Analysis
- max time kernel
174s - max time network
176s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
- submitted
08/02/2023, 18:35
General
- Target de2cc5ab0c1b901b1d57a0e10c0185be.exe
- Size 194KB
- Sample230208-w8cc7aec69
- SHA256 a754e3d045adbd88b59a7b80ea127636f710c4183001cce2b7614611b7c141e4
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 19 IoCs
- Suspicious use of WriteProcessMemory 33 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\de2cc5ab0c1b901b1d57a0e10c0185be.exe"C:\Users\Admin\AppData\Local\Temp\de2cc5ab0c1b901b1d57a0e10c0185be.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1436-168-0x0000000000BB0000-0x0000000000BD2000-memory.dmp
memory/1436-151-0x0000000000B80000-0x0000000000BA7000-memory.dmp
memory/1436-150-0x0000000000BB0000-0x0000000000BD2000-memory.dmp
memory/2276-157-0x0000000000EE0000-0x0000000000EEB000-memory.dmp
memory/2276-170-0x0000000000EF0000-0x0000000000EF6000-memory.dmp
memory/2276-156-0x0000000000EF0000-0x0000000000EF6000-memory.dmp
memory/2540-160-0x00000000004F0000-0x00000000004FD000-memory.dmp
memory/2540-159-0x0000000000500000-0x0000000000507000-memory.dmp
memory/2540-171-0x0000000000500000-0x0000000000507000-memory.dmp
memory/2940-167-0x0000000000B50000-0x0000000000B56000-memory.dmp
memory/2940-147-0x0000000000B50000-0x0000000000B56000-memory.dmp
memory/2940-148-0x0000000000B40000-0x0000000000B4C000-memory.dmp
memory/3224-141-0x0000000000D70000-0x0000000000D79000-memory.dmp
memory/3224-165-0x0000000000D70000-0x0000000000D79000-memory.dmp
memory/3224-142-0x0000000000D60000-0x0000000000D6F000-memory.dmp
memory/3524-166-0x0000000000AF0000-0x0000000000AF5000-memory.dmp
memory/3524-145-0x0000000000AE0000-0x0000000000AE9000-memory.dmp
memory/3524-144-0x0000000000AF0000-0x0000000000AF5000-memory.dmp
memory/4268-132-0x0000000000718000-0x000000000072B000-memory.dmp
memory/4268-136-0x0000000000400000-0x000000000055F000-memory.dmp
memory/4268-135-0x0000000000718000-0x000000000072B000-memory.dmp
memory/4268-133-0x00000000006F0000-0x00000000006F9000-memory.dmp
memory/4268-134-0x0000000000400000-0x000000000055F000-memory.dmp
memory/4556-162-0x0000000000F10000-0x0000000000F18000-memory.dmp
memory/4556-163-0x0000000000F00000-0x0000000000F0B000-memory.dmp
memory/4556-172-0x0000000000F10000-0x0000000000F18000-memory.dmp
memory/4700-164-0x0000000000B90000-0x0000000000B97000-memory.dmp
memory/4700-139-0x0000000000B80000-0x0000000000B8B000-memory.dmp
memory/4700-138-0x0000000000B90000-0x0000000000B97000-memory.dmp
memory/4828-154-0x0000000000F00000-0x0000000000F09000-memory.dmp
memory/4828-153-0x0000000000F10000-0x0000000000F15000-memory.dmp
memory/4828-169-0x0000000000F10000-0x0000000000F15000-memory.dmp