Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
31-01-2023 23:57
General
-
Target
fa0c5f16c7c78823b721cca2e63b6c2723379d0748cd0465a7718f8d4d88a940.exe
-
Size
299KB
-
MD5
3b8cb18a3aa1dd5e3eff31da2fd1aebf
-
SHA1
e31f217df449ca9216130f6d8c7749f864b864fa
-
SHA256
fa0c5f16c7c78823b721cca2e63b6c2723379d0748cd0465a7718f8d4d88a940
-
SHA512
f4d28c56c09b446f0b40a8db51da92a6a5ccfa28ecbfa01283da6ad4237802cfdb43965273ef6a1545a3367a153151ef33d63096b6d116345522413e044df9e1
-
SSDEEP
3072:Tznvz4LPqXRskmG/or72vePGedSLq5lao4WdMIQZKmqPUx6WfQz86YpRi3MM5A:Xz4LP9v2mPGa5/r2IHmqMoIdpg8M5
Malware Config
Signatures
-
Detects Smokeloader packer 6 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 2 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa0c5f16c7c78823b721cca2e63b6c2723379d0748cd0465a7718f8d4d88a940.exe"C:\Users\Admin\AppData\Local\Temp\fa0c5f16c7c78823b721cca2e63b6c2723379d0748cd0465a7718f8d4d88a940.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fa0c5f16c7c78823b721cca2e63b6c2723379d0748cd0465a7718f8d4d88a940.exe"C:\Users\Admin\AppData\Local\Temp\fa0c5f16c7c78823b721cca2e63b6c2723379d0748cd0465a7718f8d4d88a940.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Roaming\acffbttC:\Users\Admin\AppData\Roaming\acffbtt1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\acffbttC:\Users\Admin\AppData\Roaming\acffbtt2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
299KB
MD53b8cb18a3aa1dd5e3eff31da2fd1aebf
SHA1e31f217df449ca9216130f6d8c7749f864b864fa
SHA256fa0c5f16c7c78823b721cca2e63b6c2723379d0748cd0465a7718f8d4d88a940
SHA512f4d28c56c09b446f0b40a8db51da92a6a5ccfa28ecbfa01283da6ad4237802cfdb43965273ef6a1545a3367a153151ef33d63096b6d116345522413e044df9e1
-
Filesize
299KB
MD53b8cb18a3aa1dd5e3eff31da2fd1aebf
SHA1e31f217df449ca9216130f6d8c7749f864b864fa
SHA256fa0c5f16c7c78823b721cca2e63b6c2723379d0748cd0465a7718f8d4d88a940
SHA512f4d28c56c09b446f0b40a8db51da92a6a5ccfa28ecbfa01283da6ad4237802cfdb43965273ef6a1545a3367a153151ef33d63096b6d116345522413e044df9e1
-
Filesize
299KB
MD53b8cb18a3aa1dd5e3eff31da2fd1aebf
SHA1e31f217df449ca9216130f6d8c7749f864b864fa
SHA256fa0c5f16c7c78823b721cca2e63b6c2723379d0748cd0465a7718f8d4d88a940
SHA512f4d28c56c09b446f0b40a8db51da92a6a5ccfa28ecbfa01283da6ad4237802cfdb43965273ef6a1545a3367a153151ef33d63096b6d116345522413e044df9e1
-
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
36KB
-
-
Filesize
88KB
-
Filesize
36KB
-
Filesize
88KB