Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
20/12/2022, 13:55
Static task
static1
Behavioral task
behavioral1
Sample
a2a56847c92e2742c52820dd151144878df54d947725c737e94332857b88c581.exe
Resource
win10-20220812-en
General
-
Target
a2a56847c92e2742c52820dd151144878df54d947725c737e94332857b88c581.exe
-
Size
214KB
-
MD5
9ac92f2a0c65c0ef8577af9f7ce31bf5
-
SHA1
1a00e61a3b11d82ccfa26fdcc297bcec9c04da46
-
SHA256
a2a56847c92e2742c52820dd151144878df54d947725c737e94332857b88c581
-
SHA512
e5594fdd7aae6dec4d92a16fe47e53068427c4af711321f18bca8d9d756544dce9598b010a8435a9074c95efab974f5a41e7d2c48f5debe4913b88eaab22d3dc
-
SSDEEP
3072:NALLoo7R3C/pSGzGoJTrfOUL7PWz7b/tFdwpKWRNHCDml:aLoxhBTrfOWDWjLdwpKkCa
Malware Config
Extracted
systembc
109.205.214.18:443
Signatures
-
Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral1/memory/2404-141-0x00000000005D0000-0x00000000005D9000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
pid Process 4464 2F9.exe 3480 wpxpdt.exe -
Deletes itself 1 IoCs
pid Process 3104 Process not Found -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Tasks\wpxpdt.job 2F9.exe File opened for modification C:\Windows\Tasks\wpxpdt.job 2F9.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a2a56847c92e2742c52820dd151144878df54d947725c737e94332857b88c581.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a2a56847c92e2742c52820dd151144878df54d947725c737e94332857b88c581.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a2a56847c92e2742c52820dd151144878df54d947725c737e94332857b88c581.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2404 a2a56847c92e2742c52820dd151144878df54d947725c737e94332857b88c581.exe 2404 a2a56847c92e2742c52820dd151144878df54d947725c737e94332857b88c581.exe 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found 3104 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3104 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2404 a2a56847c92e2742c52820dd151144878df54d947725c737e94332857b88c581.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 3104 Process not Found Token: SeCreatePagefilePrivilege 3104 Process not Found Token: SeShutdownPrivilege 3104 Process not Found Token: SeCreatePagefilePrivilege 3104 Process not Found -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3104 wrote to memory of 4464 3104 Process not Found 66 PID 3104 wrote to memory of 4464 3104 Process not Found 66 PID 3104 wrote to memory of 4464 3104 Process not Found 66
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2a56847c92e2742c52820dd151144878df54d947725c737e94332857b88c581.exe"C:\Users\Admin\AppData\Local\Temp\a2a56847c92e2742c52820dd151144878df54d947725c737e94332857b88c581.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2404
-
C:\Users\Admin\AppData\Local\Temp\2F9.exeC:\Users\Admin\AppData\Local\Temp\2F9.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4464
-
C:\ProgramData\tlrlj\wpxpdt.exeC:\ProgramData\tlrlj\wpxpdt.exe start1⤵
- Executes dropped EXE
PID:3480
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
218KB
MD5cdc67700f25eaed1417264c4bdec03d3
SHA156639e9414e6ee8394d940d62778475ddf071290
SHA256fdd4cca0516be799c954e96be26b2d04e42ea0bac1edb00604412914bae2f100
SHA512a2b38a1d4d0cb57532f3feb2efa1fb345c03df9114dfb2dcc93286e19b96eb5e182bd79d070a0e4fccf1980f47effc9b511dbb0074bba69bee80098317e08038
-
Filesize
218KB
MD5cdc67700f25eaed1417264c4bdec03d3
SHA156639e9414e6ee8394d940d62778475ddf071290
SHA256fdd4cca0516be799c954e96be26b2d04e42ea0bac1edb00604412914bae2f100
SHA512a2b38a1d4d0cb57532f3feb2efa1fb345c03df9114dfb2dcc93286e19b96eb5e182bd79d070a0e4fccf1980f47effc9b511dbb0074bba69bee80098317e08038
-
Filesize
218KB
MD5cdc67700f25eaed1417264c4bdec03d3
SHA156639e9414e6ee8394d940d62778475ddf071290
SHA256fdd4cca0516be799c954e96be26b2d04e42ea0bac1edb00604412914bae2f100
SHA512a2b38a1d4d0cb57532f3feb2efa1fb345c03df9114dfb2dcc93286e19b96eb5e182bd79d070a0e4fccf1980f47effc9b511dbb0074bba69bee80098317e08038
-
Filesize
218KB
MD5cdc67700f25eaed1417264c4bdec03d3
SHA156639e9414e6ee8394d940d62778475ddf071290
SHA256fdd4cca0516be799c954e96be26b2d04e42ea0bac1edb00604412914bae2f100
SHA512a2b38a1d4d0cb57532f3feb2efa1fb345c03df9114dfb2dcc93286e19b96eb5e182bd79d070a0e4fccf1980f47effc9b511dbb0074bba69bee80098317e08038