Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
03/02/2023, 14:35
General
-
Target
e2145cb74caf435887344832b31954afd855e60d07cfa5fe2a0bcc4a32b8c363.exe
-
Size
192KB
-
MD5
9256d4a73e6f2a37e0713aaf3dfcb88d
-
SHA1
5e60d3ca6d38e008b18cc6ba08014eb0344356ef
-
SHA256
e2145cb74caf435887344832b31954afd855e60d07cfa5fe2a0bcc4a32b8c363
-
SHA512
36ce00d436146223ed76dfc79819fda18fc1be6351e224d3ba1ec75d33d7b97284b0cf00bfcf1842a7d3fcc066f52af266ed9e48d1ee70ad0b0f869e56c9ccf5
-
SSDEEP
3072:ze7XMAD7vr36JVfKrZLH3R48RWH9R5ZxJPpEtTkJQIXJNNnvq6b5:zej6JlQLXRFRYJsBIXJNFR5
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Program crash 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2145cb74caf435887344832b31954afd855e60d07cfa5fe2a0bcc4a32b8c363.exe"C:\Users\Admin\AppData\Local\Temp\e2145cb74caf435887344832b31954afd855e60d07cfa5fe2a0bcc4a32b8c363.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\E17B.exeC:\Users\Admin\AppData\Local\Temp\E17B.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Aupsoyqaypedu.dll,start2⤵
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 4842⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2528 -ip 25281⤵
-
C:\Users\Admin\AppData\Local\Temp\538F.exeC:\Users\Admin\AppData\Local\Temp\538F.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exeC:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD5331a5ef73860d94dd69ee35210d4fc61
SHA16342d7782beadcb5fee319dda180fa0f69d35eb9
SHA256f1b4ce96834fc41a883c240f2b3197b399bf14e84fddddfae213ac5af49bc28e
SHA5124ccfe942f2165543105bf6ca240e2d50290c628b274145cc2a089b31e931dff191280b955979e59afc54c6a319b90fddf18959a7c50db1b612bc669d3c197675
-
Filesize
1.8MB
MD5331a5ef73860d94dd69ee35210d4fc61
SHA16342d7782beadcb5fee319dda180fa0f69d35eb9
SHA256f1b4ce96834fc41a883c240f2b3197b399bf14e84fddddfae213ac5af49bc28e
SHA5124ccfe942f2165543105bf6ca240e2d50290c628b274145cc2a089b31e931dff191280b955979e59afc54c6a319b90fddf18959a7c50db1b612bc669d3c197675
-
Filesize
4.3MB
MD59aadd9003b18235e0240cfb0127d1fbe
SHA15f98607d16409a3ea2b231e944c1350cd4a1c916
SHA256dfaf812aef1bedbdd10047d482783688a667382d7c2692da8d032a5d97c55ce2
SHA512a4b20fe1dc7eae6184a8da61521cbfc20ac5bf47f60479ea9895609537e0e76114738f060062f870fc70ac992227e5280039fc5cbb9928f1854745fecd634e3f
-
Filesize
4.3MB
MD59aadd9003b18235e0240cfb0127d1fbe
SHA15f98607d16409a3ea2b231e944c1350cd4a1c916
SHA256dfaf812aef1bedbdd10047d482783688a667382d7c2692da8d032a5d97c55ce2
SHA512a4b20fe1dc7eae6184a8da61521cbfc20ac5bf47f60479ea9895609537e0e76114738f060062f870fc70ac992227e5280039fc5cbb9928f1854745fecd634e3f
-
Filesize
4.3MB
MD59aadd9003b18235e0240cfb0127d1fbe
SHA15f98607d16409a3ea2b231e944c1350cd4a1c916
SHA256dfaf812aef1bedbdd10047d482783688a667382d7c2692da8d032a5d97c55ce2
SHA512a4b20fe1dc7eae6184a8da61521cbfc20ac5bf47f60479ea9895609537e0e76114738f060062f870fc70ac992227e5280039fc5cbb9928f1854745fecd634e3f
-
Filesize
3.6MB
MD5623b0aa79d1a8121f21e2fd5d4a4f2ff
SHA1a1ad370bf954b27178fb685774ea5a00faf50dd7
SHA256bbe0ef5e3c8395e0408887b03a82bc3c45be04e6fa3e5bb1dc5aa970119a7791
SHA512f010ca39e0f72d74a3d53033d550967822be5dafad860933b529340d559c31eead5ebcc71abf4453e184385faaa83817aed4074e1b5f575aeed0c6cc20ce332e
-
Filesize
3.6MB
MD5623b0aa79d1a8121f21e2fd5d4a4f2ff
SHA1a1ad370bf954b27178fb685774ea5a00faf50dd7
SHA256bbe0ef5e3c8395e0408887b03a82bc3c45be04e6fa3e5bb1dc5aa970119a7791
SHA512f010ca39e0f72d74a3d53033d550967822be5dafad860933b529340d559c31eead5ebcc71abf4453e184385faaa83817aed4074e1b5f575aeed0c6cc20ce332e
-
Filesize
611.3MB
MD51f0bc21fcf031b4c40c124aa67b9295b
SHA1d297ac875e2c8319e1fb7f0f0356eadd91b8e8ef
SHA2562afbf5a97f1e33538c5a309371f30f3bc210ef5630df76faf6ff0bcf1808537b
SHA512dc4c7c5dca3e31885d5e398248a1d56be5dfffbdd6cb5b6c8c93d3c7b6ef866a5f2454ba7b8accf02b59a9e4d3e426f56b9004c1336fb89977c18314f81f918a
-
Filesize
607.1MB
MD5c273f2e62add201d12d11fcea6b2ab7e
SHA16508a4c3b38554591b102c456ca2ca0577d1ee69
SHA25683fb77baf6f2729e03a8429005d8e1a8bb156a7ddd46c061e23b486d468b9768
SHA5128e223cb8215f98eec3d90c9da68ff6adc3ead0ac11adf5039d7d1dfc24c1b943a956e492c171b6f0e275918a92fa3ae422f00e6f335a39a8c5b3f89e7952319a
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
1.7MB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
36KB
-
Filesize
76KB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
3.5MB
-
Filesize
4.9MB
-
Filesize
4.0MB
-
Filesize
3.8MB
-
Filesize
1.7MB
-
Filesize
4.0MB
-
Filesize
4.3MB