Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
25-01-2023 10:59
General
-
Target
file.exe
-
Size
341KB
-
MD5
250973815ae5ccaa0b928d111effe1d7
-
SHA1
5e4f54161514a0c089e5f4d7e90cffb06bb8fbaa
-
SHA256
fe84fac0fd7c599ee46038fe54a9dc45eb4fac8fac8dc3ed84272b100f55652c
-
SHA512
ed54d84220a580f6b70df08308d89f5c272d9b1d9eb941f98228129f557fc168784fa7299c50a39dfcabd09b0753f163edb56844a5a505546251006e7cb07252
-
SSDEEP
6144:uL32eg3D58Dw69VFutShtnzOjq7VWRFBMolz9095m:ur2x3in9VFuSHt7VWR5lz5
Malware Config
Signatures
-
Detects Smokeloader packer ⋅ 1 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE ⋅ 1 IoCs
-
Checks SCSI registry key(s) ⋅ 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses ⋅ 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam ⋅ 1 IoCs
-
Suspicious behavior: MapViewOfSection ⋅ 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exePID:4816"C:\Users\Admin\AppData\Local\Temp\file.exe"Checks SCSI registry key(s)Suspicious behavior: EnumeratesProcessesSuspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\efdvgwwPID:1380C:\Users\Admin\AppData\Roaming\efdvgwwExecutes dropped EXEChecks SCSI registry key(s)Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Replay Monitor
Downloads
-
C:\Users\Admin\AppData\Roaming\efdvgwwFilesize
341KB
MD5250973815ae5ccaa0b928d111effe1d7
SHA15e4f54161514a0c089e5f4d7e90cffb06bb8fbaa
SHA256fe84fac0fd7c599ee46038fe54a9dc45eb4fac8fac8dc3ed84272b100f55652c
SHA512ed54d84220a580f6b70df08308d89f5c272d9b1d9eb941f98228129f557fc168784fa7299c50a39dfcabd09b0753f163edb56844a5a505546251006e7cb07252
-
C:\Users\Admin\AppData\Roaming\efdvgwwFilesize
341KB
MD5250973815ae5ccaa0b928d111effe1d7
SHA15e4f54161514a0c089e5f4d7e90cffb06bb8fbaa
SHA256fe84fac0fd7c599ee46038fe54a9dc45eb4fac8fac8dc3ed84272b100f55652c
SHA512ed54d84220a580f6b70df08308d89f5c272d9b1d9eb941f98228129f557fc168784fa7299c50a39dfcabd09b0753f163edb56844a5a505546251006e7cb07252
-
memory/1380-138-0x000000000060E000-0x0000000000624000-memory.dmpFilesize
88KB
-
memory/1380-139-0x0000000000400000-0x000000000045D000-memory.dmpFilesize
372KB
-
memory/1380-140-0x0000000000400000-0x000000000045D000-memory.dmpFilesize
372KB
-
memory/4816-132-0x00000000006DE000-0x00000000006F3000-memory.dmpFilesize
84KB
-
memory/4816-133-0x00000000005E0000-0x00000000005E9000-memory.dmpFilesize
36KB
-
memory/4816-134-0x0000000000400000-0x000000000045D000-memory.dmpFilesize
372KB
-
memory/4816-135-0x0000000000400000-0x000000000045D000-memory.dmpFilesize
372KB