Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
10/01/2023, 19:44
General
-
Target
bc4df2381fc98d6f1aef8e6ba30bbdc5330d6a73348cad9db2c4943f1555d0a8.exe
-
Size
278KB
-
MD5
3a83057b6c2b478b3f5f5b73f82c124e
-
SHA1
409bbaeb746688839bc8ea75bac5d5ae50e29816
-
SHA256
bc4df2381fc98d6f1aef8e6ba30bbdc5330d6a73348cad9db2c4943f1555d0a8
-
SHA512
d1cc4deb3b3592c2882385e55a34c25bb18cc9e5c65361c08dabf5b6a99787ca9eb7cbc2e5bd968b77776026a92ece63929221e30fa0e5034b56172f547af026
-
SSDEEP
3072:mXEZFhmzRK4p7LdmTHNSJsNo5scoSj35dftR8WjYYVu9PDhism2m4FwCpjKpEAH7:OTzRZLyHNEsNx+DR8W0XPDHmnEmQLr
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Program crash 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc4df2381fc98d6f1aef8e6ba30bbdc5330d6a73348cad9db2c4943f1555d0a8.exe"C:\Users\Admin\AppData\Local\Temp\bc4df2381fc98d6f1aef8e6ba30bbdc5330d6a73348cad9db2c4943f1555d0a8.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\1F01.exeC:\Users\Admin\AppData\Local\Temp\1F01.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 13242⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4892 -ip 48921⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
316KB
MD5742cb9ac8ac7e816fd90431c5ae2cf60
SHA161d7a09b04881118ea328882d7e997f540916968
SHA256ca0ef095e3579fa1c41964305d153824664a7bf0825bec11141fc0d388631d48
SHA512f859734038ab2decab5f2317bbf156b89069b2e7848cd35b79b0da3b1506f1305f9baf83a4cd06d265eb3c2a0abc47f927d27a124214971d69872e9a76daae90
-
Filesize
316KB
MD5742cb9ac8ac7e816fd90431c5ae2cf60
SHA161d7a09b04881118ea328882d7e997f540916968
SHA256ca0ef095e3579fa1c41964305d153824664a7bf0825bec11141fc0d388631d48
SHA512f859734038ab2decab5f2317bbf156b89069b2e7848cd35b79b0da3b1506f1305f9baf83a4cd06d265eb3c2a0abc47f927d27a124214971d69872e9a76daae90
-
Filesize
64KB
-
Filesize
36KB
-
Filesize
39.7MB
-
Filesize
39.7MB
-
Filesize
104KB
-
Filesize
168KB
-
Filesize
39.7MB
-
Filesize
39.7MB