Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07-02-2023 00:18
Static task
static1
Behavioral task
behavioral1
Sample
086f98376b2a5d38f1215467ef57d7803523984b3ff745fc5438eea791da7985.exe
Resource
win10v2004-20220812-en
General
-
Target
086f98376b2a5d38f1215467ef57d7803523984b3ff745fc5438eea791da7985.exe
-
Size
298KB
-
MD5
afc1de57455861ff97bf20c27cfaba6c
-
SHA1
00bd80516cbf5a309b48730abc76eedd9c5c688f
-
SHA256
086f98376b2a5d38f1215467ef57d7803523984b3ff745fc5438eea791da7985
-
SHA512
d2651e79444401b4a04f7169d6d782eea042273eacca0e95dd332b2562d2789bda2dabda11c37d18815013ea0d024271f1ffdbe74b74006d5af863b82f1673ce
-
SSDEEP
3072:Aqb6bEcjNLqKRmaVrAndcjlYJZnQ6jJC9GS6AEn11uQjiMTE5wY3ta5hN:1vcjNLqJaVYeCjJoEkE11uQj9EaL
Malware Config
Signatures
-
Detects Smokeloader packer 6 IoCs
Processes:
resource yara_rule behavioral1/memory/5040-133-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/4932-135-0x0000000002200000-0x0000000002209000-memory.dmp family_smokeloader behavioral1/memory/5040-136-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/5040-137-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/2664-144-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/2664-145-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 2 IoCs
Processes:
caucuvwcaucuvwpid process 1840 caucuvw 2664 caucuvw -
Suspicious use of SetThreadContext 2 IoCs
Processes:
086f98376b2a5d38f1215467ef57d7803523984b3ff745fc5438eea791da7985.execaucuvwdescription pid process target process PID 4932 set thread context of 5040 4932 086f98376b2a5d38f1215467ef57d7803523984b3ff745fc5438eea791da7985.exe 086f98376b2a5d38f1215467ef57d7803523984b3ff745fc5438eea791da7985.exe PID 1840 set thread context of 2664 1840 caucuvw caucuvw -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
086f98376b2a5d38f1215467ef57d7803523984b3ff745fc5438eea791da7985.execaucuvwdescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 086f98376b2a5d38f1215467ef57d7803523984b3ff745fc5438eea791da7985.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI caucuvw Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI caucuvw Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI caucuvw Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 086f98376b2a5d38f1215467ef57d7803523984b3ff745fc5438eea791da7985.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 086f98376b2a5d38f1215467ef57d7803523984b3ff745fc5438eea791da7985.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
086f98376b2a5d38f1215467ef57d7803523984b3ff745fc5438eea791da7985.exepid process 5040 086f98376b2a5d38f1215467ef57d7803523984b3ff745fc5438eea791da7985.exe 5040 086f98376b2a5d38f1215467ef57d7803523984b3ff745fc5438eea791da7985.exe 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 3076 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3076 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
086f98376b2a5d38f1215467ef57d7803523984b3ff745fc5438eea791da7985.execaucuvwpid process 5040 086f98376b2a5d38f1215467ef57d7803523984b3ff745fc5438eea791da7985.exe 2664 caucuvw -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 3076 Token: SeCreatePagefilePrivilege 3076 -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
086f98376b2a5d38f1215467ef57d7803523984b3ff745fc5438eea791da7985.execaucuvwdescription pid process target process PID 4932 wrote to memory of 5040 4932 086f98376b2a5d38f1215467ef57d7803523984b3ff745fc5438eea791da7985.exe 086f98376b2a5d38f1215467ef57d7803523984b3ff745fc5438eea791da7985.exe PID 4932 wrote to memory of 5040 4932 086f98376b2a5d38f1215467ef57d7803523984b3ff745fc5438eea791da7985.exe 086f98376b2a5d38f1215467ef57d7803523984b3ff745fc5438eea791da7985.exe PID 4932 wrote to memory of 5040 4932 086f98376b2a5d38f1215467ef57d7803523984b3ff745fc5438eea791da7985.exe 086f98376b2a5d38f1215467ef57d7803523984b3ff745fc5438eea791da7985.exe PID 4932 wrote to memory of 5040 4932 086f98376b2a5d38f1215467ef57d7803523984b3ff745fc5438eea791da7985.exe 086f98376b2a5d38f1215467ef57d7803523984b3ff745fc5438eea791da7985.exe PID 4932 wrote to memory of 5040 4932 086f98376b2a5d38f1215467ef57d7803523984b3ff745fc5438eea791da7985.exe 086f98376b2a5d38f1215467ef57d7803523984b3ff745fc5438eea791da7985.exe PID 4932 wrote to memory of 5040 4932 086f98376b2a5d38f1215467ef57d7803523984b3ff745fc5438eea791da7985.exe 086f98376b2a5d38f1215467ef57d7803523984b3ff745fc5438eea791da7985.exe PID 1840 wrote to memory of 2664 1840 caucuvw caucuvw PID 1840 wrote to memory of 2664 1840 caucuvw caucuvw PID 1840 wrote to memory of 2664 1840 caucuvw caucuvw PID 1840 wrote to memory of 2664 1840 caucuvw caucuvw PID 1840 wrote to memory of 2664 1840 caucuvw caucuvw PID 1840 wrote to memory of 2664 1840 caucuvw caucuvw
Processes
-
C:\Users\Admin\AppData\Local\Temp\086f98376b2a5d38f1215467ef57d7803523984b3ff745fc5438eea791da7985.exe"C:\Users\Admin\AppData\Local\Temp\086f98376b2a5d38f1215467ef57d7803523984b3ff745fc5438eea791da7985.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\086f98376b2a5d38f1215467ef57d7803523984b3ff745fc5438eea791da7985.exe"C:\Users\Admin\AppData\Local\Temp\086f98376b2a5d38f1215467ef57d7803523984b3ff745fc5438eea791da7985.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\caucuvwC:\Users\Admin\AppData\Roaming\caucuvw1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\caucuvwC:\Users\Admin\AppData\Roaming\caucuvw2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\caucuvwFilesize
298KB
MD5afc1de57455861ff97bf20c27cfaba6c
SHA100bd80516cbf5a309b48730abc76eedd9c5c688f
SHA256086f98376b2a5d38f1215467ef57d7803523984b3ff745fc5438eea791da7985
SHA512d2651e79444401b4a04f7169d6d782eea042273eacca0e95dd332b2562d2789bda2dabda11c37d18815013ea0d024271f1ffdbe74b74006d5af863b82f1673ce
-
C:\Users\Admin\AppData\Roaming\caucuvwFilesize
298KB
MD5afc1de57455861ff97bf20c27cfaba6c
SHA100bd80516cbf5a309b48730abc76eedd9c5c688f
SHA256086f98376b2a5d38f1215467ef57d7803523984b3ff745fc5438eea791da7985
SHA512d2651e79444401b4a04f7169d6d782eea042273eacca0e95dd332b2562d2789bda2dabda11c37d18815013ea0d024271f1ffdbe74b74006d5af863b82f1673ce
-
C:\Users\Admin\AppData\Roaming\caucuvwFilesize
298KB
MD5afc1de57455861ff97bf20c27cfaba6c
SHA100bd80516cbf5a309b48730abc76eedd9c5c688f
SHA256086f98376b2a5d38f1215467ef57d7803523984b3ff745fc5438eea791da7985
SHA512d2651e79444401b4a04f7169d6d782eea042273eacca0e95dd332b2562d2789bda2dabda11c37d18815013ea0d024271f1ffdbe74b74006d5af863b82f1673ce
-
memory/1840-143-0x000000000072E000-0x0000000000743000-memory.dmpFilesize
84KB
-
memory/2664-140-0x0000000000000000-mapping.dmp
-
memory/2664-144-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2664-145-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4932-135-0x0000000002200000-0x0000000002209000-memory.dmpFilesize
36KB
-
memory/4932-134-0x000000000075E000-0x0000000000773000-memory.dmpFilesize
84KB
-
memory/5040-136-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/5040-137-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/5040-133-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/5040-132-0x0000000000000000-mapping.dmp