Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
30/01/2023, 13:19
General
-
Target
8ccd7a50b7f49ffd4bc65ce6389c60a68b6e76f2f595c734a6f410fb15380333.exe
-
Size
199KB
-
MD5
2ceed127a480b715d1229631e84a38ac
-
SHA1
b0d9198a9566a089406d374304eb7b95e2715ea0
-
SHA256
8ccd7a50b7f49ffd4bc65ce6389c60a68b6e76f2f595c734a6f410fb15380333
-
SHA512
fd790f39c172f3469abc6b4f28e6de423f3d4ec64e0892350f6e1b9446887d91dc65ec2f02e8ac4adcbbfd0f32ff0d6ca30d1defa9068e8a808f0114f61b9120
-
SSDEEP
3072:uBN2LS2tmwLb1nkvXtS5t7xoO44U0umYO9FE/xhabgF5Db0YhjWN:CmpLbyvXtk00PYBpAbgF5XdjW
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Program crash 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ccd7a50b7f49ffd4bc65ce6389c60a68b6e76f2f595c734a6f410fb15380333.exe"C:\Users\Admin\AppData\Local\Temp\8ccd7a50b7f49ffd4bc65ce6389c60a68b6e76f2f595c734a6f410fb15380333.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\5469.exeC:\Users\Admin\AppData\Local\Temp\5469.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Eorppuwwrieiyod.dll,start2⤵
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 5202⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1400 -ip 14001⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5f8f43bc988fd35dbd9dc3801223a00c0
SHA1d31a18d5b012d19fb77a6e23dab02a314054672c
SHA2567c63fa71c9d97192d237a05926aa90f3f5d88f3186fa8c1354355046b568c090
SHA51290783521a1d6fd28441128637f96802b53874fb89c2e578f41912cecc73b965c04a94f22fc7210af19a0437f6ad273c1cd003e9a01e4a43e2b1af942cbae5fe1
-
Filesize
3.1MB
MD5f8f43bc988fd35dbd9dc3801223a00c0
SHA1d31a18d5b012d19fb77a6e23dab02a314054672c
SHA2567c63fa71c9d97192d237a05926aa90f3f5d88f3186fa8c1354355046b568c090
SHA51290783521a1d6fd28441128637f96802b53874fb89c2e578f41912cecc73b965c04a94f22fc7210af19a0437f6ad273c1cd003e9a01e4a43e2b1af942cbae5fe1
-
Filesize
4.2MB
MD5e9fb7828bde045d1a62f2dddfa90003c
SHA11cc2b0a63d513fb48d753ff9e037f648a4901d92
SHA256adf89a2683f67bd49bb0bba3ff1c7c350b8beb7b42fb4e19d04329f2671731f6
SHA512df364a00ea1cd814021af8baf36baf146a8171e08afa648c8a8e3d79aa7f95c7ebed611416d3c552a71ccd35ee7be3a181570f53a5f43fb66f5e9f3a285424c4
-
Filesize
4.2MB
MD5e9fb7828bde045d1a62f2dddfa90003c
SHA11cc2b0a63d513fb48d753ff9e037f648a4901d92
SHA256adf89a2683f67bd49bb0bba3ff1c7c350b8beb7b42fb4e19d04329f2671731f6
SHA512df364a00ea1cd814021af8baf36baf146a8171e08afa648c8a8e3d79aa7f95c7ebed611416d3c552a71ccd35ee7be3a181570f53a5f43fb66f5e9f3a285424c4
-
Filesize
4.2MB
MD5e9fb7828bde045d1a62f2dddfa90003c
SHA11cc2b0a63d513fb48d753ff9e037f648a4901d92
SHA256adf89a2683f67bd49bb0bba3ff1c7c350b8beb7b42fb4e19d04329f2671731f6
SHA512df364a00ea1cd814021af8baf36baf146a8171e08afa648c8a8e3d79aa7f95c7ebed611416d3c552a71ccd35ee7be3a181570f53a5f43fb66f5e9f3a285424c4
-
Filesize
3.7MB
-
Filesize
3.0MB
-
Filesize
42.5MB
-
Filesize
42.5MB
-
Filesize
4.2MB
-
Filesize
76KB
-
Filesize
39.6MB
-
Filesize
39.6MB
-
Filesize
36KB