Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
06-12-2022 06:33
Static task
static1
Behavioral task
behavioral1
Sample
c4bac936dd869e9c00b5d11d10581ddfefff568289c1d7a3829a901c03af8702.exe
Resource
win10v2004-20220901-en
General
-
Target
c4bac936dd869e9c00b5d11d10581ddfefff568289c1d7a3829a901c03af8702.exe
-
Size
320KB
-
MD5
0dbb2387dd98920442a56e1dc00cfdf6
-
SHA1
a5f1e07897e3b20083bab3eec4e8dd4722226ab0
-
SHA256
c4bac936dd869e9c00b5d11d10581ddfefff568289c1d7a3829a901c03af8702
-
SHA512
211d094bbd4951378560d8376c3d3bf967039dd6f64727c7ea884af381096128f6c3b4d92d7e2fb1b8e69f2dc7088372c78fca61d6ae9d17ae2f1476f35484a9
-
SSDEEP
6144:rezBoyYPLkPmZBenMWGf6LtN88PqaWzQ+zF:rezCyiYPmZBZWGf6LtK8yE+zF
Malware Config
Signatures
-
Detects Smokeloader packer 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1432-135-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/5004-134-0x0000000000030000-0x0000000000039000-memory.dmp family_smokeloader behavioral1/memory/1432-136-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/1432-137-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
c4bac936dd869e9c00b5d11d10581ddfefff568289c1d7a3829a901c03af8702.exedescription pid process target process PID 5004 set thread context of 1432 5004 c4bac936dd869e9c00b5d11d10581ddfefff568289c1d7a3829a901c03af8702.exe c4bac936dd869e9c00b5d11d10581ddfefff568289c1d7a3829a901c03af8702.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
c4bac936dd869e9c00b5d11d10581ddfefff568289c1d7a3829a901c03af8702.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c4bac936dd869e9c00b5d11d10581ddfefff568289c1d7a3829a901c03af8702.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c4bac936dd869e9c00b5d11d10581ddfefff568289c1d7a3829a901c03af8702.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c4bac936dd869e9c00b5d11d10581ddfefff568289c1d7a3829a901c03af8702.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
c4bac936dd869e9c00b5d11d10581ddfefff568289c1d7a3829a901c03af8702.exepid process 1432 c4bac936dd869e9c00b5d11d10581ddfefff568289c1d7a3829a901c03af8702.exe 1432 c4bac936dd869e9c00b5d11d10581ddfefff568289c1d7a3829a901c03af8702.exe 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 2664 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2664 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
c4bac936dd869e9c00b5d11d10581ddfefff568289c1d7a3829a901c03af8702.exepid process 1432 c4bac936dd869e9c00b5d11d10581ddfefff568289c1d7a3829a901c03af8702.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
c4bac936dd869e9c00b5d11d10581ddfefff568289c1d7a3829a901c03af8702.exedescription pid process target process PID 5004 wrote to memory of 1432 5004 c4bac936dd869e9c00b5d11d10581ddfefff568289c1d7a3829a901c03af8702.exe c4bac936dd869e9c00b5d11d10581ddfefff568289c1d7a3829a901c03af8702.exe PID 5004 wrote to memory of 1432 5004 c4bac936dd869e9c00b5d11d10581ddfefff568289c1d7a3829a901c03af8702.exe c4bac936dd869e9c00b5d11d10581ddfefff568289c1d7a3829a901c03af8702.exe PID 5004 wrote to memory of 1432 5004 c4bac936dd869e9c00b5d11d10581ddfefff568289c1d7a3829a901c03af8702.exe c4bac936dd869e9c00b5d11d10581ddfefff568289c1d7a3829a901c03af8702.exe PID 5004 wrote to memory of 1432 5004 c4bac936dd869e9c00b5d11d10581ddfefff568289c1d7a3829a901c03af8702.exe c4bac936dd869e9c00b5d11d10581ddfefff568289c1d7a3829a901c03af8702.exe PID 5004 wrote to memory of 1432 5004 c4bac936dd869e9c00b5d11d10581ddfefff568289c1d7a3829a901c03af8702.exe c4bac936dd869e9c00b5d11d10581ddfefff568289c1d7a3829a901c03af8702.exe PID 5004 wrote to memory of 1432 5004 c4bac936dd869e9c00b5d11d10581ddfefff568289c1d7a3829a901c03af8702.exe c4bac936dd869e9c00b5d11d10581ddfefff568289c1d7a3829a901c03af8702.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4bac936dd869e9c00b5d11d10581ddfefff568289c1d7a3829a901c03af8702.exe"C:\Users\Admin\AppData\Local\Temp\c4bac936dd869e9c00b5d11d10581ddfefff568289c1d7a3829a901c03af8702.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c4bac936dd869e9c00b5d11d10581ddfefff568289c1d7a3829a901c03af8702.exe"C:\Users\Admin\AppData\Local\Temp\c4bac936dd869e9c00b5d11d10581ddfefff568289c1d7a3829a901c03af8702.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1432-132-0x0000000000000000-mapping.dmp
-
memory/1432-135-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1432-136-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1432-137-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/5004-133-0x00000000006A2000-0x00000000006B7000-memory.dmpFilesize
84KB
-
memory/5004-134-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB