Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
17/02/2023, 03:19
General
-
Target
file.exe
-
Size
253KB
-
MD5
80f560ff4a90ea8d7a81bd57424d3c1a
-
SHA1
fe628bdfc3de7cb0ab475c0ac666586cf34dd936
-
SHA256
0e4722653d9d917e35cd403924899bf3d66515b4e7d9d2000ff0ace516b7d95d
-
SHA512
56daa33108f1ff561c97fa2905471887e0e1ca0723585ab28ec00ce86097ea59a46afbdbceae2d963a3ca789caa24af6d640639213e360ce14c96f20b204ff42
-
SSDEEP
3072:FbjZT1RLhpERKFboo4gI8k3BG1VubG15foHZ4S8HPVrtPe6v:NNTDLMKNv2GU0RJzHth
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Blocklisted process makes network request 1 IoCs
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 19 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies Internet Explorer settings 1 TTPs 4 IoCs
-
Modifies registry class 30 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 18 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\E3AE.exeC:\Users\Admin\AppData\Local\Temp\E3AE.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Ruifriwreh.dll,start2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 141493⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 4882⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2604 -ip 26041⤵
-
C:\Users\Admin\AppData\Roaming\cbggjjiC:\Users\Admin\AppData\Roaming\cbggjji1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.7MB
MD513ce3685da66c70a48f6653a022b45ab
SHA1e9d077ed143d9aae2e0715f54a78c320bf2bee74
SHA256b9ec177821d7a0d037f08a259adb5b2233765112e9766b7bf99d0dcb5ecc733c
SHA512db2ed681a2eb8a16272393eb005a43181c6b9fa6934ef877f62143c347443a3c4fe7a680dc929be6062da23f36cb91023cebf5bb7c04cb16036949340de62a7a
-
Filesize
3.7MB
MD513ce3685da66c70a48f6653a022b45ab
SHA1e9d077ed143d9aae2e0715f54a78c320bf2bee74
SHA256b9ec177821d7a0d037f08a259adb5b2233765112e9766b7bf99d0dcb5ecc733c
SHA512db2ed681a2eb8a16272393eb005a43181c6b9fa6934ef877f62143c347443a3c4fe7a680dc929be6062da23f36cb91023cebf5bb7c04cb16036949340de62a7a
-
Filesize
4.3MB
MD538ae35e850b41e1ca38591cc8c594af7
SHA1480ca0b5ea6fd989cf506d22ecc2b748485560d6
SHA25623939c64e7f1f3d1ca608a8b677f4a37ce4fc1b3cc39a90d2d0467ce124139aa
SHA512fb08033243e28f9cce576ebe9982a66bbe6f60cd2770e53985a2ceeda1f464b558f168329e0ff6371e21ef5a714fbd7556715fa20ca95924e63b0b3913e1714f
-
Filesize
4.3MB
MD538ae35e850b41e1ca38591cc8c594af7
SHA1480ca0b5ea6fd989cf506d22ecc2b748485560d6
SHA25623939c64e7f1f3d1ca608a8b677f4a37ce4fc1b3cc39a90d2d0467ce124139aa
SHA512fb08033243e28f9cce576ebe9982a66bbe6f60cd2770e53985a2ceeda1f464b558f168329e0ff6371e21ef5a714fbd7556715fa20ca95924e63b0b3913e1714f
-
Filesize
4.3MB
MD538ae35e850b41e1ca38591cc8c594af7
SHA1480ca0b5ea6fd989cf506d22ecc2b748485560d6
SHA25623939c64e7f1f3d1ca608a8b677f4a37ce4fc1b3cc39a90d2d0467ce124139aa
SHA512fb08033243e28f9cce576ebe9982a66bbe6f60cd2770e53985a2ceeda1f464b558f168329e0ff6371e21ef5a714fbd7556715fa20ca95924e63b0b3913e1714f
-
Filesize
253KB
MD580f560ff4a90ea8d7a81bd57424d3c1a
SHA1fe628bdfc3de7cb0ab475c0ac666586cf34dd936
SHA2560e4722653d9d917e35cd403924899bf3d66515b4e7d9d2000ff0ace516b7d95d
SHA51256daa33108f1ff561c97fa2905471887e0e1ca0723585ab28ec00ce86097ea59a46afbdbceae2d963a3ca789caa24af6d640639213e360ce14c96f20b204ff42
-
Filesize
253KB
MD580f560ff4a90ea8d7a81bd57424d3c1a
SHA1fe628bdfc3de7cb0ab475c0ac666586cf34dd936
SHA2560e4722653d9d917e35cd403924899bf3d66515b4e7d9d2000ff0ace516b7d95d
SHA51256daa33108f1ff561c97fa2905471887e0e1ca0723585ab28ec00ce86097ea59a46afbdbceae2d963a3ca789caa24af6d640639213e360ce14c96f20b204ff42
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
2.6MB
-
Filesize
2.7MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
84KB
-
Filesize
5.2MB
-
Filesize
3.5MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
11.3MB
-
Filesize
11.3MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
11.3MB
-
Filesize
11.3MB
-
Filesize
4.3MB
-
Filesize
8KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
36KB
-
Filesize
88KB