Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07-02-2023 01:39
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
General
-
Target
file.exe
-
Size
299KB
-
MD5
f89b1362ab0f86b5cf3d5ae8540b8a5a
-
SHA1
bce0b2db7ccc34237ae7bc40710230b9f95b60fa
-
SHA256
12699211aacfad01bd4e1d6b9f4d58e49455c28746cdde26379a70260a6da798
-
SHA512
5d2c6dd63b004af5c7d637a14cc45ad9241f981f9844e67ee71a96163a2b431c34ca01af30836fcc477cc6e23a8a6f275f8396ec7484ebeda23a10a3d3400a63
-
SSDEEP
6144:p9YKLMSuyXrh7NyzRi8dJPzgKiuQj9ja:XYKwdy7NYVXdJP0Kilj1
Malware Config
Signatures
-
Detects Smokeloader packer 6 IoCs
Processes:
resource yara_rule behavioral2/memory/4584-133-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral2/memory/3180-135-0x0000000000660000-0x0000000000669000-memory.dmp family_smokeloader behavioral2/memory/4584-136-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral2/memory/4584-137-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral2/memory/3992-144-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral2/memory/3992-145-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 2 IoCs
Processes:
crcftbacrcftbapid process 2032 crcftba 3992 crcftba -
Suspicious use of SetThreadContext 2 IoCs
Processes:
file.execrcftbadescription pid process target process PID 3180 set thread context of 4584 3180 file.exe file.exe PID 2032 set thread context of 3992 2032 crcftba crcftba -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
file.execrcftbadescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI crcftba Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI crcftba Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI crcftba -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
file.exepid process 4584 file.exe 4584 file.exe 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2824 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
file.execrcftbapid process 4584 file.exe 3992 crcftba -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 2824 Token: SeCreatePagefilePrivilege 2824 -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
file.execrcftbadescription pid process target process PID 3180 wrote to memory of 4584 3180 file.exe file.exe PID 3180 wrote to memory of 4584 3180 file.exe file.exe PID 3180 wrote to memory of 4584 3180 file.exe file.exe PID 3180 wrote to memory of 4584 3180 file.exe file.exe PID 3180 wrote to memory of 4584 3180 file.exe file.exe PID 3180 wrote to memory of 4584 3180 file.exe file.exe PID 2032 wrote to memory of 3992 2032 crcftba crcftba PID 2032 wrote to memory of 3992 2032 crcftba crcftba PID 2032 wrote to memory of 3992 2032 crcftba crcftba PID 2032 wrote to memory of 3992 2032 crcftba crcftba PID 2032 wrote to memory of 3992 2032 crcftba crcftba PID 2032 wrote to memory of 3992 2032 crcftba crcftba
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4584
-
C:\Users\Admin\AppData\Roaming\crcftbaC:\Users\Admin\AppData\Roaming\crcftba1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Roaming\crcftbaC:\Users\Admin\AppData\Roaming\crcftba2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3992
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\crcftbaFilesize
299KB
MD5f89b1362ab0f86b5cf3d5ae8540b8a5a
SHA1bce0b2db7ccc34237ae7bc40710230b9f95b60fa
SHA25612699211aacfad01bd4e1d6b9f4d58e49455c28746cdde26379a70260a6da798
SHA5125d2c6dd63b004af5c7d637a14cc45ad9241f981f9844e67ee71a96163a2b431c34ca01af30836fcc477cc6e23a8a6f275f8396ec7484ebeda23a10a3d3400a63
-
C:\Users\Admin\AppData\Roaming\crcftbaFilesize
299KB
MD5f89b1362ab0f86b5cf3d5ae8540b8a5a
SHA1bce0b2db7ccc34237ae7bc40710230b9f95b60fa
SHA25612699211aacfad01bd4e1d6b9f4d58e49455c28746cdde26379a70260a6da798
SHA5125d2c6dd63b004af5c7d637a14cc45ad9241f981f9844e67ee71a96163a2b431c34ca01af30836fcc477cc6e23a8a6f275f8396ec7484ebeda23a10a3d3400a63
-
C:\Users\Admin\AppData\Roaming\crcftbaFilesize
299KB
MD5f89b1362ab0f86b5cf3d5ae8540b8a5a
SHA1bce0b2db7ccc34237ae7bc40710230b9f95b60fa
SHA25612699211aacfad01bd4e1d6b9f4d58e49455c28746cdde26379a70260a6da798
SHA5125d2c6dd63b004af5c7d637a14cc45ad9241f981f9844e67ee71a96163a2b431c34ca01af30836fcc477cc6e23a8a6f275f8396ec7484ebeda23a10a3d3400a63
-
memory/2032-143-0x000000000075E000-0x0000000000773000-memory.dmpFilesize
84KB
-
memory/3180-135-0x0000000000660000-0x0000000000669000-memory.dmpFilesize
36KB
-
memory/3180-134-0x000000000070E000-0x0000000000723000-memory.dmpFilesize
84KB
-
memory/3992-140-0x0000000000000000-mapping.dmp
-
memory/3992-144-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3992-145-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4584-136-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4584-137-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4584-133-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4584-132-0x0000000000000000-mapping.dmp