Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
08/01/2023, 13:28
Static task
static1
Behavioral task
behavioral1
Sample
1e715d06cd9ece98291cddf44f6d5d68b23f42d4118015b7dbcaa55bdd9d57bd.exe
Resource
win10-20220812-en
9 signatures
150 seconds
General
-
Target
1e715d06cd9ece98291cddf44f6d5d68b23f42d4118015b7dbcaa55bdd9d57bd.exe
-
Size
264KB
-
MD5
b3c5d6243ef1d617bb9d6b80de2b51a5
-
SHA1
76dc85f4141b730a2b65905e9bfca1b4d20350f4
-
SHA256
1e715d06cd9ece98291cddf44f6d5d68b23f42d4118015b7dbcaa55bdd9d57bd
-
SHA512
b518aba574f4862333857d11e6c78c43b49492a6edd4bcecb5001163de1a4cdf7163db9faa6936a233cbdb5085401434108277dac823d6294c3de428d31a1b16
-
SSDEEP
3072:VXhENMvtL7/BW/LV/0q/R5ZXQa1UJVqurtlSE4lpxOdUZNTKXWPr0sd6:R3L7/B2/0q/Cb7tllY3OuN
Score
10/10
Malware Config
Signatures
-
Detects Smokeloader packer 4 IoCs
resource yara_rule behavioral1/memory/5056-147-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/5056-148-0x0000000000402DD8-mapping.dmp family_smokeloader behavioral1/memory/5056-157-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/5056-179-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
pid Process 1916 Process not Found -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4936 set thread context of 5056 4936 1e715d06cd9ece98291cddf44f6d5d68b23f42d4118015b7dbcaa55bdd9d57bd.exe 67 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1e715d06cd9ece98291cddf44f6d5d68b23f42d4118015b7dbcaa55bdd9d57bd.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1e715d06cd9ece98291cddf44f6d5d68b23f42d4118015b7dbcaa55bdd9d57bd.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1e715d06cd9ece98291cddf44f6d5d68b23f42d4118015b7dbcaa55bdd9d57bd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5056 1e715d06cd9ece98291cddf44f6d5d68b23f42d4118015b7dbcaa55bdd9d57bd.exe 5056 1e715d06cd9ece98291cddf44f6d5d68b23f42d4118015b7dbcaa55bdd9d57bd.exe 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found 1916 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1916 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 5056 1e715d06cd9ece98291cddf44f6d5d68b23f42d4118015b7dbcaa55bdd9d57bd.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4936 wrote to memory of 5056 4936 1e715d06cd9ece98291cddf44f6d5d68b23f42d4118015b7dbcaa55bdd9d57bd.exe 67 PID 4936 wrote to memory of 5056 4936 1e715d06cd9ece98291cddf44f6d5d68b23f42d4118015b7dbcaa55bdd9d57bd.exe 67 PID 4936 wrote to memory of 5056 4936 1e715d06cd9ece98291cddf44f6d5d68b23f42d4118015b7dbcaa55bdd9d57bd.exe 67 PID 4936 wrote to memory of 5056 4936 1e715d06cd9ece98291cddf44f6d5d68b23f42d4118015b7dbcaa55bdd9d57bd.exe 67 PID 4936 wrote to memory of 5056 4936 1e715d06cd9ece98291cddf44f6d5d68b23f42d4118015b7dbcaa55bdd9d57bd.exe 67 PID 4936 wrote to memory of 5056 4936 1e715d06cd9ece98291cddf44f6d5d68b23f42d4118015b7dbcaa55bdd9d57bd.exe 67
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e715d06cd9ece98291cddf44f6d5d68b23f42d4118015b7dbcaa55bdd9d57bd.exe"C:\Users\Admin\AppData\Local\Temp\1e715d06cd9ece98291cddf44f6d5d68b23f42d4118015b7dbcaa55bdd9d57bd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\1e715d06cd9ece98291cddf44f6d5d68b23f42d4118015b7dbcaa55bdd9d57bd.exe"C:\Users\Admin\AppData\Local\Temp\1e715d06cd9ece98291cddf44f6d5d68b23f42d4118015b7dbcaa55bdd9d57bd.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:5056
-