Overview

overview

10

Static

static

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/01/2023, 06:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    file.exe
  • Size 261KB
  • Sample230114-ha681sbb39
  • SHA256 ad8ab0c5389d2e8a36e7a113c9da8197891f44d548a829332d5e72ec855f1ba7
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
smokeloaderbackdoorcollectiondiscoverypersistencespywarestealertrojan

Malware Config

Signatures

  • Detects Smokeloader packer 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Sets DLL path for service in the registry 2 TTPs 1 IoCs
    persistence
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
    collection
  • Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
    collection
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 18 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 26 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 30 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:3468
  • C:\Users\Admin\AppData\Local\Temp\CE51.exe
    C:\Users\Admin\AppData\Local\Temp\CE51.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3028
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Rruwtqrefy.tmp",Uuhpdwiyer
      2⤵
      • Blocklisted process makes network request
      • Sets DLL path for service in the registry
      • Sets service image path in registry
      • Loads dropped DLL
      • Accesses Microsoft Outlook accounts
      • Accesses Microsoft Outlook profiles
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:3112
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 17209
        3⤵
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        PID:3968
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
        3⤵
          PID:2028
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
          3⤵
            PID:1144
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 532
          2⤵
          • Program crash
          PID:220
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3028 -ip 3028
        1⤵
          PID:700
        • C:\Windows\System32\rundll32.exe
          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
          1⤵
            PID:4076

          Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                CE51.exe
                • Path C:\Users\Admin\AppData\Local\Temp\CE51.exe
                • Size 1.1MB
                • SHA256 4598d77bc7e0935b01fb6f77b13f67287972897fab534404837861e3af54ed18
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                CE51.exe
                • Path C:\Users\Admin\AppData\Local\Temp\CE51.exe
                • Size 1.1MB
                • SHA256 4598d77bc7e0935b01fb6f77b13f67287972897fab534404837861e3af54ed18
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                Rruwtqrefy.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\Rruwtqrefy.tmp
                • Size 805KB
                • SHA256 c5cd7d52ba95127c18556a2ddca64e4ef80a2945e6579545c0067abdab3a0ad0
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                Rruwtqrefy.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\Rruwtqrefy.tmp
                • Size 805KB
                • SHA256 c5cd7d52ba95127c18556a2ddca64e4ef80a2945e6579545c0067abdab3a0ad0
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                memory/3028-142-0x00000000049C3000-0x0000000004AA7000-memory.dmp
                Download

                memory/3028-144-0x0000000000400000-0x0000000002C7D000-memory.dmp
                Download

                memory/3028-143-0x0000000004AB0000-0x0000000004BD4000-memory.dmp
                Download

                memory/3112-146-0x0000000006570000-0x000000000709F000-memory.dmp
                Download

                memory/3112-151-0x0000000004850000-0x0000000004990000-memory.dmp
                Download

                memory/3112-158-0x0000000006570000-0x000000000709F000-memory.dmp
                Download

                memory/3112-145-0x0000000006570000-0x000000000709F000-memory.dmp
                Download

                memory/3112-152-0x0000000004850000-0x0000000004990000-memory.dmp
                Download

                memory/3112-147-0x0000000004850000-0x0000000004990000-memory.dmp
                Download

                memory/3112-148-0x0000000004850000-0x0000000004990000-memory.dmp
                Download

                memory/3112-149-0x0000000004850000-0x0000000004990000-memory.dmp
                Download

                memory/3112-150-0x0000000004850000-0x0000000004990000-memory.dmp
                Download

                memory/3468-132-0x0000000002DBD000-0x0000000002DCE000-memory.dmp
                Download

                memory/3468-135-0x0000000000400000-0x0000000002BA9000-memory.dmp
                Download

                memory/3468-134-0x0000000000400000-0x0000000002BA9000-memory.dmp
                Download

                memory/3468-133-0x0000000002D40000-0x0000000002D49000-memory.dmp
                Download

                memory/3968-154-0x0000018F28FC0000-0x0000018F29100000-memory.dmp
                Download

                memory/3968-155-0x0000018F28FC0000-0x0000018F29100000-memory.dmp
                Download

                memory/3968-156-0x0000000000220000-0x00000000004B8000-memory.dmp
                Download

                memory/3968-157-0x0000018F27700000-0x0000018F279A9000-memory.dmp
                Download