Analysis
-
max time kernel
151s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2022, 12:30
Static task
static1
Behavioral task
behavioral1
Sample
f03cfa30317eefbc658e645242cf7be5a3d012cc26d91f04284b80127d07b6ce.exe
Resource
win10v2004-20220812-en
General
-
Target
f03cfa30317eefbc658e645242cf7be5a3d012cc26d91f04284b80127d07b6ce.exe
-
Size
232KB
-
MD5
612690d2d2a6c5aec8e5b623e2c390cf
-
SHA1
8f05ab45296839473b91afd9f4ad158f6bd1c2ba
-
SHA256
f03cfa30317eefbc658e645242cf7be5a3d012cc26d91f04284b80127d07b6ce
-
SHA512
894691078f834e5038c03ab32d46fee12719af18357c48cdd9b511c196828b9e64d8d10a563aac7693eb024fd968fcb2085af03b9072acf7eb58bb9f0888f88c
-
SSDEEP
3072:sl8NLawRLUhJ5hX6YMnfaJJZ4s2/nIVzW+5SeAddxZtJ/SRLjw7RkxmJZs:tLFRLk7J/4BEW+ce6dxPJ/SZGymI
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral1/memory/1308-133-0x00000000005E0000-0x00000000005E9000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
pid Process 4908 DA38.exe 3304 DD75.exe 436 E12F.exe -
Uses the VBS compiler for execution 1 TTPs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f03cfa30317eefbc658e645242cf7be5a3d012cc26d91f04284b80127d07b6ce.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f03cfa30317eefbc658e645242cf7be5a3d012cc26d91f04284b80127d07b6ce.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f03cfa30317eefbc658e645242cf7be5a3d012cc26d91f04284b80127d07b6ce.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1308 f03cfa30317eefbc658e645242cf7be5a3d012cc26d91f04284b80127d07b6ce.exe 1308 f03cfa30317eefbc658e645242cf7be5a3d012cc26d91f04284b80127d07b6ce.exe 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2560 Process not Found -
Suspicious behavior: MapViewOfSection 19 IoCs
pid Process 1308 f03cfa30317eefbc658e645242cf7be5a3d012cc26d91f04284b80127d07b6ce.exe 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found 2560 Process not Found -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 2560 wrote to memory of 4908 2560 Process not Found 88 PID 2560 wrote to memory of 4908 2560 Process not Found 88 PID 2560 wrote to memory of 3304 2560 Process not Found 89 PID 2560 wrote to memory of 3304 2560 Process not Found 89 PID 2560 wrote to memory of 436 2560 Process not Found 90 PID 2560 wrote to memory of 436 2560 Process not Found 90 PID 2560 wrote to memory of 436 2560 Process not Found 90 PID 2560 wrote to memory of 920 2560 Process not Found 91 PID 2560 wrote to memory of 920 2560 Process not Found 91 PID 2560 wrote to memory of 920 2560 Process not Found 91 PID 2560 wrote to memory of 920 2560 Process not Found 91 PID 2560 wrote to memory of 1244 2560 Process not Found 92 PID 2560 wrote to memory of 1244 2560 Process not Found 92 PID 2560 wrote to memory of 1244 2560 Process not Found 92 PID 436 wrote to memory of 448 436 E12F.exe 93 PID 436 wrote to memory of 448 436 E12F.exe 93 PID 436 wrote to memory of 448 436 E12F.exe 93 PID 436 wrote to memory of 2828 436 E12F.exe 94 PID 436 wrote to memory of 2828 436 E12F.exe 94 PID 436 wrote to memory of 2828 436 E12F.exe 94 PID 436 wrote to memory of 4752 436 E12F.exe 95 PID 436 wrote to memory of 4752 436 E12F.exe 95 PID 436 wrote to memory of 4752 436 E12F.exe 95 PID 436 wrote to memory of 5088 436 E12F.exe 96 PID 436 wrote to memory of 5088 436 E12F.exe 96 PID 436 wrote to memory of 5088 436 E12F.exe 96 PID 2560 wrote to memory of 4672 2560 Process not Found 97 PID 2560 wrote to memory of 4672 2560 Process not Found 97 PID 2560 wrote to memory of 4672 2560 Process not Found 97 PID 2560 wrote to memory of 4672 2560 Process not Found 97 PID 2560 wrote to memory of 724 2560 Process not Found 98 PID 2560 wrote to memory of 724 2560 Process not Found 98 PID 2560 wrote to memory of 724 2560 Process not Found 98 PID 2560 wrote to memory of 4356 2560 Process not Found 99 PID 2560 wrote to memory of 4356 2560 Process not Found 99 PID 2560 wrote to memory of 4356 2560 Process not Found 99 PID 2560 wrote to memory of 4356 2560 Process not Found 99 PID 2560 wrote to memory of 4664 2560 Process not Found 100 PID 2560 wrote to memory of 4664 2560 Process not Found 100 PID 2560 wrote to memory of 4664 2560 Process not Found 100 PID 2560 wrote to memory of 4664 2560 Process not Found 100 PID 2560 wrote to memory of 1600 2560 Process not Found 101 PID 2560 wrote to memory of 1600 2560 Process not Found 101 PID 2560 wrote to memory of 1600 2560 Process not Found 101 PID 2560 wrote to memory of 1600 2560 Process not Found 101 PID 2560 wrote to memory of 4228 2560 Process not Found 102 PID 2560 wrote to memory of 4228 2560 Process not Found 102 PID 2560 wrote to memory of 4228 2560 Process not Found 102 PID 2560 wrote to memory of 4984 2560 Process not Found 103 PID 2560 wrote to memory of 4984 2560 Process not Found 103 PID 2560 wrote to memory of 4984 2560 Process not Found 103 PID 2560 wrote to memory of 4984 2560 Process not Found 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\f03cfa30317eefbc658e645242cf7be5a3d012cc26d91f04284b80127d07b6ce.exe"C:\Users\Admin\AppData\Local\Temp\f03cfa30317eefbc658e645242cf7be5a3d012cc26d91f04284b80127d07b6ce.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1308
-
C:\Users\Admin\AppData\Local\Temp\DA38.exeC:\Users\Admin\AppData\Local\Temp\DA38.exe1⤵
- Executes dropped EXE
PID:4908
-
C:\Users\Admin\AppData\Local\Temp\DD75.exeC:\Users\Admin\AppData\Local\Temp\DD75.exe1⤵
- Executes dropped EXE
PID:3304
-
C:\Users\Admin\AppData\Local\Temp\E12F.exeC:\Users\Admin\AppData\Local\Temp\E12F.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵PID:448
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵PID:2828
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵PID:4752
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵PID:5088
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:920
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1244
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4672
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:724
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4356
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4664
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1600
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4228
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4984
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD59748489855d9dd82ab09da5e3e55b19e
SHA16ed2bf6a1a53a59cd2137812cb43b5032817f6a1
SHA25605bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b
SHA5127eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be
-
Filesize
4KB
MD59748489855d9dd82ab09da5e3e55b19e
SHA16ed2bf6a1a53a59cd2137812cb43b5032817f6a1
SHA25605bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b
SHA5127eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be
-
Filesize
4KB
MD59748489855d9dd82ab09da5e3e55b19e
SHA16ed2bf6a1a53a59cd2137812cb43b5032817f6a1
SHA25605bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b
SHA5127eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be
-
Filesize
4KB
MD59748489855d9dd82ab09da5e3e55b19e
SHA16ed2bf6a1a53a59cd2137812cb43b5032817f6a1
SHA25605bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b
SHA5127eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be
-
Filesize
67KB
MD5666d8f33d37064fd5d14e2166c9bfa69
SHA13b27df9335a9b2efe9da1057e9f8312a72d1ca9d
SHA2567fddf1b75f50d43214867f367223f2d241d62ae63deea334d051c0ee19d18157
SHA512ac3c993f019bb402db474fda65d587ae7717725eea9b3a869acd3530543b7b94d354f19474f6b1c7fc760b5b22622328def2bef26e3900c186b16e8a3d3b90df
-
Filesize
67KB
MD5666d8f33d37064fd5d14e2166c9bfa69
SHA13b27df9335a9b2efe9da1057e9f8312a72d1ca9d
SHA2567fddf1b75f50d43214867f367223f2d241d62ae63deea334d051c0ee19d18157
SHA512ac3c993f019bb402db474fda65d587ae7717725eea9b3a869acd3530543b7b94d354f19474f6b1c7fc760b5b22622328def2bef26e3900c186b16e8a3d3b90df