Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
03-01-2023 07:42
General
-
Target
file.exe
-
Size
334KB
-
MD5
4757415db2cb6f0c2fe7deb0cc2640a7
-
SHA1
f28b5fbc920703bafe414d4e4ce6c9e4965963d0
-
SHA256
60fe43fe56681f11075849841523ef3ba8e20a68fb0191f8d31b0e12ac94d00f
-
SHA512
9f98d8963bd9afd1e6d66fe3db2c7b34e329456c9e3db7785f7917a22b17fcb44f457d8ba3a1cc2eb5042c65bca4c367b9b4bd4bd113d012ad342ebcf9026a0e
-
SSDEEP
6144:IDsLXWohp/BGIBmE8FhC1n28gqjAWTM4xVvkHb+ewx:yszWoz/BJZ8FsJ2QXTMENi+r
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Blocklisted process makes network request 3 IoCs
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 24 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies Internet Explorer settings 1 TTPs 4 IoCs
-
Modifies registry class 30 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 20 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\DBFD.exeC:\Users\Admin\AppData\Local\Temp\DBFD.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Uwuepfhtwy.tmp",Iypewfhtshu2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 226913⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 5282⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1180 -ip 11801⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD54f93d31b2f55d9a2d9c4ad09b6d42147
SHA1f0b6365c8212bf757ad67e7936f559d2b2df9973
SHA2565fd7b36420e0042c0d9a1c11ee59ab2e443fca1bf933bbf3a663c4c76d827db0
SHA512ace309ae9ee505d8769f12a71cf5260b1e3eca1d7942092d1bfca7a44f30489969021f875e3468545fb6bf3d7164cab09b4e0884898376d91bc0cc2846b63e15
-
Filesize
1.1MB
MD54f93d31b2f55d9a2d9c4ad09b6d42147
SHA1f0b6365c8212bf757ad67e7936f559d2b2df9973
SHA2565fd7b36420e0042c0d9a1c11ee59ab2e443fca1bf933bbf3a663c4c76d827db0
SHA512ace309ae9ee505d8769f12a71cf5260b1e3eca1d7942092d1bfca7a44f30489969021f875e3468545fb6bf3d7164cab09b4e0884898376d91bc0cc2846b63e15
-
Filesize
783KB
MD5bca40b7547bf1cb7bf2d7a53d01ff6a8
SHA1ea624306e9ac715746bd9710a2c803a7e8fdefaa
SHA256f683b568c71a82666d0d4f99a966b4c600116cdae6167f284e3cbc19075010d8
SHA512fc2d85b8df331e510305a8eb1b5f176b24d43a6df449aa90c0dd2bb6bfd37e647310a35aeb9a1ef1bcf3a6ed444d1127b7da0d47f707ba59874c7fcd00a277aa
-
Filesize
783KB
MD5bca40b7547bf1cb7bf2d7a53d01ff6a8
SHA1ea624306e9ac715746bd9710a2c803a7e8fdefaa
SHA256f683b568c71a82666d0d4f99a966b4c600116cdae6167f284e3cbc19075010d8
SHA512fc2d85b8df331e510305a8eb1b5f176b24d43a6df449aa90c0dd2bb6bfd37e647310a35aeb9a1ef1bcf3a6ed444d1127b7da0d47f707ba59874c7fcd00a277aa
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
-
Filesize
1.2MB
-
Filesize
1.1MB
-
Filesize
916KB
-
Filesize
84KB
-
Filesize
356KB
-
Filesize
36KB
-
Filesize
356KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
11.3MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
-
Filesize
1.2MB
-
Filesize
11.3MB
-
Filesize
1.2MB
-
Filesize
11.3MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
-
Filesize
2.7MB
-
Filesize
2.6MB