5bdfb6b6509d24a2cf16e61f.exe 678c3cb6321c1c53cbce223c051e6a2a9c197c1e5bdfb6b6509d24a2cf16e61f.exe PID 2488 wrote to memory of 3228 2488 678c3cb6321c1c53cbce223c051e6a2a9c197c1e5bdfb6b6509d24a2cf16e61f.exe 678c3cb6321c1c53cbce223c051e6a2a9c197c1e5bdfb6b6509d24a2cf16e61f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\678c3cb6321c1c53cbce223c051e6a2a9c197c1e5bdfb6b6509d24a2cf16e61f.exe"C:\Users\Admin\AppData\Local\Temp\678c3cb6321c1c53cbce223c051e6a2a9c197c1e5bdfb6b6509d24a2cf16e61f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\678c3cb6321c1c53cbce223c051e6a2a9c197c1e5bdfb6b6509d24a2cf16e61f.exe"C:\Users\Admin\AppData\Local\Temp\678c3cb6321c1c53cbce223c051e6a2a9c197c1e5bdfb6b6509d24a2cf16e61f.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2488-132-0x00000000005E8000-0x00000000005F9000-memory.dmpFilesize
68KB
-
memory/2488-133-0x00000000004E0000-0x00000000004E9000-memory.dmpFilesize
36KB
-
memory/2488-136-0x00000000005E8000-0x00000000005F9000-memory.dmpFilesize
68KB
-
memory/3228-134-0x0000000000000000-mapping.dmp
-
memory/3228-135-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3228-137-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3228-138-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB