Analysis
- max time kernel
150s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
15/02/2023, 17:05
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20221111-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target file.exe
- Size 189KB
- Sample230215-vlt42sch79
- SHA256 2c265e4069a993ec44021ed7750ca9bd7c1f43cdfac38a8c7bdd10ec5e2e320b
- MD5 ab0afae150cd2cbfcc7cb1b27c7183ac
- SHA1 044a9441bcac36d326c41da9b597bc55eae2ee21
- SHA512 a63c792725691d261271a44360d06df2e6bda3e7e940cdca10499b451b4a6fc5d409e2ae33af952a30be312864ae2cb9d2b92889fdd86123facab46af27658f7
- SSDEEP 3072:BCaAesTG/kT6o+0DYj3BsqtVuoBJnwSVpqxvvaDuTW:BbAe/kTZo3TtVuo/fWZva
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/632-133-0x00000000006F0000-0x00000000006F9000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
pid Process 2264 E014.exe - Program crash 1 IoCs
pid pid_target Process procid_target 4288 2264 WerFault.exe 81 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 632 file.exe 632 file.exe 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1040 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 632 file.exe - Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeShutdownPrivilege 1040 Process not Found Token: SeCreatePagefilePrivilege 1040 Process not Found Token: SeShutdownPrivilege 1040 Process not Found Token: SeCreatePagefilePrivilege 1040 Process not Found Token: SeShutdownPrivilege 1040 Process not Found Token: SeCreatePagefilePrivilege 1040 Process not Found Token: SeShutdownPrivilege 1040 Process not Found Token: SeCreatePagefilePrivilege 1040 Process not Found Token: SeShutdownPrivilege 1040 Process not Found Token: SeCreatePagefilePrivilege 1040 Process not Found Token: SeShutdownPrivilege 1040 Process not Found Token: SeCreatePagefilePrivilege 1040 Process not Found Token: SeShutdownPrivilege 1040 Process not Found Token: SeCreatePagefilePrivilege 1040 Process not Found Token: SeShutdownPrivilege 1040 Process not Found Token: SeCreatePagefilePrivilege 1040 Process not Found Token: SeShutdownPrivilege 1040 Process not Found Token: SeCreatePagefilePrivilege 1040 Process not Found - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1040 wrote to memory of 2264 1040 Process not Found 81 PID 1040 wrote to memory of 2264 1040 Process not Found 81 PID 1040 wrote to memory of 2264 1040 Process not Found 81 PID 2264 wrote to memory of 4252 2264 E014.exe 82 PID 2264 wrote to memory of 4252 2264 E014.exe 82 PID 2264 wrote to memory of 4252 2264 E014.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:632
-
C:\Users\Admin\AppData\Local\Temp\E014.exeC:\Users\Admin\AppData\Local\Temp\E014.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Ruifriwreh.dll,start2⤵PID:4252
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 5082⤵
- Program crash
PID:4288
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2264 -ip 22641⤵PID:2220
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\E014.exe
- Size 3.6MB
- SHA256 ede387b12df42ac03d3a75383c2c2dbf52eedf38b0400fdababd051df76ef2a9
- MD5 d9351d16128970fe6ada633c16c9b4db
- SHA1 9a3eb797e5b5e611faac8703ee0821d3e3bb959f
- SHA512 e5ee3d2cf5e424ec18008a770d036eb45e71fbbf49148ce610a38b3810b57cb4f8458d4db9e654fe9af21d07b706d129aa8be2846a24eda3b67c807281c2dcb2
- SSDEEP 98304:h/6j8gXkLwLe/xKcKlF+RJ1xlgbNrya0SnLPb9WS0:V6IGkLwLgyF+J7lgBkaLPb910
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\E014.exe
- Size 3.6MB
- SHA256 ede387b12df42ac03d3a75383c2c2dbf52eedf38b0400fdababd051df76ef2a9
- MD5 d9351d16128970fe6ada633c16c9b4db
- SHA1 9a3eb797e5b5e611faac8703ee0821d3e3bb959f
- SHA512 e5ee3d2cf5e424ec18008a770d036eb45e71fbbf49148ce610a38b3810b57cb4f8458d4db9e654fe9af21d07b706d129aa8be2846a24eda3b67c807281c2dcb2
- SSDEEP 98304:h/6j8gXkLwLe/xKcKlF+RJ1xlgbNrya0SnLPb9WS0:V6IGkLwLgyF+J7lgBkaLPb910
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Ruifriwreh.dll
- Size 2.5MB
- SHA256 98d6516abb9a5fede93cbd1d806c1f067d3d5dcd9009597111f8be04d077c487
- MD5 c21359cea73e0d69d4eb2130e9937328
- SHA1 8fafbb0d7ec8023857ae92a504d7c4aed6463e07
- SHA512 b779800db4b6fac794d65fe66b70b3735e9913231973474d2432e3cff13482d4310e033b2d5caaa1b8046f06505cb6407817e6b8b548f73efc482f03e909cbee
- SSDEEP 49152:ggpIYf08fFEKYC39SM0ZMRcEoDu7v/TZybbqTk4:PIhFYD0ZMRcEo0PTl
- MD5 SHA1 SHA512 SSDEEP