Analysis
- max time kernel
193s - max time network
199s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
- submitted
06/12/2022, 05:41
General
- Target file.exe
- Size 320KB
- Sample221206-gde39shf49
- SHA256 3549d76fa5cba791831358a7a034dd7b1dde1d30c654ab2d45a824dfd8cefc08
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Blocklisted process makes network request 1 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Program crash 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\5E96.exeC:\Users\Admin\AppData\Local\Temp\5E96.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Eshwsfeuryqqffi.tmp",Qiysidaatietut2⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 5482⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2380 -ip 23801⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
5E96.exe
5E96.exe
Eshwsfeuryqqffi.tmp
Eshwsfeuryqqffi.tmp
memory/2380-168-0x0000000000400000-0x0000000000522000-memory.dmp
memory/2380-164-0x0000000000400000-0x0000000000522000-memory.dmp
memory/2380-163-0x0000000000930000-0x0000000000A50000-memory.dmp
memory/2380-162-0x00000000007C2000-0x00000000008A1000-memory.dmp
memory/2644-147-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-179-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-144-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-145-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-146-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-191-0x00000000033F0000-0x0000000003400000-memory.dmp
memory/2644-148-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-149-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-150-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-151-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-152-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-153-0x00000000030D0000-0x00000000030E0000-memory.dmp
memory/2644-154-0x00000000030F0000-0x0000000003100000-memory.dmp
memory/2644-155-0x00000000030F0000-0x0000000003100000-memory.dmp
memory/2644-156-0x00000000030F0000-0x0000000003100000-memory.dmp
memory/2644-157-0x00000000030F0000-0x0000000003100000-memory.dmp
memory/2644-158-0x00000000030F0000-0x0000000003100000-memory.dmp
memory/2644-142-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-141-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-140-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-139-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-138-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-137-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-136-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-190-0x00000000033F0000-0x0000000003400000-memory.dmp
memory/2644-189-0x00000000033E0000-0x00000000033F0000-memory.dmp
memory/2644-188-0x00000000033F0000-0x0000000003400000-memory.dmp
memory/2644-169-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-170-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-172-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-173-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-171-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-174-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-175-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-176-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-177-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-178-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-143-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-180-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-181-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-182-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-183-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-184-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-185-0x00000000030C0000-0x00000000030D0000-memory.dmp
memory/2644-186-0x00000000033E0000-0x00000000033F0000-memory.dmp
memory/2644-187-0x00000000033F0000-0x0000000003400000-memory.dmp
memory/4288-133-0x0000000000030000-0x0000000000039000-memory.dmp
memory/4288-134-0x0000000000400000-0x0000000000455000-memory.dmp
memory/4288-135-0x0000000000400000-0x0000000000455000-memory.dmp
memory/4288-132-0x0000000000593000-0x00000000005A9000-memory.dmp