Analysis
-
max time kernel
177s -
max time network
182s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
16-01-2023 08:27
Static task
static1
Behavioral task
behavioral1
Sample
18dc8fac237e8cb22397fe44f64c54863b4ed5f490042d759689d149856b8dd3.exe
Resource
win7-20221111-en
General
-
Target
18dc8fac237e8cb22397fe44f64c54863b4ed5f490042d759689d149856b8dd3.exe
-
Size
210KB
-
MD5
ebd42ae578479719653b35c33554ccc5
-
SHA1
da79aceadb98f5198c218438e1ff13900b206ec9
-
SHA256
18dc8fac237e8cb22397fe44f64c54863b4ed5f490042d759689d149856b8dd3
-
SHA512
0eaf3f62705ddab16e14a077bc29c52b22a99dd9b2212dcd0aeec9d92843b79b65bdde3b14a9170fc424aace760a6c80970916547039fa697814e7be639c1f12
-
SSDEEP
1536:gMQuk7EPCnpn2XcxezpkQYCPt9ldnXEp6Zd5X581Z1EnVx7C0NDuYHCx3IkwLuTy:gMXWEo+/hd5p73762CxYXSNti
Malware Config
Extracted
lumma
77.73.134.68
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2376-133-0x0000000002C20000-0x0000000002C29000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
caeduavE848.exepid process 4188 caeduav 748 E848.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
caeduav18dc8fac237e8cb22397fe44f64c54863b4ed5f490042d759689d149856b8dd3.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI caeduav Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 18dc8fac237e8cb22397fe44f64c54863b4ed5f490042d759689d149856b8dd3.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 18dc8fac237e8cb22397fe44f64c54863b4ed5f490042d759689d149856b8dd3.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 18dc8fac237e8cb22397fe44f64c54863b4ed5f490042d759689d149856b8dd3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI caeduav Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI caeduav -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
18dc8fac237e8cb22397fe44f64c54863b4ed5f490042d759689d149856b8dd3.exepid process 2376 18dc8fac237e8cb22397fe44f64c54863b4ed5f490042d759689d149856b8dd3.exe 2376 18dc8fac237e8cb22397fe44f64c54863b4ed5f490042d759689d149856b8dd3.exe 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 2016 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2016 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
18dc8fac237e8cb22397fe44f64c54863b4ed5f490042d759689d149856b8dd3.execaeduavpid process 2376 18dc8fac237e8cb22397fe44f64c54863b4ed5f490042d759689d149856b8dd3.exe 4188 caeduav -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
description pid process target process PID 2016 wrote to memory of 748 2016 E848.exe PID 2016 wrote to memory of 748 2016 E848.exe PID 2016 wrote to memory of 748 2016 E848.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\18dc8fac237e8cb22397fe44f64c54863b4ed5f490042d759689d149856b8dd3.exe"C:\Users\Admin\AppData\Local\Temp\18dc8fac237e8cb22397fe44f64c54863b4ed5f490042d759689d149856b8dd3.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2376
-
C:\Users\Admin\AppData\Roaming\caeduavC:\Users\Admin\AppData\Roaming\caeduav1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4188
-
C:\Users\Admin\AppData\Local\Temp\E848.exeC:\Users\Admin\AppData\Local\Temp\E848.exe1⤵
- Executes dropped EXE
PID:748
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\E848.exeFilesize
276KB
MD59a636854eb16b6ae20d0152747ccdc87
SHA1839ad2590dc91881058abf89c41cdde28e3c40ed
SHA256730d01a6a7eedbf59ff5fc88ca0e7bf3d2a1fc7d5ede1232f31aa7a06e7b9adc
SHA512d5b88e441a3c609ad59fbc50472d8ae5114543832109532c8d1e9dbf015b2e63b33227cbd904689ea8e2ce308dd8e65d61cfedfa3eae23696d0de3a5d9d2761f
-
C:\Users\Admin\AppData\Local\Temp\E848.exeFilesize
276KB
MD59a636854eb16b6ae20d0152747ccdc87
SHA1839ad2590dc91881058abf89c41cdde28e3c40ed
SHA256730d01a6a7eedbf59ff5fc88ca0e7bf3d2a1fc7d5ede1232f31aa7a06e7b9adc
SHA512d5b88e441a3c609ad59fbc50472d8ae5114543832109532c8d1e9dbf015b2e63b33227cbd904689ea8e2ce308dd8e65d61cfedfa3eae23696d0de3a5d9d2761f
-
C:\Users\Admin\AppData\Roaming\caeduavFilesize
210KB
MD5ebd42ae578479719653b35c33554ccc5
SHA1da79aceadb98f5198c218438e1ff13900b206ec9
SHA25618dc8fac237e8cb22397fe44f64c54863b4ed5f490042d759689d149856b8dd3
SHA5120eaf3f62705ddab16e14a077bc29c52b22a99dd9b2212dcd0aeec9d92843b79b65bdde3b14a9170fc424aace760a6c80970916547039fa697814e7be639c1f12
-
C:\Users\Admin\AppData\Roaming\caeduavFilesize
210KB
MD5ebd42ae578479719653b35c33554ccc5
SHA1da79aceadb98f5198c218438e1ff13900b206ec9
SHA25618dc8fac237e8cb22397fe44f64c54863b4ed5f490042d759689d149856b8dd3
SHA5120eaf3f62705ddab16e14a077bc29c52b22a99dd9b2212dcd0aeec9d92843b79b65bdde3b14a9170fc424aace760a6c80970916547039fa697814e7be639c1f12
-
memory/748-141-0x0000000000000000-mapping.dmp
-
memory/748-146-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/748-145-0x0000000000590000-0x00000000005BA000-memory.dmpFilesize
168KB
-
memory/748-144-0x000000000072D000-0x0000000000747000-memory.dmpFilesize
104KB
-
memory/2376-135-0x0000000000400000-0x0000000002B9D000-memory.dmpFilesize
39.6MB
-
memory/2376-132-0x0000000002C68000-0x0000000002C78000-memory.dmpFilesize
64KB
-
memory/2376-134-0x0000000000400000-0x0000000002B9D000-memory.dmpFilesize
39.6MB
-
memory/2376-133-0x0000000002C20000-0x0000000002C29000-memory.dmpFilesize
36KB
-
memory/4188-140-0x0000000000400000-0x0000000002B9D000-memory.dmpFilesize
39.6MB
-
memory/4188-139-0x0000000000400000-0x0000000002B9D000-memory.dmpFilesize
39.6MB
-
memory/4188-138-0x0000000002DF8000-0x0000000002E08000-memory.dmpFilesize
64KB