Analysis
- max time kernel
150s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
17/01/2023, 11:35
General
- Target file.exe
- Size 210KB
- Sample230117-np1mnsfb32
- SHA256 f6e0d121b7feaa0d5a6a03f2485d72a85a2995de3d25435bd1ff968c577fa6ef
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Blocklisted process makes network request 3 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 19 IoCs
- Checks computer location settings 2 TTPs 18 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 18 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 23 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Modifies registry class 30 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 50 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\FE0C.exeC:\Users\Admin\AppData\Local\Temp\FE0C.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FE0C.exe"C:\Users\Admin\AppData\Local\Temp\FE0C.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FE0C.exe"C:\Users\Admin\AppData\Local\Temp\FE0C.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FE0C.exe"C:\Users\Admin\AppData\Local\Temp\FE0C.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FE0C.exe"C:\Users\Admin\AppData\Local\Temp\FE0C.exe"5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FE0C.exe"C:\Users\Admin\AppData\Local\Temp\FE0C.exe"6⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FE0C.exe"C:\Users\Admin\AppData\Local\Temp\FE0C.exe"7⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FE0C.exe"C:\Users\Admin\AppData\Local\Temp\FE0C.exe"8⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FE0C.exe"C:\Users\Admin\AppData\Local\Temp\FE0C.exe"9⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FE0C.exe"C:\Users\Admin\AppData\Local\Temp\FE0C.exe"10⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FE0C.exe"C:\Users\Admin\AppData\Local\Temp\FE0C.exe"11⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FE0C.exe"C:\Users\Admin\AppData\Local\Temp\FE0C.exe"12⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FE0C.exe"C:\Users\Admin\AppData\Local\Temp\FE0C.exe"13⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FE0C.exe"C:\Users\Admin\AppData\Local\Temp\FE0C.exe"14⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FE0C.exe"C:\Users\Admin\AppData\Local\Temp\FE0C.exe"15⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FE0C.exe"C:\Users\Admin\AppData\Local\Temp\FE0C.exe"16⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FE0C.exe"C:\Users\Admin\AppData\Local\Temp\FE0C.exe"17⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FE0C.exe"C:\Users\Admin\AppData\Local\Temp\FE0C.exe"18⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FE0C.exe"C:\Users\Admin\AppData\Local\Temp\FE0C.exe"19⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 120019⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 86418⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1876 -s 112817⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 112816⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 89215⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 86814⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 90013⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 86412⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 126411⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 88410⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 12489⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 12608⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 11287⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 11886⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 11285⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 8644⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 8643⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Udtshesidi.tmp",Wpfprp2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 190133⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 12922⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4848 -ip 48481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4980 -ip 49801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4244 -ip 42441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4372 -ip 43721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1644 -ip 16441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3192 -ip 31921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4164 -ip 41641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1104 -ip 11041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1340 -ip 13401⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 1012 -ip 10121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 8 -ip 81⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 220 -ip 2201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3768 -ip 37681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 1868 -ip 18681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 4400 -ip 44001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1876 -ip 18761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4968 -ip 49681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1720 -ip 17201⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
FE0C.exe
FE0C.exe
FE0C.exe
FE0C.exe
FE0C.exe
FE0C.exe
FE0C.exe
FE0C.exe
FE0C.exe
FE0C.exe
FE0C.exe
FE0C.exe
FE0C.exe
FE0C.exe
FE0C.exe
FE0C.exe
FE0C.exe
FE0C.exe
FE0C.exe
FE0C.exe
Udtshesidi.tmp
Udtshesidi.tmp
memory/8-202-0x0000000000400000-0x0000000002DBC000-memory.dmp
memory/8-201-0x0000000004A95000-0x0000000004CC4000-memory.dmp
memory/8-205-0x0000000000400000-0x0000000002DBC000-memory.dmp
memory/220-209-0x0000000004AC4000-0x0000000004CF3000-memory.dmp
memory/220-210-0x0000000000400000-0x0000000002DBC000-memory.dmp
memory/1012-199-0x0000000000400000-0x0000000002DBC000-memory.dmp
memory/1012-206-0x0000000000400000-0x0000000002DBC000-memory.dmp
memory/1012-198-0x0000000004AA4000-0x0000000004CD3000-memory.dmp
memory/1104-177-0x0000000004CA3000-0x0000000004ED2000-memory.dmp
memory/1104-178-0x0000000000400000-0x0000000002DBC000-memory.dmp
memory/1112-134-0x0000000000400000-0x0000000002B9D000-memory.dmp
memory/1112-133-0x0000000002C10000-0x0000000002C19000-memory.dmp
memory/1112-132-0x0000000002D59000-0x0000000002D69000-memory.dmp
memory/1112-135-0x0000000000400000-0x0000000002B9D000-memory.dmp
memory/1340-194-0x0000000000400000-0x0000000002DBC000-memory.dmp
memory/1340-193-0x0000000004B6F000-0x0000000004D9E000-memory.dmp
memory/1340-200-0x0000000000400000-0x0000000002DBC000-memory.dmp
memory/1644-163-0x0000000004AAB000-0x0000000004CDA000-memory.dmp
memory/1644-164-0x0000000000400000-0x0000000002DBC000-memory.dmp
memory/1720-234-0x0000000000400000-0x0000000002DBC000-memory.dmp
memory/1720-233-0x0000000004A82000-0x0000000004CB1000-memory.dmp
memory/1868-217-0x0000000004A6F000-0x0000000004C9E000-memory.dmp
memory/1868-218-0x0000000000400000-0x0000000002DBC000-memory.dmp
memory/1876-225-0x0000000004B1A000-0x0000000004D49000-memory.dmp
memory/1876-226-0x0000000000400000-0x0000000002DBC000-memory.dmp
memory/2200-185-0x0000000004710000-0x0000000004850000-memory.dmp
memory/2200-181-0x0000000004710000-0x0000000004850000-memory.dmp
memory/2200-183-0x0000000004710000-0x0000000004850000-memory.dmp
memory/2200-176-0x0000000004FC0000-0x0000000005B23000-memory.dmp
memory/2200-179-0x0000000004FC0000-0x0000000005B23000-memory.dmp
memory/2200-180-0x0000000004710000-0x0000000004850000-memory.dmp
memory/2200-195-0x0000000004FC0000-0x0000000005B23000-memory.dmp
memory/2200-184-0x0000000004710000-0x0000000004850000-memory.dmp
memory/2200-182-0x0000000004710000-0x0000000004850000-memory.dmp
memory/3192-167-0x0000000004A22000-0x0000000004C51000-memory.dmp
memory/3192-168-0x0000000000400000-0x0000000002DBC000-memory.dmp
memory/3768-214-0x0000000000400000-0x0000000002DBC000-memory.dmp
memory/3768-213-0x0000000004B23000-0x0000000004D52000-memory.dmp
memory/4164-173-0x0000000000400000-0x0000000002DBC000-memory.dmp
memory/4164-172-0x0000000004A2B000-0x0000000004C5A000-memory.dmp
memory/4244-156-0x0000000000400000-0x0000000002DBC000-memory.dmp
memory/4244-155-0x0000000004A7C000-0x0000000004CAB000-memory.dmp
memory/4372-169-0x0000000000400000-0x0000000002DBC000-memory.dmp
memory/4372-159-0x0000000004A49000-0x0000000004C78000-memory.dmp
memory/4372-160-0x0000000000400000-0x0000000002DBC000-memory.dmp
memory/4400-221-0x0000000004B27000-0x0000000004D56000-memory.dmp
memory/4400-222-0x0000000000400000-0x0000000002DBC000-memory.dmp
memory/4848-146-0x0000000000400000-0x0000000002DBC000-memory.dmp
memory/4848-147-0x0000000000400000-0x0000000002DBC000-memory.dmp
memory/4848-140-0x0000000004B1C000-0x0000000004D4B000-memory.dmp
memory/4848-143-0x0000000004D50000-0x0000000004FC0000-memory.dmp
memory/4968-229-0x0000000004ACB000-0x0000000004CFA000-memory.dmp
memory/4968-230-0x0000000000400000-0x0000000002DBC000-memory.dmp
memory/4980-152-0x0000000000400000-0x0000000002DBC000-memory.dmp
memory/4980-149-0x0000000000400000-0x0000000002DBC000-memory.dmp
memory/4980-148-0x0000000004A9F000-0x0000000004CCE000-memory.dmp
memory/5096-190-0x0000016F71430000-0x0000016F716D2000-memory.dmp
memory/5096-189-0x0000000000130000-0x00000000003C1000-memory.dmp
memory/5096-188-0x0000016F72E80000-0x0000016F72FC0000-memory.dmp
memory/5096-187-0x0000016F72E80000-0x0000016F72FC0000-memory.dmp