Resubmissions
21-02-2024 21:44
240221-1lqdrafg5w 1021-02-2024 18:39
240221-xanh8sdd21 1015-02-2023 18:24
230215-w18fnada5x 1015-02-2023 17:35
230215-v6c19scg9t 1010-02-2023 13:30
230210-qr8geaah9x 1010-02-2023 13:25
230210-qn1x6abc29 1010-02-2023 13:11
230210-qe8awaag29 1029-01-2023 06:15
230129-gzxv7sbe38 1029-01-2023 06:02
230129-grzptsbb44 10Analysis
-
max time kernel
601s -
max time network
497s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2023 06:15
Static task
static1
Behavioral task
behavioral1
Sample
79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exe
Resource
win10v2004-20220812-en
General
-
Target
79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exe
-
Size
298KB
-
MD5
11511ba5fd4de1fc5051d0bcefb388ae
-
SHA1
5e9476f39df92e01d0952e703869e71f85d470cd
-
SHA256
79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a
-
SHA512
904f0e3a252cd0ef8108492de955ac520008b10b66da736cc4bbdc6a8c3736440a9a11edb73707ba415d7f3f4c2c590dfa983aca01864b9d66a6c3559ed744e9
-
SSDEEP
3072:0pb2LIT54Ga9Qzgp4gaCJrSjgBoMZmYKxQCBnIyCSyxzID1C7hZW0KIsiuNZ:xLIKGa96dfkBoMsDlqSwzIDM/KPP
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3912-133-0x0000000000700000-0x0000000000709000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 1 IoCs
Processes:
fajwwwrpid process 1644 fajwwwr -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exefajwwwrdescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fajwwwr Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fajwwwr Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fajwwwr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exepid process 3912 79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exe 3912 79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exe 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 744 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 744 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exefajwwwrpid process 3912 79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exe 1644 fajwwwr -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 744 Token: SeCreatePagefilePrivilege 744 Token: SeShutdownPrivilege 744 Token: SeCreatePagefilePrivilege 744
Processes
-
C:\Users\Admin\AppData\Local\Temp\79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exe"C:\Users\Admin\AppData\Local\Temp\79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\fajwwwrC:\Users\Admin\AppData\Roaming\fajwwwr1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\fajwwwrFilesize
298KB
MD511511ba5fd4de1fc5051d0bcefb388ae
SHA15e9476f39df92e01d0952e703869e71f85d470cd
SHA25679fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a
SHA512904f0e3a252cd0ef8108492de955ac520008b10b66da736cc4bbdc6a8c3736440a9a11edb73707ba415d7f3f4c2c590dfa983aca01864b9d66a6c3559ed744e9
-
C:\Users\Admin\AppData\Roaming\fajwwwrFilesize
298KB
MD511511ba5fd4de1fc5051d0bcefb388ae
SHA15e9476f39df92e01d0952e703869e71f85d470cd
SHA25679fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a
SHA512904f0e3a252cd0ef8108492de955ac520008b10b66da736cc4bbdc6a8c3736440a9a11edb73707ba415d7f3f4c2c590dfa983aca01864b9d66a6c3559ed744e9
-
memory/1644-138-0x00000000005A8000-0x00000000005BD000-memory.dmpFilesize
84KB
-
memory/1644-139-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/1644-140-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/3912-132-0x0000000000768000-0x000000000077E000-memory.dmpFilesize
88KB
-
memory/3912-133-0x0000000000700000-0x0000000000709000-memory.dmpFilesize
36KB
-
memory/3912-134-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/3912-135-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB