Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
-
submitted
10-01-2023 03:29
General
-
Target
acdb7a96617754bd48192b679466645840cc3600c78fff2931e827ce0e415b09.exe
-
Size
327KB
-
MD5
790d065e1cbf9bfa45aba74afdb4a660
-
SHA1
764878ddec582fc4d8ee48e09db03bdda17cde5e
-
SHA256
acdb7a96617754bd48192b679466645840cc3600c78fff2931e827ce0e415b09
-
SHA512
995c6db403195dc9fc5340932c13c56f3659006397c8cd201b331a6bda63a79e6642d0b9f9cc96b08813cf7a3b256395fd1ca28da3b5b6ce3596cd668a400ae0
-
SSDEEP
6144:l+lvj2+a/MBntI+xu7fWbg7dBA0X31JY:l+piREntI+xu7+Cn1
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Deletes itself 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\acdb7a96617754bd48192b679466645840cc3600c78fff2931e827ce0e415b09.exe"C:\Users\Admin\AppData\Local\Temp\acdb7a96617754bd48192b679466645840cc3600c78fff2931e827ce0e415b09.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\AF3B.exeC:\Users\Admin\AppData\Local\Temp\AF3B.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
340KB
MD5eb83082ce8b0915d853b0b6315f7ecfc
SHA12c29d77fc7d104c6f0a263c3c1152966300c8227
SHA256fba7392ec5c5b21009ff5353c10948bdd36a33d073bead32947f376807021ab3
SHA5122d075be3b79b8b54c932d20028c74d73ec74ba9873fc82dc482bebb7f323085f57d1c3fc5c85978d265975c8899806ae0a6314997e186edb38f97c43e5d66824
-
Filesize
340KB
MD5eb83082ce8b0915d853b0b6315f7ecfc
SHA12c29d77fc7d104c6f0a263c3c1152966300c8227
SHA256fba7392ec5c5b21009ff5353c10948bdd36a33d073bead32947f376807021ab3
SHA5122d075be3b79b8b54c932d20028c74d73ec74ba9873fc82dc482bebb7f323085f57d1c3fc5c85978d265975c8899806ae0a6314997e186edb38f97c43e5d66824
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
696KB
-
Filesize
36KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
352KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
352KB
-
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
360KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
360KB