Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
06-02-2023 20:50
Static task
static1
Behavioral task
behavioral1
Sample
fb7ea2b876c6a5352336f12df2b4029fc06aea96b70b0e8be560ebecd943026c.exe
Resource
win10v2004-20221111-en
General
-
Target
fb7ea2b876c6a5352336f12df2b4029fc06aea96b70b0e8be560ebecd943026c.exe
-
Size
300KB
-
MD5
0f700e4b1a6487ac2aa66a4364fa1d49
-
SHA1
be348e7999158ed52fb5c01d601152930c28dbfc
-
SHA256
fb7ea2b876c6a5352336f12df2b4029fc06aea96b70b0e8be560ebecd943026c
-
SHA512
6472512a879ca1a872f8181214ba0078fcf128a17cdc71e23d0b8c21fde5f9ef39d4383838aa06568e79a0258997fedc04edf8dafc2486eb5d80d03fd4365692
-
SSDEEP
3072:C5Ob6bxOkLsZDRGXDeRTHK3TSFK2adEPDGsuQjiMTE5i6ydk4qafZi:CM63LogTeRGDSUFOysuQj9Pjqah
Malware Config
Signatures
-
Detects Smokeloader packer 4 IoCs
Processes:
resource yara_rule behavioral1/memory/672-133-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/4936-135-0x0000000002200000-0x0000000002209000-memory.dmp family_smokeloader behavioral1/memory/672-136-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/672-137-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
fb7ea2b876c6a5352336f12df2b4029fc06aea96b70b0e8be560ebecd943026c.exedescription pid process target process PID 4936 set thread context of 672 4936 fb7ea2b876c6a5352336f12df2b4029fc06aea96b70b0e8be560ebecd943026c.exe fb7ea2b876c6a5352336f12df2b4029fc06aea96b70b0e8be560ebecd943026c.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
fb7ea2b876c6a5352336f12df2b4029fc06aea96b70b0e8be560ebecd943026c.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fb7ea2b876c6a5352336f12df2b4029fc06aea96b70b0e8be560ebecd943026c.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fb7ea2b876c6a5352336f12df2b4029fc06aea96b70b0e8be560ebecd943026c.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fb7ea2b876c6a5352336f12df2b4029fc06aea96b70b0e8be560ebecd943026c.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
fb7ea2b876c6a5352336f12df2b4029fc06aea96b70b0e8be560ebecd943026c.exepid process 672 fb7ea2b876c6a5352336f12df2b4029fc06aea96b70b0e8be560ebecd943026c.exe 672 fb7ea2b876c6a5352336f12df2b4029fc06aea96b70b0e8be560ebecd943026c.exe 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 2716 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2716 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
fb7ea2b876c6a5352336f12df2b4029fc06aea96b70b0e8be560ebecd943026c.exepid process 672 fb7ea2b876c6a5352336f12df2b4029fc06aea96b70b0e8be560ebecd943026c.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
fb7ea2b876c6a5352336f12df2b4029fc06aea96b70b0e8be560ebecd943026c.exedescription pid process target process PID 4936 wrote to memory of 672 4936 fb7ea2b876c6a5352336f12df2b4029fc06aea96b70b0e8be560ebecd943026c.exe fb7ea2b876c6a5352336f12df2b4029fc06aea96b70b0e8be560ebecd943026c.exe PID 4936 wrote to memory of 672 4936 fb7ea2b876c6a5352336f12df2b4029fc06aea96b70b0e8be560ebecd943026c.exe fb7ea2b876c6a5352336f12df2b4029fc06aea96b70b0e8be560ebecd943026c.exe PID 4936 wrote to memory of 672 4936 fb7ea2b876c6a5352336f12df2b4029fc06aea96b70b0e8be560ebecd943026c.exe fb7ea2b876c6a5352336f12df2b4029fc06aea96b70b0e8be560ebecd943026c.exe PID 4936 wrote to memory of 672 4936 fb7ea2b876c6a5352336f12df2b4029fc06aea96b70b0e8be560ebecd943026c.exe fb7ea2b876c6a5352336f12df2b4029fc06aea96b70b0e8be560ebecd943026c.exe PID 4936 wrote to memory of 672 4936 fb7ea2b876c6a5352336f12df2b4029fc06aea96b70b0e8be560ebecd943026c.exe fb7ea2b876c6a5352336f12df2b4029fc06aea96b70b0e8be560ebecd943026c.exe PID 4936 wrote to memory of 672 4936 fb7ea2b876c6a5352336f12df2b4029fc06aea96b70b0e8be560ebecd943026c.exe fb7ea2b876c6a5352336f12df2b4029fc06aea96b70b0e8be560ebecd943026c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb7ea2b876c6a5352336f12df2b4029fc06aea96b70b0e8be560ebecd943026c.exe"C:\Users\Admin\AppData\Local\Temp\fb7ea2b876c6a5352336f12df2b4029fc06aea96b70b0e8be560ebecd943026c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fb7ea2b876c6a5352336f12df2b4029fc06aea96b70b0e8be560ebecd943026c.exe"C:\Users\Admin\AppData\Local\Temp\fb7ea2b876c6a5352336f12df2b4029fc06aea96b70b0e8be560ebecd943026c.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/672-132-0x0000000000000000-mapping.dmp
-
memory/672-133-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/672-136-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/672-137-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4936-134-0x000000000056E000-0x0000000000583000-memory.dmpFilesize
84KB
-
memory/4936-135-0x0000000002200000-0x0000000002209000-memory.dmpFilesize
36KB