Analysis
-
max time kernel
168s -
max time network
195s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
15-01-2023 20:45
Static task
static1
General
-
Target
fd0c6b0d9618c804aaec4f9ba1ac221ce54a43ddca16444824245bd684471825.exe
-
Size
210KB
-
MD5
7035b2eefc6413e4c791147727e42a2f
-
SHA1
cef5f176237f8bc633ebb82791fa492108835d7c
-
SHA256
fd0c6b0d9618c804aaec4f9ba1ac221ce54a43ddca16444824245bd684471825
-
SHA512
5eb8a11de7b72d3546b4562891c040f028a8c4d9e436dd5b46f2e9122441c6cda8fe4fc0f229080000d7c17062ff4cf66b4f3d271865b6fe245df38f98611bf8
-
SSDEEP
3072:qXGCbQqP+Uls5cfB1Q3HyG+eP9ehkCHo2g9pND3YGMtT51i:K+aZ1QiePohloV90Gg5
Malware Config
Extracted
lumma
77.73.134.68
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2416-142-0x0000000002D00000-0x0000000002D09000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
2A18.exe5DBC.exepid process 4308 2A18.exe 3480 5DBC.exe -
Deletes itself 1 IoCs
Processes:
pid process 2576 -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 3148 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
fd0c6b0d9618c804aaec4f9ba1ac221ce54a43ddca16444824245bd684471825.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fd0c6b0d9618c804aaec4f9ba1ac221ce54a43ddca16444824245bd684471825.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fd0c6b0d9618c804aaec4f9ba1ac221ce54a43ddca16444824245bd684471825.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fd0c6b0d9618c804aaec4f9ba1ac221ce54a43ddca16444824245bd684471825.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
fd0c6b0d9618c804aaec4f9ba1ac221ce54a43ddca16444824245bd684471825.exepid process 2416 fd0c6b0d9618c804aaec4f9ba1ac221ce54a43ddca16444824245bd684471825.exe 2416 fd0c6b0d9618c804aaec4f9ba1ac221ce54a43ddca16444824245bd684471825.exe 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2576 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
fd0c6b0d9618c804aaec4f9ba1ac221ce54a43ddca16444824245bd684471825.exepid process 2416 fd0c6b0d9618c804aaec4f9ba1ac221ce54a43ddca16444824245bd684471825.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
2A18.exedescription pid process target process PID 2576 wrote to memory of 4308 2576 2A18.exe PID 2576 wrote to memory of 4308 2576 2A18.exe PID 2576 wrote to memory of 4308 2576 2A18.exe PID 4308 wrote to memory of 3148 4308 2A18.exe rundll32.exe PID 4308 wrote to memory of 3148 4308 2A18.exe rundll32.exe PID 4308 wrote to memory of 3148 4308 2A18.exe rundll32.exe PID 2576 wrote to memory of 3480 2576 5DBC.exe PID 2576 wrote to memory of 3480 2576 5DBC.exe PID 2576 wrote to memory of 3480 2576 5DBC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd0c6b0d9618c804aaec4f9ba1ac221ce54a43ddca16444824245bd684471825.exe"C:\Users\Admin\AppData\Local\Temp\fd0c6b0d9618c804aaec4f9ba1ac221ce54a43ddca16444824245bd684471825.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\2A18.exeC:\Users\Admin\AppData\Local\Temp\2A18.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Sdaaysrpyefiy.tmp",Qowsuiaedfeupa2⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\5DBC.exeC:\Users\Admin\AppData\Local\Temp\5DBC.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\2A18.exeFilesize
1.1MB
MD50222009e709c5801f1ea8edd9a198ec6
SHA1371268659a9827f02210502b514f33aca62bb2ca
SHA2563d1e452ce84407cbde17ddd4dfb7d1efd81f5ea3f61690c38a0dc97c4c284eb1
SHA51269713e1678a01847a20227b43ebf1e97bf16b511dd2f9abf6aba24112e9fd95265a0a15b3d54562e2700edb813a596e99a4ff65d7814876c4a20bbd79e927f20
-
C:\Users\Admin\AppData\Local\Temp\2A18.exeFilesize
1.1MB
MD50222009e709c5801f1ea8edd9a198ec6
SHA1371268659a9827f02210502b514f33aca62bb2ca
SHA2563d1e452ce84407cbde17ddd4dfb7d1efd81f5ea3f61690c38a0dc97c4c284eb1
SHA51269713e1678a01847a20227b43ebf1e97bf16b511dd2f9abf6aba24112e9fd95265a0a15b3d54562e2700edb813a596e99a4ff65d7814876c4a20bbd79e927f20
-
C:\Users\Admin\AppData\Local\Temp\5DBC.exeFilesize
248KB
MD53d92131e50a1b8aa8e84e987059bf2d3
SHA16e0d66119ac618710e2dd1c81e340d079d053304
SHA256f8d13608a3238b1909ee373c32ff31930912f69bbad44560a6e10cdd35fe2271
SHA5121d2fc9c7569e169b0179c36a636923444e0ca45ab4360ee834a921d9a45a2357c2cc0011fd99c73b02bfe67405cebf3dc388b4a1efe80fb3518ec9fa8dc75500
-
C:\Users\Admin\AppData\Local\Temp\5DBC.exeFilesize
248KB
MD53d92131e50a1b8aa8e84e987059bf2d3
SHA16e0d66119ac618710e2dd1c81e340d079d053304
SHA256f8d13608a3238b1909ee373c32ff31930912f69bbad44560a6e10cdd35fe2271
SHA5121d2fc9c7569e169b0179c36a636923444e0ca45ab4360ee834a921d9a45a2357c2cc0011fd99c73b02bfe67405cebf3dc388b4a1efe80fb3518ec9fa8dc75500
-
C:\Users\Admin\AppData\Local\Temp\Sdaaysrpyefiy.tmpFilesize
774KB
MD5e06fb66bfbe1444cc091f0297b8d32db
SHA1c3e13e3edcbbf30cdc51ce96cc7a802fc88e83af
SHA256b282eb3f05d375d3487d20596d783fa52aa27013e8b2b407db32d9a3a751319d
SHA512c639b62f417d46148c3a84ae5ff2cc7018c653424cc1d643a983c41d4a12f6015df0f4359c5e078c2c3e5b1d42de18acfb6aab432266a8c4e37aa5449e961d95
-
\Users\Admin\AppData\Local\Temp\Sdaaysrpyefiy.tmpFilesize
774KB
MD5e06fb66bfbe1444cc091f0297b8d32db
SHA1c3e13e3edcbbf30cdc51ce96cc7a802fc88e83af
SHA256b282eb3f05d375d3487d20596d783fa52aa27013e8b2b407db32d9a3a751319d
SHA512c639b62f417d46148c3a84ae5ff2cc7018c653424cc1d643a983c41d4a12f6015df0f4359c5e078c2c3e5b1d42de18acfb6aab432266a8c4e37aa5449e961d95
-
memory/2416-141-0x0000000002E96000-0x0000000002EA6000-memory.dmpFilesize
64KB
-
memory/2416-146-0x0000000000400000-0x0000000002B9D000-memory.dmpFilesize
39.6MB
-
memory/2416-125-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2416-126-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2416-127-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2416-128-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2416-129-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2416-130-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2416-131-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2416-132-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2416-133-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2416-134-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2416-135-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2416-136-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2416-137-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2416-138-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2416-139-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2416-140-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2416-123-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2416-142-0x0000000002D00000-0x0000000002D09000-memory.dmpFilesize
36KB
-
memory/2416-143-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2416-144-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2416-145-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2416-124-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2416-147-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2416-148-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2416-149-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2416-150-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2416-151-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2416-152-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2416-153-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2416-154-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2416-155-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2416-156-0x0000000000400000-0x0000000002B9D000-memory.dmpFilesize
39.6MB
-
memory/2416-120-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2416-121-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2416-122-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/3148-205-0x0000000000000000-mapping.dmp
-
memory/3480-316-0x0000000000400000-0x0000000002BA6000-memory.dmpFilesize
39.6MB
-
memory/3480-311-0x0000000000400000-0x0000000002BA6000-memory.dmpFilesize
39.6MB
-
memory/3480-310-0x0000000002BB0000-0x0000000002C5E000-memory.dmpFilesize
696KB
-
memory/3480-286-0x0000000000400000-0x0000000002BA6000-memory.dmpFilesize
39.6MB
-
memory/3480-283-0x00000000047C0000-0x00000000047EA000-memory.dmpFilesize
168KB
-
memory/3480-282-0x0000000002BB0000-0x0000000002C5E000-memory.dmpFilesize
696KB
-
memory/3480-212-0x0000000000000000-mapping.dmp
-
memory/4308-157-0x0000000000000000-mapping.dmp
-
memory/4308-169-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4308-170-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4308-171-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4308-172-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4308-173-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4308-174-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4308-176-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4308-177-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4308-178-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4308-179-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4308-180-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4308-181-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4308-182-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4308-183-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4308-184-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4308-185-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4308-186-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4308-188-0x00000000049F0000-0x0000000004B1E000-memory.dmpFilesize
1.2MB
-
memory/4308-187-0x0000000004870000-0x000000000495B000-memory.dmpFilesize
940KB
-
memory/4308-189-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4308-190-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4308-191-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4308-168-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4308-192-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4308-193-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4308-197-0x0000000000400000-0x0000000002C75000-memory.dmpFilesize
40.5MB
-
memory/4308-251-0x0000000000400000-0x0000000002C75000-memory.dmpFilesize
40.5MB
-
memory/4308-167-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4308-165-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4308-164-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4308-163-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4308-162-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4308-161-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4308-160-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/4308-159-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB