Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
19-02-2023 16:12
Static task
static1
Behavioral task
behavioral1
Sample
2949ae862f29a51027ade70cc02e483439f4c3aba6e42e6623daced3714d1b60.exe
Resource
win10v2004-20221111-en
General
-
Target
2949ae862f29a51027ade70cc02e483439f4c3aba6e42e6623daced3714d1b60.exe
-
Size
229KB
-
MD5
73fa447cb47faf3e975479de5cc60cd8
-
SHA1
b2025bb55894a18d4bba9ecdad14f50109349f33
-
SHA256
2949ae862f29a51027ade70cc02e483439f4c3aba6e42e6623daced3714d1b60
-
SHA512
fcc346590d63cfb1afc39c2098d4fde29ece80a9f3dcf2d4c1c8dcdce84aac4714c1cbef25d14f27e418e3ae68c86c4b4858b23907b9006285f9045f2ef6fb50
-
SSDEEP
3072:+n92UWxHILc1PuADtH20n41epgs13BxzXzqlK2Ylzb8QDeFVvQPtB7fVS:5xHILdADPn4wph13BNOG7DeFMj7f
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral1/memory/1044-133-0x0000000000870000-0x0000000000879000-memory.dmp family_smokeloader -
Panda Stealer payload 4 IoCs
resource yara_rule behavioral1/memory/1052-150-0x0000000000400000-0x00000000004A3000-memory.dmp family_pandastealer behavioral1/memory/1052-151-0x0000000000400000-0x00000000004A3000-memory.dmp family_pandastealer behavioral1/memory/1052-152-0x0000000000400000-0x00000000004A3000-memory.dmp family_pandastealer behavioral1/memory/1052-153-0x0000000000400000-0x00000000004A3000-memory.dmp family_pandastealer -
PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
pid Process 3720 FE4A.exe 4212 34D.exe 2336 AFE.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2336 set thread context of 1052 2336 AFE.exe 94 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2949ae862f29a51027ade70cc02e483439f4c3aba6e42e6623daced3714d1b60.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2949ae862f29a51027ade70cc02e483439f4c3aba6e42e6623daced3714d1b60.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2949ae862f29a51027ade70cc02e483439f4c3aba6e42e6623daced3714d1b60.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1044 2949ae862f29a51027ade70cc02e483439f4c3aba6e42e6623daced3714d1b60.exe 1044 2949ae862f29a51027ade70cc02e483439f4c3aba6e42e6623daced3714d1b60.exe 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2584 Process not Found -
Suspicious behavior: MapViewOfSection 19 IoCs
pid Process 1044 2949ae862f29a51027ade70cc02e483439f4c3aba6e42e6623daced3714d1b60.exe 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found 2584 Process not Found -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeShutdownPrivilege 2584 Process not Found Token: SeCreatePagefilePrivilege 2584 Process not Found Token: SeShutdownPrivilege 2584 Process not Found Token: SeCreatePagefilePrivilege 2584 Process not Found Token: SeShutdownPrivilege 2584 Process not Found Token: SeCreatePagefilePrivilege 2584 Process not Found Token: SeShutdownPrivilege 2584 Process not Found Token: SeCreatePagefilePrivilege 2584 Process not Found -
Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 2584 wrote to memory of 3720 2584 Process not Found 89 PID 2584 wrote to memory of 3720 2584 Process not Found 89 PID 2584 wrote to memory of 4212 2584 Process not Found 90 PID 2584 wrote to memory of 4212 2584 Process not Found 90 PID 2584 wrote to memory of 2336 2584 Process not Found 91 PID 2584 wrote to memory of 2336 2584 Process not Found 91 PID 2584 wrote to memory of 2336 2584 Process not Found 91 PID 2584 wrote to memory of 4796 2584 Process not Found 93 PID 2584 wrote to memory of 4796 2584 Process not Found 93 PID 2584 wrote to memory of 4796 2584 Process not Found 93 PID 2584 wrote to memory of 4796 2584 Process not Found 93 PID 2336 wrote to memory of 1052 2336 AFE.exe 94 PID 2336 wrote to memory of 1052 2336 AFE.exe 94 PID 2336 wrote to memory of 1052 2336 AFE.exe 94 PID 2336 wrote to memory of 1052 2336 AFE.exe 94 PID 2336 wrote to memory of 1052 2336 AFE.exe 94 PID 2336 wrote to memory of 1052 2336 AFE.exe 94 PID 2336 wrote to memory of 1052 2336 AFE.exe 94 PID 2336 wrote to memory of 1052 2336 AFE.exe 94 PID 2336 wrote to memory of 1052 2336 AFE.exe 94 PID 2336 wrote to memory of 1052 2336 AFE.exe 94 PID 2584 wrote to memory of 1808 2584 Process not Found 95 PID 2584 wrote to memory of 1808 2584 Process not Found 95 PID 2584 wrote to memory of 1808 2584 Process not Found 95 PID 2584 wrote to memory of 392 2584 Process not Found 96 PID 2584 wrote to memory of 392 2584 Process not Found 96 PID 2584 wrote to memory of 392 2584 Process not Found 96 PID 2584 wrote to memory of 392 2584 Process not Found 96 PID 2584 wrote to memory of 4848 2584 Process not Found 97 PID 2584 wrote to memory of 4848 2584 Process not Found 97 PID 2584 wrote to memory of 4848 2584 Process not Found 97 PID 2584 wrote to memory of 4852 2584 Process not Found 98 PID 2584 wrote to memory of 4852 2584 Process not Found 98 PID 2584 wrote to memory of 4852 2584 Process not Found 98 PID 2584 wrote to memory of 4852 2584 Process not Found 98 PID 2584 wrote to memory of 704 2584 Process not Found 99 PID 2584 wrote to memory of 704 2584 Process not Found 99 PID 2584 wrote to memory of 704 2584 Process not Found 99 PID 2584 wrote to memory of 704 2584 Process not Found 99 PID 2584 wrote to memory of 3396 2584 Process not Found 100 PID 2584 wrote to memory of 3396 2584 Process not Found 100 PID 2584 wrote to memory of 3396 2584 Process not Found 100 PID 2584 wrote to memory of 3396 2584 Process not Found 100 PID 2584 wrote to memory of 4996 2584 Process not Found 101 PID 2584 wrote to memory of 4996 2584 Process not Found 101 PID 2584 wrote to memory of 4996 2584 Process not Found 101 PID 2584 wrote to memory of 5028 2584 Process not Found 102 PID 2584 wrote to memory of 5028 2584 Process not Found 102 PID 2584 wrote to memory of 5028 2584 Process not Found 102 PID 2584 wrote to memory of 5028 2584 Process not Found 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\2949ae862f29a51027ade70cc02e483439f4c3aba6e42e6623daced3714d1b60.exe"C:\Users\Admin\AppData\Local\Temp\2949ae862f29a51027ade70cc02e483439f4c3aba6e42e6623daced3714d1b60.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1044
-
C:\Users\Admin\AppData\Local\Temp\FE4A.exeC:\Users\Admin\AppData\Local\Temp\FE4A.exe1⤵
- Executes dropped EXE
PID:3720
-
C:\Users\Admin\AppData\Local\Temp\34D.exeC:\Users\Admin\AppData\Local\Temp\34D.exe1⤵
- Executes dropped EXE
PID:4212
-
C:\Users\Admin\AppData\Local\Temp\AFE.exeC:\Users\Admin\AppData\Local\Temp\AFE.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵PID:1052
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4796
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1808
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:392
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4848
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4852
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:704
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3396
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4996
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:5028
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD59748489855d9dd82ab09da5e3e55b19e
SHA16ed2bf6a1a53a59cd2137812cb43b5032817f6a1
SHA25605bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b
SHA5127eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be
-
Filesize
4KB
MD59748489855d9dd82ab09da5e3e55b19e
SHA16ed2bf6a1a53a59cd2137812cb43b5032817f6a1
SHA25605bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b
SHA5127eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be
-
Filesize
1.6MB
MD55e90d194f2ea7c8fdbbdd2e92a27cc86
SHA177a386f998234404c0107238ae6990a18795c842
SHA256a23d3de62c296400d288e7e4457162ccc8cc8c4936f3e59fc4ceb6ca137a3db1
SHA512c26175e17645947bf6b73610a3d1c36d4669fc3ff5d5ed7792c9c8e066fa7d0f9168c071cae0210c67cdd8165259f440ce8ce0e2128a09a1ffd140134cd57f39
-
Filesize
1.6MB
MD55e90d194f2ea7c8fdbbdd2e92a27cc86
SHA177a386f998234404c0107238ae6990a18795c842
SHA256a23d3de62c296400d288e7e4457162ccc8cc8c4936f3e59fc4ceb6ca137a3db1
SHA512c26175e17645947bf6b73610a3d1c36d4669fc3ff5d5ed7792c9c8e066fa7d0f9168c071cae0210c67cdd8165259f440ce8ce0e2128a09a1ffd140134cd57f39
-
Filesize
4KB
MD59748489855d9dd82ab09da5e3e55b19e
SHA16ed2bf6a1a53a59cd2137812cb43b5032817f6a1
SHA25605bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b
SHA5127eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be
-
Filesize
4KB
MD59748489855d9dd82ab09da5e3e55b19e
SHA16ed2bf6a1a53a59cd2137812cb43b5032817f6a1
SHA25605bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b
SHA5127eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be