Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
07-02-2023 00:09
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20221111-en
General
-
Target
file.exe
-
Size
298KB
-
MD5
bf0dfde86387701ca7f2d0f588f45a67
-
SHA1
b1f7c5849a945d0c8e75e6bfd8b2c05a2571819d
-
SHA256
c2121e45bca3f193881080e9319f1f462217ccb8c3aeb05de6c9a2bf85c2cc43
-
SHA512
75aea76728e589c15f2458564b970650bb6767ad6ac5724dcf9d6be43de43e642fcdcde2d87a294be82ac6798acddc4c6723e8180ddf2f0684f759c2bbdebf3b
-
SSDEEP
6144:CWyuEL5Q8Hr/1thY8S5vuPRkluQj9RLy4a3:Czflrb1thBYeR4ljPLZ
Malware Config
Signatures
-
Detects Smokeloader packer 6 IoCs
Processes:
resource yara_rule behavioral2/memory/4788-133-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral2/memory/4804-135-0x0000000000760000-0x0000000000769000-memory.dmp family_smokeloader behavioral2/memory/4788-136-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral2/memory/4788-137-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral2/memory/4556-144-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral2/memory/4556-145-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 2 IoCs
Processes:
fffrbhufffrbhupid process 3452 fffrbhu 4556 fffrbhu -
Suspicious use of SetThreadContext 2 IoCs
Processes:
file.exefffrbhudescription pid process target process PID 4804 set thread context of 4788 4804 file.exe file.exe PID 3452 set thread context of 4556 3452 fffrbhu fffrbhu -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
file.exefffrbhudescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fffrbhu Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fffrbhu Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fffrbhu Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
file.exepid process 4788 file.exe 4788 file.exe 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 2600 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2600 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
file.exefffrbhupid process 4788 file.exe 4556 fffrbhu -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 2600 Token: SeCreatePagefilePrivilege 2600 -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
file.exefffrbhudescription pid process target process PID 4804 wrote to memory of 4788 4804 file.exe file.exe PID 4804 wrote to memory of 4788 4804 file.exe file.exe PID 4804 wrote to memory of 4788 4804 file.exe file.exe PID 4804 wrote to memory of 4788 4804 file.exe file.exe PID 4804 wrote to memory of 4788 4804 file.exe file.exe PID 4804 wrote to memory of 4788 4804 file.exe file.exe PID 3452 wrote to memory of 4556 3452 fffrbhu fffrbhu PID 3452 wrote to memory of 4556 3452 fffrbhu fffrbhu PID 3452 wrote to memory of 4556 3452 fffrbhu fffrbhu PID 3452 wrote to memory of 4556 3452 fffrbhu fffrbhu PID 3452 wrote to memory of 4556 3452 fffrbhu fffrbhu PID 3452 wrote to memory of 4556 3452 fffrbhu fffrbhu
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\fffrbhuC:\Users\Admin\AppData\Roaming\fffrbhu1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\fffrbhuC:\Users\Admin\AppData\Roaming\fffrbhu2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\fffrbhuFilesize
298KB
MD5bf0dfde86387701ca7f2d0f588f45a67
SHA1b1f7c5849a945d0c8e75e6bfd8b2c05a2571819d
SHA256c2121e45bca3f193881080e9319f1f462217ccb8c3aeb05de6c9a2bf85c2cc43
SHA51275aea76728e589c15f2458564b970650bb6767ad6ac5724dcf9d6be43de43e642fcdcde2d87a294be82ac6798acddc4c6723e8180ddf2f0684f759c2bbdebf3b
-
C:\Users\Admin\AppData\Roaming\fffrbhuFilesize
298KB
MD5bf0dfde86387701ca7f2d0f588f45a67
SHA1b1f7c5849a945d0c8e75e6bfd8b2c05a2571819d
SHA256c2121e45bca3f193881080e9319f1f462217ccb8c3aeb05de6c9a2bf85c2cc43
SHA51275aea76728e589c15f2458564b970650bb6767ad6ac5724dcf9d6be43de43e642fcdcde2d87a294be82ac6798acddc4c6723e8180ddf2f0684f759c2bbdebf3b
-
C:\Users\Admin\AppData\Roaming\fffrbhuFilesize
298KB
MD5bf0dfde86387701ca7f2d0f588f45a67
SHA1b1f7c5849a945d0c8e75e6bfd8b2c05a2571819d
SHA256c2121e45bca3f193881080e9319f1f462217ccb8c3aeb05de6c9a2bf85c2cc43
SHA51275aea76728e589c15f2458564b970650bb6767ad6ac5724dcf9d6be43de43e642fcdcde2d87a294be82ac6798acddc4c6723e8180ddf2f0684f759c2bbdebf3b
-
memory/4556-141-0x0000000000000000-mapping.dmp
-
memory/4556-144-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4556-145-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4788-132-0x0000000000000000-mapping.dmp
-
memory/4788-133-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4788-136-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4788-137-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4804-134-0x00000000007AE000-0x00000000007C3000-memory.dmpFilesize
84KB
-
memory/4804-135-0x0000000000760000-0x0000000000769000-memory.dmpFilesize
36KB