Overview

overview

10

Static

static

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Resubmissions

12-12-2022 20:14

221212-y1gn2sfc5t 10

12-12-2022 15:35

221212-s1ddqsbg26 10

Analysis

  • max time kernel
    83s
  • max time network
    85s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-12-2022 20:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    file.exe

  • Size

    238KB

  • MD5

    968905a62a1aaff517ec51a0f86b06d7

  • SHA1

    d2baea0842e6df4f8a1924cc1c1efdd48c24fadb

  • SHA256

    65baf6f97e9206c572b743fb7eadc5ddf9adc3fbb5857c73ae2b4b77affc7b72

  • SHA512

    aa248fb6a89c216ba93a1c63d07532552874be8ada65674c9b9c606400cac1963ee48e9ae7716e72549c847c4e07db2f13b1011ed4a54ff8fe60bc0ecac94406

  • SSDEEP

    3072:7+5WLzpe327C9OJr5qK9pnTqObiFKrpJadvohdBcf0E0OTkRbR8pgX:hLzD7C9Oykpn/iFMp6voyftmcpgX

Score
10/10
smokeloaderbackdoortrojan

Malware Config

Signatures

  • Detects Smokeloader packer 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 56 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 33 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:4788
  • C:\Users\Admin\AppData\Local\Temp\80D8.exe
    C:\Users\Admin\AppData\Local\Temp\80D8.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:256
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Uyieweaiht.tmp",Hfesyte
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      PID:4060
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 256 -s 528
      2⤵
      • Program crash
      PID:1256
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 256 -ip 256
    1⤵
      PID:3588

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\80D8.exe
      Filesize

      1.1MB

      MD5

      f3b54e24459543e105886a9b77f35687

      SHA1

      d57ecd8bb3f125e746d560c3a60b0419dc5f9561

      SHA256

      13a939f3a6ca83fa6f8b7d412f181e15767f68adeafa6c2379ceddbe59000e81

      SHA512

      a5c709632d222ae517820809702bce36905df627217d5ffbd60cf49e8bda5891deb2d913ed27b029dcfa187849537c7c71f619e547970ecad1acb7c842617be5

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\80D8.exe
      Filesize

      1.1MB

      MD5

      f3b54e24459543e105886a9b77f35687

      SHA1

      d57ecd8bb3f125e746d560c3a60b0419dc5f9561

      SHA256

      13a939f3a6ca83fa6f8b7d412f181e15767f68adeafa6c2379ceddbe59000e81

      SHA512

      a5c709632d222ae517820809702bce36905df627217d5ffbd60cf49e8bda5891deb2d913ed27b029dcfa187849537c7c71f619e547970ecad1acb7c842617be5

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\Uyieweaiht.tmp
      Filesize

      788KB

      MD5

      8e37ae196e2cdea4dbc44dc99a84a80f

      SHA1

      b81e6a81a6efe6f44a0edd73ef3b8635b8ae3a0e

      SHA256

      f61cae9301f5336f9048c1b7e68eab13bb839f63925bc6625f8e7e20f32f00c6

      SHA512

      fbb1418cab570e6e4e375da3dd99616add73576da1ace88a44adc57a39a6911dab2e3e150366cc7b662604859e6ede53b2a9f2876afe14a0b5e0ea7b7db75e41

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\Uyieweaiht.tmp
      Filesize

      788KB

      MD5

      8e37ae196e2cdea4dbc44dc99a84a80f

      SHA1

      b81e6a81a6efe6f44a0edd73ef3b8635b8ae3a0e

      SHA256

      f61cae9301f5336f9048c1b7e68eab13bb839f63925bc6625f8e7e20f32f00c6

      SHA512

      fbb1418cab570e6e4e375da3dd99616add73576da1ace88a44adc57a39a6911dab2e3e150366cc7b662604859e6ede53b2a9f2876afe14a0b5e0ea7b7db75e41

      Download Submit
    • memory/256-141-0x0000000000400000-0x0000000000532000-memory.dmp
      Filesize

      1.2MB

      Download
    • memory/256-136-0x0000000000000000-mapping.dmp
      Download
    • memory/256-139-0x000000000061C000-0x0000000000704000-memory.dmp
      Filesize

      928KB

      Download
    • memory/256-140-0x00000000022A0000-0x00000000023C9000-memory.dmp
      Filesize

      1.2MB

      Download
    • memory/256-145-0x0000000000400000-0x0000000000532000-memory.dmp
      Filesize

      1.2MB

      Download
    • memory/4060-142-0x0000000000000000-mapping.dmp
      Download
    • memory/4788-135-0x0000000000400000-0x0000000000459000-memory.dmp
      Filesize

      356KB

      Download
    • memory/4788-132-0x0000000000773000-0x0000000000783000-memory.dmp
      Filesize

      64KB

      Download
    • memory/4788-134-0x0000000000400000-0x0000000000459000-memory.dmp
      Filesize

      356KB

      Download
    • memory/4788-133-0x00000000001F0000-0x00000000001F9000-memory.dmp
      Filesize

      36KB

      Download