Analysis
- max time kernel
151s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system - submitted
13/02/2023, 11:00
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target file.exe
- Size 197KB
- Sample230213-m31ddscg45
- SHA256 ea90e9a64e47feec4e20a41bc22ea2aca6fb0d16eb133d8ac6265d9d71981425
- MD5 792018486680014dbde50ad58dd925f3
- SHA1 ab781343e5b3ece458f6950accd1d5bf42b5172e
- SHA512 2b46aae6220700bd994e20b0fdc89d97a076bbfc6b85a1554499c192c8ee8b713c31fc18934183e11df3873be1481256c5ec91fd99d6fb67bbc09a62f8b0fe2e
- SSDEEP 3072:RvcUKbth3RgdwaI+5Gew8hhx3A6Pve6bTE6Mqd10VWG+f9iIbx/5nzzlC13eK13N:RvrGE9IeGew8hhxAQbH0+9iYVNZC
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/3916-133-0x0000000000800000-0x0000000000809000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
pid Process 3040 61D7.exe - Loads dropped DLL 1 IoCs
pid Process 5064 rundll32.exe - Program crash 1 IoCs
pid pid_target Process procid_target 4500 3040 WerFault.exe 89 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3916 file.exe 3916 file.exe 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2932 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3916 file.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 2932 Process not Found Token: SeCreatePagefilePrivilege 2932 Process not Found Token: SeShutdownPrivilege 2932 Process not Found Token: SeCreatePagefilePrivilege 2932 Process not Found - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2932 wrote to memory of 3040 2932 Process not Found 89 PID 2932 wrote to memory of 3040 2932 Process not Found 89 PID 2932 wrote to memory of 3040 2932 Process not Found 89 PID 3040 wrote to memory of 5064 3040 61D7.exe 90 PID 3040 wrote to memory of 5064 3040 61D7.exe 90 PID 3040 wrote to memory of 5064 3040 61D7.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3916
-
C:\Users\Admin\AppData\Local\Temp\61D7.exeC:\Users\Admin\AppData\Local\Temp\61D7.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Eoufdihy.dll,start2⤵
- Loads dropped DLL
PID:5064
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 4802⤵
- Program crash
PID:4500
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3040 -ip 30401⤵PID:5016
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\61D7.exe
- Size 3.6MB
- SHA256 0fec96901f8f3dabbe9b3d522eda73f28d748399fa55fdd8900d70f12f0c8447
- MD5 4b6d940909b23b75fcd19e7fa374ed29
- SHA1 592f1701ba40aea0e3bf2d96dafdd49c8ae767c7
- SHA512 c35d5b9b160f387a1044b7c49d2fbfce56fc47656d9b654289879443e740dd4225f7e1713118fd31bc6390a37cb57cfdaac3baae7704089218fce477a4494eaa
- SSDEEP 49152:VPQblJfv1kD4sRbmhelckd7VDvKlmVMKnsEpX2czWeI31Nl6luWuTpkq6zmBGuoN:pcLv1kssRlckFBS0/sErzszP7PC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\61D7.exe
- Size 3.6MB
- SHA256 0fec96901f8f3dabbe9b3d522eda73f28d748399fa55fdd8900d70f12f0c8447
- MD5 4b6d940909b23b75fcd19e7fa374ed29
- SHA1 592f1701ba40aea0e3bf2d96dafdd49c8ae767c7
- SHA512 c35d5b9b160f387a1044b7c49d2fbfce56fc47656d9b654289879443e740dd4225f7e1713118fd31bc6390a37cb57cfdaac3baae7704089218fce477a4494eaa
- SSDEEP 49152:VPQblJfv1kD4sRbmhelckd7VDvKlmVMKnsEpX2czWeI31Nl6luWuTpkq6zmBGuoN:pcLv1kssRlckFBS0/sErzszP7PC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Eoufdihy.dll
- Size 4.2MB
- SHA256 0a6eae4daf5ed9aa15332f25296940bcb6290d6ea098bb1d6b91b97cc3235340
- MD5 72614803729b74a38c7788703c2d77d5
- SHA1 fa113bd26141bf8384cb761fc50b78f6ac0c46ef
- SHA512 39b633059b4b9b673d8fd4f7c3ca11518fa13bbc5be28eff86668724cb953bb672fe384c86f608e296d177fae5ae87cecfc9d4d36095f8f0d23a493ad857fe5c
- SSDEEP 98304:UNtQyIbS87QVWCPifJ1tebTfU9LkX7b9:ca17QVWCP/3fU9LkL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Eoufdihy.dll
- Size 4.2MB
- SHA256 0a6eae4daf5ed9aa15332f25296940bcb6290d6ea098bb1d6b91b97cc3235340
- MD5 72614803729b74a38c7788703c2d77d5
- SHA1 fa113bd26141bf8384cb761fc50b78f6ac0c46ef
- SHA512 39b633059b4b9b673d8fd4f7c3ca11518fa13bbc5be28eff86668724cb953bb672fe384c86f608e296d177fae5ae87cecfc9d4d36095f8f0d23a493ad857fe5c
- SSDEEP 98304:UNtQyIbS87QVWCPifJ1tebTfU9LkX7b9:ca17QVWCP/3fU9LkL
- MD5 SHA1 SHA512 SSDEEP