Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
27-12-2022 20:12
General
-
Target
4b4ee0649b719ce5a14b63c9b3a7f7bc0878b530ad158f9c2a04c3dd8b015af4.exe
-
Size
297KB
-
MD5
69178f6e005b870217b52a6780494088
-
SHA1
ee2cd7dcd50d89196f949159182c78a99aec2400
-
SHA256
4b4ee0649b719ce5a14b63c9b3a7f7bc0878b530ad158f9c2a04c3dd8b015af4
-
SHA512
14fd684790345e0e36b2b86f083276325662c99636d619e085ed1bf3685b35e7fba0330a24704a8ddcdb999b9c2569d5bd90e1fa0af52b1ed51b56c8356c5617
-
SSDEEP
6144:ALzX0e34H8RMnx+X58xQ3xDPkMo5zXbAc:AXru8RMnxK58xaxDPyrbA
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Blocklisted process makes network request 3 IoCs
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 31 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 26 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies Internet Explorer settings 1 TTPs 4 IoCs
-
Modifies registry class 30 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b4ee0649b719ce5a14b63c9b3a7f7bc0878b530ad158f9c2a04c3dd8b015af4.exe"C:\Users\Admin\AppData\Local\Temp\4b4ee0649b719ce5a14b63c9b3a7f7bc0878b530ad158f9c2a04c3dd8b015af4.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\D4D9.exeC:\Users\Admin\AppData\Local\Temp\D4D9.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Qfyshwqueqdpai.tmp",Dioeeedresq2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 140263⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 344 -s 5282⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 344 -ip 3441⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k LocalService1⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "c:\program files (x86)\google\temp\agmgpuoptin.dll",tVNicml3Uw==2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
792KB
MD5b0aae80c522d672c0cb533b21502bb27
SHA123271c304da87bf0854fc577cc2396899aec3055
SHA25640ed5e6894f4b982cb1aa5e194409ca31a0a2d5b7e7dcccd3f6ac5da4e1dbc7b
SHA5127c946134b789d110969ed7818bce4f65d59b281770aa49bf621dd6ec90f9ff3ce18567d4a21c0291838453eab5a010fe1754e56126f7d2db8be4e42484b9a897
-
Filesize
792KB
MD5b0aae80c522d672c0cb533b21502bb27
SHA123271c304da87bf0854fc577cc2396899aec3055
SHA25640ed5e6894f4b982cb1aa5e194409ca31a0a2d5b7e7dcccd3f6ac5da4e1dbc7b
SHA5127c946134b789d110969ed7818bce4f65d59b281770aa49bf621dd6ec90f9ff3ce18567d4a21c0291838453eab5a010fe1754e56126f7d2db8be4e42484b9a897
-
Filesize
110B
MD537a1115747e63e1c0ead2c66301f22d3
SHA144339aa5b475ecc2669a69fa1850ffcbf6fc666e
SHA2569496889b2cbda0bcb85b8ef91dc323107702c214ee37a7c1057b8fc9c8874589
SHA5126ecc4b9f1d08bccc3f1ae111391e83b8a1ae3788f532ae3afac5ed91823891aaf6a56385e3856910730d312d5374c779bdab7760d82a685ee99c077a3180357d
-
Filesize
10KB
MD53ef69b2c0f15e6b97fca1141bc9beb9a
SHA1421916704e31978eb77421161bb170003a83c1a2
SHA256f3e25cf6f3fdd2017b76701290ba9599384dd2084111545f6da078502cae29cc
SHA512cec4a92eb852d731571a4e1098f195b2f3d84a5fde17c5e6ba5d3e7464f2352fe25cb67b051078f0742696b0aa862960e0203c2231df1552534c06539149427d
-
Filesize
3.5MB
MD57f3acb0a74fa4a288b33bd0d22f91716
SHA19b25a97fe300128d8f99a1887e37812b97fca4d2
SHA25604637d26bee1e1cd72ed842719afe64c0bfbd7968b173ae043e76c35bbeea636
SHA512c8fb61038fafb3f6e7cdf3d0e96cc78b565e697ac0376fb7bf02e268c3f018b9925ef6325a29c0a6494f9dcfa5789ed9d55ad67cd0ce0f22ff0863b1a5097d7e
-
Filesize
1KB
MD58c59faf203fc8a2a460920be06eb2b4e
SHA1833cf94c8a893ed6199812f4ca6f177af7dc43c1
SHA256b7e5f69aa3d04494c0a0d3a09b70d48b38b5264f74c04a49e5886bb6cc78889a
SHA5125fa0271ecb6995cac9c003e6d3313c6fa5f89a360711ff4b80292379f58c33d8802413c8c63d1312913934a7144f0a2cfffddeab05d69afd4a1d810c5003bc5f
-
Filesize
26KB
MD53973cc0067bf4b33098b7bf2d68db787
SHA188ddb50df1c24a7f658ba2050f94dea1e13ca8d4
SHA25670d4896e97e5a6e63d081deb667a746d8153c30ef2556c15fac003e4ac3ea4e9
SHA51287b72becab432f15accf9433b024b53efff165a9478937a4efd5ecf6841503b4c64eedbaae87ecba44f7803331950cd36f9e54c97c4ebf05d7a76062814bd080
-
Filesize
829B
MD587abe99363b16041e32b8a146eb53617
SHA1b1f3f3c3939f2331dee213e480f4a4d0c753f72a
SHA2567c8df7b34fca6387a15cbc0d6f591624a5a28bf513f71eb1077d55f1b448d856
SHA512091ffae18e7cf41237b1039964cb4c3116275edfa34b198bbb9a0b258a99bf3b62b420fb22d747788a889f2306c30f0dc00566c432d4b2bb2e410a9e7dc69e44
-
Filesize
15KB
MD52f71d0396b93381c1fd86bf822612868
SHA1d0801700dd00a51276f32c6ed19f5b713b5db825
SHA2560543ea8c8efce3d69431f57affc2cfa44df1b9244a25ed080e4b2014d0419026
SHA51267022ce5c41641799abff9e68cb3f049c5d932aea5c6fd8748469e2e7f51f987f1bdfc7d831a8d11a69d99a77cc363c51db8be6ad50e4014eb63a15c1f25a722
-
Filesize
3KB
MD51a3168a15983b890b16390a23a89a02e
SHA1d56ce16d88d79159a27c2d1cd3770dc56d897ebe
SHA256334782208e9520975f597b19a273fcc6f3a8a7caffd2e4fb22213f6b957f4946
SHA512f2be33992fd70d90eb94973c19924229bb70da4ce21c9777cfccbf56b0635452b382d2846afe2b0cc80a83d3b6a2c855557855cfb22fc681d182b2b605daa668
-
Filesize
1KB
MD536b733e882d091355ffdd2b0a3286888
SHA10043a974ebd90d802e8cc5e04b5cefc980d03292
SHA256f83662badfaa62797f925aa8292852be5351d3e641d70fe22c911ee4cdf68aad
SHA512abb0df60401f74df3368e17cd8ff672dceaeef0fbeb097da659c07f2b8d756a09ada065ecb3ba7ccabbb4416817d730c13e6340ae5c6239dff31ae8b81c0a10c
-
Filesize
128B
MD573f303800be636585f9ec14701cd8d5e
SHA1456304dc888d5eaa159fa0fa34fc9bcc3bacb633
SHA256c8e3762853e17a3bd49882b0d36afa285bed5639f8f9e88f716c3942e28b6ace
SHA5128a80ee6d1b074d68a55bbb3d5be251cfaae89b0345a6b0e84a6359e8c1453c8bf0969e6d33a7d0523d30d586c46c1eede9e71f7a89f7bc67ea0ad866671b81b4
-
Filesize
12KB
MD5f9f25c79e2df9c8c8209b5d052a557b0
SHA12d4a14e2df96245a599bacb530e396c2900a5b61
SHA256385214231d70603caaf00c1f2e9f115be35cc603d289dd878069f9933aa591b5
SHA5127c9d68d4f96cef25f4703fe4db68fda9689308df759ef05666421c74f0e57b4c25fa8d1c6cf9e5a6a0e9a81d230669b8656279076e60ebfd1ba5b56770fa4ca2
-
Filesize
1.0MB
MD5bbb459e503d4c79fdc02a2b89af1d07a
SHA1a0b81044e45b130b56a81f068193295aa79da174
SHA2566aa2b86ef308d638ec7ed2d9f1be438e1fa481ffe90c4013be27c0e8a61cc427
SHA5122aeaf04490fa3637bd467b028d3755e208a9688b7fcc28abc9856f1e436270a1bbe67577464c3052241f3c722d778118d972b945a97955ca8dd57c686378ba84
-
Filesize
1.0MB
MD5bbb459e503d4c79fdc02a2b89af1d07a
SHA1a0b81044e45b130b56a81f068193295aa79da174
SHA2566aa2b86ef308d638ec7ed2d9f1be438e1fa481ffe90c4013be27c0e8a61cc427
SHA5122aeaf04490fa3637bd467b028d3755e208a9688b7fcc28abc9856f1e436270a1bbe67577464c3052241f3c722d778118d972b945a97955ca8dd57c686378ba84
-
Filesize
792KB
MD5822d3ead416a1a85cb96e65f65cd5ae2
SHA1af32b69e2835d1cacdadb97ae6dfafccc32d1837
SHA25672bdb3a06dca8458ac9aedf06785b2d7b95a19f8b9f3f8f5be2eb4744e9c5d1d
SHA51248d0d61efd51fd2d8eb04d990b4a5b3ca34c916199d3b0a3b135d2089e028ee37f5145e4705fb75da77eaabbe12f8c4ea55775a41e1b1c68a90ce68b8c2a7260
-
Filesize
792KB
MD5822d3ead416a1a85cb96e65f65cd5ae2
SHA1af32b69e2835d1cacdadb97ae6dfafccc32d1837
SHA25672bdb3a06dca8458ac9aedf06785b2d7b95a19f8b9f3f8f5be2eb4744e9c5d1d
SHA51248d0d61efd51fd2d8eb04d990b4a5b3ca34c916199d3b0a3b135d2089e028ee37f5145e4705fb75da77eaabbe12f8c4ea55775a41e1b1c68a90ce68b8c2a7260
-
Filesize
792KB
MD5b0aae80c522d672c0cb533b21502bb27
SHA123271c304da87bf0854fc577cc2396899aec3055
SHA25640ed5e6894f4b982cb1aa5e194409ca31a0a2d5b7e7dcccd3f6ac5da4e1dbc7b
SHA5127c946134b789d110969ed7818bce4f65d59b281770aa49bf621dd6ec90f9ff3ce18567d4a21c0291838453eab5a010fe1754e56126f7d2db8be4e42484b9a897
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
856KB
-
-
Filesize
11.4MB
-
-
Filesize
36KB
-
Filesize
312KB
-
Filesize
84KB
-
Filesize
312KB
-
Filesize
1.2MB
-
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
11.4MB
-
Filesize
11.4MB
-
Filesize
1.2MB
-
Filesize
11.4MB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
11.4MB
-
Filesize
11.4MB
-
Filesize
2.7MB
-
Filesize
2.6MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-