Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
-
submitted
01/02/2023, 13:48
General
-
Target
8b833a65aa211e8c3d50245be670dee1326333c71d8f4d17cf108df28c3f4f9b.exe
-
Size
225KB
-
MD5
19b3bb5e1b49fae5683771a114eb2b54
-
SHA1
0e090e04a3ec9b4617968193ab43f94f13fc80e1
-
SHA256
8b833a65aa211e8c3d50245be670dee1326333c71d8f4d17cf108df28c3f4f9b
-
SHA512
bce104e72a015b4c5ae7aa18f6d50ec1b013184a3a1fc17839e2950e2639be39de8343dba4c701101784b2b56324498a438dec6d7a2f7a1e10223c3aed3f0d63
-
SSDEEP
6144:xmPx8X8hLNI/n9A93N5Ip0wTuRMbwrPn:xm5FxI/9A9wpFTu+bwrP
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
-
Deletes itself 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b833a65aa211e8c3d50245be670dee1326333c71d8f4d17cf108df28c3f4f9b.exe"C:\Users\Admin\AppData\Local\Temp\8b833a65aa211e8c3d50245be670dee1326333c71d8f4d17cf108df28c3f4f9b.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\AFC.exeC:\Users\Admin\AppData\Local\Temp\AFC.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Rqdarrhtrsoihy.dll,start2⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Roaming\hudcwwfC:\Users\Admin\AppData\Roaming\hudcwwf1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD5c8db2328026625bc1a9cc5628fa0a36c
SHA11e52cdd8761a75f15746e0f84640544415ffcfe6
SHA2569f24c13f6a9e99b702004259acc932a2cc0a4506b40274d64e92527e8e06b930
SHA512aa2f3589e09cfb81a9c0c06cd897b3d83a044496ead22af5521ad06e9c269d84d228fa39fe3e370b3fdde1184a4b2d1d91d661e9a46d76b8a2446a11df551a67
-
Filesize
3.2MB
MD5c8db2328026625bc1a9cc5628fa0a36c
SHA11e52cdd8761a75f15746e0f84640544415ffcfe6
SHA2569f24c13f6a9e99b702004259acc932a2cc0a4506b40274d64e92527e8e06b930
SHA512aa2f3589e09cfb81a9c0c06cd897b3d83a044496ead22af5521ad06e9c269d84d228fa39fe3e370b3fdde1184a4b2d1d91d661e9a46d76b8a2446a11df551a67
-
Filesize
4.3MB
MD5e7d1b0006fff31b83f7cfa73c814242b
SHA1d656de1ca21b9c3defbdd0bdd9d9e6206650d322
SHA256cf0e140ed82af710d60752098c00666dadef7ff7f6f306ec1f34c7e2d7e42a54
SHA51254b18c73a511eb16ea20aa86048cfb96e1f83fb55152f97eba8e9d57e2433ad64ddcc3dc8889d06b00ed7258436b25779cd04df9c0b9967027edd3bd0a7eceee
-
Filesize
225KB
MD519b3bb5e1b49fae5683771a114eb2b54
SHA10e090e04a3ec9b4617968193ab43f94f13fc80e1
SHA2568b833a65aa211e8c3d50245be670dee1326333c71d8f4d17cf108df28c3f4f9b
SHA512bce104e72a015b4c5ae7aa18f6d50ec1b013184a3a1fc17839e2950e2639be39de8343dba4c701101784b2b56324498a438dec6d7a2f7a1e10223c3aed3f0d63
-
Filesize
225KB
MD519b3bb5e1b49fae5683771a114eb2b54
SHA10e090e04a3ec9b4617968193ab43f94f13fc80e1
SHA2568b833a65aa211e8c3d50245be670dee1326333c71d8f4d17cf108df28c3f4f9b
SHA512bce104e72a015b4c5ae7aa18f6d50ec1b013184a3a1fc17839e2950e2639be39de8343dba4c701101784b2b56324498a438dec6d7a2f7a1e10223c3aed3f0d63
-
Filesize
4.3MB
MD5e7d1b0006fff31b83f7cfa73c814242b
SHA1d656de1ca21b9c3defbdd0bdd9d9e6206650d322
SHA256cf0e140ed82af710d60752098c00666dadef7ff7f6f306ec1f34c7e2d7e42a54
SHA51254b18c73a511eb16ea20aa86048cfb96e1f83fb55152f97eba8e9d57e2433ad64ddcc3dc8889d06b00ed7258436b25779cd04df9c0b9967027edd3bd0a7eceee
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
42.6MB
-
Filesize
1.6MB
-
Filesize
3.7MB
-
Filesize
3.1MB
-
Filesize
42.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
3.7MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
3.1MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
39.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
39.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
36KB
-
Filesize
1.6MB
-
Filesize
1.3MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.3MB
-
Filesize
39.6MB
-
Filesize
39.6MB