Analysis
-
max time kernel
151s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
06-12-2022 04:44
Static task
static1
Behavioral task
behavioral1
Sample
de97cb8ac270803038f51586f061bce7575a6df7c8f51087a2ba5654658fe8ff.exe
Resource
win10v2004-20220901-en
General
-
Target
de97cb8ac270803038f51586f061bce7575a6df7c8f51087a2ba5654658fe8ff.exe
-
Size
274KB
-
MD5
1f6c3ca67c5c8ba25586cf3dcfc092fa
-
SHA1
0b890781827011488566dd24a01fecdf81bba422
-
SHA256
de97cb8ac270803038f51586f061bce7575a6df7c8f51087a2ba5654658fe8ff
-
SHA512
4ef443e2fe5b652bd38dadbe1d9208267f20eb45c0dac9a600bf00b4a92e08f1f06be81a6f42659de83ee72efc5d8c81769e888ce77d7f5e15df1b45d0442552
-
SSDEEP
6144:4t7d2ssmt1pcsMuDauZnvnGwIDcy1CtVS:4t52EtFMuDrZn/QDcoCtVS
Malware Config
Signatures
-
Detects Smokeloader packer 4 IoCs
Processes:
resource yara_rule behavioral1/memory/384-133-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/3796-135-0x00000000004B0000-0x00000000004B9000-memory.dmp family_smokeloader behavioral1/memory/384-136-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/384-137-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
de97cb8ac270803038f51586f061bce7575a6df7c8f51087a2ba5654658fe8ff.exedescription pid process target process PID 3796 set thread context of 384 3796 de97cb8ac270803038f51586f061bce7575a6df7c8f51087a2ba5654658fe8ff.exe de97cb8ac270803038f51586f061bce7575a6df7c8f51087a2ba5654658fe8ff.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
de97cb8ac270803038f51586f061bce7575a6df7c8f51087a2ba5654658fe8ff.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI de97cb8ac270803038f51586f061bce7575a6df7c8f51087a2ba5654658fe8ff.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI de97cb8ac270803038f51586f061bce7575a6df7c8f51087a2ba5654658fe8ff.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI de97cb8ac270803038f51586f061bce7575a6df7c8f51087a2ba5654658fe8ff.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
de97cb8ac270803038f51586f061bce7575a6df7c8f51087a2ba5654658fe8ff.exepid process 384 de97cb8ac270803038f51586f061bce7575a6df7c8f51087a2ba5654658fe8ff.exe 384 de97cb8ac270803038f51586f061bce7575a6df7c8f51087a2ba5654658fe8ff.exe 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 2440 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2440 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
de97cb8ac270803038f51586f061bce7575a6df7c8f51087a2ba5654658fe8ff.exepid process 384 de97cb8ac270803038f51586f061bce7575a6df7c8f51087a2ba5654658fe8ff.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
de97cb8ac270803038f51586f061bce7575a6df7c8f51087a2ba5654658fe8ff.exedescription pid process target process PID 3796 wrote to memory of 384 3796 de97cb8ac270803038f51586f061bce7575a6df7c8f51087a2ba5654658fe8ff.exe de97cb8ac270803038f51586f061bce7575a6df7c8f51087a2ba5654658fe8ff.exe PID 3796 wrote to memory of 384 3796 de97cb8ac270803038f51586f061bce7575a6df7c8f51087a2ba5654658fe8ff.exe de97cb8ac270803038f51586f061bce7575a6df7c8f51087a2ba5654658fe8ff.exe PID 3796 wrote to memory of 384 3796 de97cb8ac270803038f51586f061bce7575a6df7c8f51087a2ba5654658fe8ff.exe de97cb8ac270803038f51586f061bce7575a6df7c8f51087a2ba5654658fe8ff.exe PID 3796 wrote to memory of 384 3796 de97cb8ac270803038f51586f061bce7575a6df7c8f51087a2ba5654658fe8ff.exe de97cb8ac270803038f51586f061bce7575a6df7c8f51087a2ba5654658fe8ff.exe PID 3796 wrote to memory of 384 3796 de97cb8ac270803038f51586f061bce7575a6df7c8f51087a2ba5654658fe8ff.exe de97cb8ac270803038f51586f061bce7575a6df7c8f51087a2ba5654658fe8ff.exe PID 3796 wrote to memory of 384 3796 de97cb8ac270803038f51586f061bce7575a6df7c8f51087a2ba5654658fe8ff.exe de97cb8ac270803038f51586f061bce7575a6df7c8f51087a2ba5654658fe8ff.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\de97cb8ac270803038f51586f061bce7575a6df7c8f51087a2ba5654658fe8ff.exe"C:\Users\Admin\AppData\Local\Temp\de97cb8ac270803038f51586f061bce7575a6df7c8f51087a2ba5654658fe8ff.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\de97cb8ac270803038f51586f061bce7575a6df7c8f51087a2ba5654658fe8ff.exe"C:\Users\Admin\AppData\Local\Temp\de97cb8ac270803038f51586f061bce7575a6df7c8f51087a2ba5654658fe8ff.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/384-132-0x0000000000000000-mapping.dmp
-
memory/384-133-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/384-136-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/384-137-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3796-134-0x00000000004D8000-0x00000000004E9000-memory.dmpFilesize
68KB
-
memory/3796-135-0x00000000004B0000-0x00000000004B9000-memory.dmpFilesize
36KB