Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
07-02-2023 09:35
Static task
static1
Behavioral task
behavioral1
Sample
7c2b7f94b57d15b6f5f4ed31a96cc0ec.exe
Resource
win7-20221111-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
7c2b7f94b57d15b6f5f4ed31a96cc0ec.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
7c2b7f94b57d15b6f5f4ed31a96cc0ec.exe
-
Size
285KB
-
MD5
7c2b7f94b57d15b6f5f4ed31a96cc0ec
-
SHA1
51ec2b8292ae25dc53c1bb96722228c612651e05
-
SHA256
94dcd9eb97aa7ef0957f20728ef38d1b95c9fc6f16c1467c752e019046ea882b
-
SHA512
9dd76b03f6866ca792b6a906f69339ce9bf22ce61e21318f72c745e32619fc8d47a664f3ab68b5a0aba98574650d7189e7d74c656ef46d7f3f72ebe480041cec
-
SSDEEP
6144:SOe7vYYo2U4YRNNbKL4pTYdkhVoi4Fc+dVkR52:SNvYYowYtiisdkEDFc+7kr2
Score
10/10
Malware Config
Signatures
-
Detects Smokeloader packer 3 IoCs
resource yara_rule behavioral2/memory/2520-143-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral2/memory/2520-144-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral2/memory/2520-145-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 7c2b7f94b57d15b6f5f4ed31a96cc0ec.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4800 set thread context of 2520 4800 7c2b7f94b57d15b6f5f4ed31a96cc0ec.exe 86 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 7c2b7f94b57d15b6f5f4ed31a96cc0ec.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 7c2b7f94b57d15b6f5f4ed31a96cc0ec.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 7c2b7f94b57d15b6f5f4ed31a96cc0ec.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1460 powershell.exe 1460 powershell.exe 2520 7c2b7f94b57d15b6f5f4ed31a96cc0ec.exe 2520 7c2b7f94b57d15b6f5f4ed31a96cc0ec.exe 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2644 Process not Found -
Suspicious behavior: MapViewOfSection 15 IoCs
pid Process 2520 7c2b7f94b57d15b6f5f4ed31a96cc0ec.exe 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found 2644 Process not Found -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4800 7c2b7f94b57d15b6f5f4ed31a96cc0ec.exe Token: SeDebugPrivilege 1460 powershell.exe -
Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 4800 wrote to memory of 1460 4800 7c2b7f94b57d15b6f5f4ed31a96cc0ec.exe 80 PID 4800 wrote to memory of 1460 4800 7c2b7f94b57d15b6f5f4ed31a96cc0ec.exe 80 PID 4800 wrote to memory of 1460 4800 7c2b7f94b57d15b6f5f4ed31a96cc0ec.exe 80 PID 4800 wrote to memory of 2520 4800 7c2b7f94b57d15b6f5f4ed31a96cc0ec.exe 86 PID 4800 wrote to memory of 2520 4800 7c2b7f94b57d15b6f5f4ed31a96cc0ec.exe 86 PID 4800 wrote to memory of 2520 4800 7c2b7f94b57d15b6f5f4ed31a96cc0ec.exe 86 PID 4800 wrote to memory of 2520 4800 7c2b7f94b57d15b6f5f4ed31a96cc0ec.exe 86 PID 4800 wrote to memory of 2520 4800 7c2b7f94b57d15b6f5f4ed31a96cc0ec.exe 86 PID 4800 wrote to memory of 2520 4800 7c2b7f94b57d15b6f5f4ed31a96cc0ec.exe 86 PID 2644 wrote to memory of 4044 2644 Process not Found 90 PID 2644 wrote to memory of 4044 2644 Process not Found 90 PID 2644 wrote to memory of 4044 2644 Process not Found 90 PID 2644 wrote to memory of 4044 2644 Process not Found 90 PID 2644 wrote to memory of 1108 2644 Process not Found 91 PID 2644 wrote to memory of 1108 2644 Process not Found 91 PID 2644 wrote to memory of 1108 2644 Process not Found 91 PID 2644 wrote to memory of 4256 2644 Process not Found 92 PID 2644 wrote to memory of 4256 2644 Process not Found 92 PID 2644 wrote to memory of 4256 2644 Process not Found 92 PID 2644 wrote to memory of 4256 2644 Process not Found 92 PID 2644 wrote to memory of 3496 2644 Process not Found 93 PID 2644 wrote to memory of 3496 2644 Process not Found 93 PID 2644 wrote to memory of 3496 2644 Process not Found 93 PID 2644 wrote to memory of 3496 2644 Process not Found 93 PID 2644 wrote to memory of 3648 2644 Process not Found 94 PID 2644 wrote to memory of 3648 2644 Process not Found 94 PID 2644 wrote to memory of 3648 2644 Process not Found 94 PID 2644 wrote to memory of 3192 2644 Process not Found 95 PID 2644 wrote to memory of 3192 2644 Process not Found 95 PID 2644 wrote to memory of 3192 2644 Process not Found 95 PID 2644 wrote to memory of 3192 2644 Process not Found 95 PID 2644 wrote to memory of 2188 2644 Process not Found 96 PID 2644 wrote to memory of 2188 2644 Process not Found 96 PID 2644 wrote to memory of 2188 2644 Process not Found 96 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c2b7f94b57d15b6f5f4ed31a96cc0ec.exe"C:\Users\Admin\AppData\Local\Temp\7c2b7f94b57d15b6f5f4ed31a96cc0ec.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1460
-
-
C:\Users\Admin\AppData\Local\Temp\7c2b7f94b57d15b6f5f4ed31a96cc0ec.exeC:\Users\Admin\AppData\Local\Temp\7c2b7f94b57d15b6f5f4ed31a96cc0ec.exe2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2520
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:4044
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1108
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4256
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3496
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3648
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3192
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2188