Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
06-02-2023 20:08
General
-
Target
file.exe
-
Size
299KB
-
MD5
aa5a5c1a74dfeeeae5e3ad5b8918e895
-
SHA1
08bf1a1b6d5d4e3b52fd3605c948949fa9eebfe8
-
SHA256
9c61453e154e13f1c384a83ca3ac0331cde96ae9d8652dbb8366722cb1adf8b4
-
SHA512
88d26a2e6f1efc50d52cf1e9d7addcdbd5d0b3ef8035561d12cf5dc6718699ce1e2aaacacb2d4ee89c952493fddc74e07a4b06dd65d832964b55421ad58bcfc7
-
SSDEEP
3072:CEeb6bdqLZFRGh6vzIXWnSiowFtXtdsnc41ObuQjiMTE5B00afZi:CTGqLZKh6cmQwP8n71WuQj9Uah
Malware Config
Signatures
-
Detects Smokeloader packer 6 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 2 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\afeijuvC:\Users\Admin\AppData\Roaming\afeijuv1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\afeijuvC:\Users\Admin\AppData\Roaming\afeijuv2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\afeijuvFilesize
299KB
MD5aa5a5c1a74dfeeeae5e3ad5b8918e895
SHA108bf1a1b6d5d4e3b52fd3605c948949fa9eebfe8
SHA2569c61453e154e13f1c384a83ca3ac0331cde96ae9d8652dbb8366722cb1adf8b4
SHA51288d26a2e6f1efc50d52cf1e9d7addcdbd5d0b3ef8035561d12cf5dc6718699ce1e2aaacacb2d4ee89c952493fddc74e07a4b06dd65d832964b55421ad58bcfc7
-
C:\Users\Admin\AppData\Roaming\afeijuvFilesize
299KB
MD5aa5a5c1a74dfeeeae5e3ad5b8918e895
SHA108bf1a1b6d5d4e3b52fd3605c948949fa9eebfe8
SHA2569c61453e154e13f1c384a83ca3ac0331cde96ae9d8652dbb8366722cb1adf8b4
SHA51288d26a2e6f1efc50d52cf1e9d7addcdbd5d0b3ef8035561d12cf5dc6718699ce1e2aaacacb2d4ee89c952493fddc74e07a4b06dd65d832964b55421ad58bcfc7
-
C:\Users\Admin\AppData\Roaming\afeijuvFilesize
299KB
MD5aa5a5c1a74dfeeeae5e3ad5b8918e895
SHA108bf1a1b6d5d4e3b52fd3605c948949fa9eebfe8
SHA2569c61453e154e13f1c384a83ca3ac0331cde96ae9d8652dbb8366722cb1adf8b4
SHA51288d26a2e6f1efc50d52cf1e9d7addcdbd5d0b3ef8035561d12cf5dc6718699ce1e2aaacacb2d4ee89c952493fddc74e07a4b06dd65d832964b55421ad58bcfc7
-
memory/3892-143-0x000000000072E000-0x0000000000743000-memory.dmpFilesize
84KB
-
memory/4388-140-0x0000000000000000-mapping.dmp
-
memory/4388-144-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4388-145-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4444-133-0x0000000000000000-mapping.dmp
-
memory/4444-134-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4444-136-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4444-137-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4612-135-0x0000000000680000-0x0000000000689000-memory.dmpFilesize
36KB