Analysis

  • max time kernel
    300s
  • max time network
    31s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    25/02/2023, 22:47

General

  • Target

    c6bf32612e9edda0f05636131ee97f6d651a252fe31858d01baa8c402dadf7e9.ps1

  • Size

    552B

  • MD5

    e4e334efd3ed0f23499a75127e2662aa

  • SHA1

    7e460968dcbc7ddc8b8c6ede94798e54fbfc5e63

  • SHA256

    c6bf32612e9edda0f05636131ee97f6d651a252fe31858d01baa8c402dadf7e9

  • SHA512

    75d26061e143542f13a05839b054aaaac2146b5ea79bcf94b587169e822f27c525a8cf30f39e3048d5249346adacbeb2695a45a68e0bee48fdd2035ed068ade8

Malware Config

Signatures

  • Detects Smokeloader packer 4 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\c6bf32612e9edda0f05636131ee97f6d651a252fe31858d01baa8c402dadf7e9.ps1
    1⤵
    • Blocklisted process makes network request
    • Deletes itself
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1656
    • C:\Users\Admin\AppData\Local\Temp\agent.exe
      "C:\Users\Admin\AppData\Local\Temp\agent.exe"
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:656

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\agent.exe

          Filesize

          29KB

          MD5

          1496b98fe0530da47982105a87a69bce

          SHA1

          00719a1b168c8baa3827a161326b157713f9a07a

          SHA256

          c7c03c2d6a78eb79409a53304bfaf8a69334d2f6a5928db641092bcc39dc8e8d

          SHA512

          286c28a228dda2d589e7e5a75027c27fcc69244b8fec2ae1019d66a8fe6aa00ef245682a1e2dd3f37722c9c4220f2ddc52ab8750369842da028970c59513dcc6

        • C:\Users\Admin\AppData\Local\Temp\agent.exe

          Filesize

          29KB

          MD5

          1496b98fe0530da47982105a87a69bce

          SHA1

          00719a1b168c8baa3827a161326b157713f9a07a

          SHA256

          c7c03c2d6a78eb79409a53304bfaf8a69334d2f6a5928db641092bcc39dc8e8d

          SHA512

          286c28a228dda2d589e7e5a75027c27fcc69244b8fec2ae1019d66a8fe6aa00ef245682a1e2dd3f37722c9c4220f2ddc52ab8750369842da028970c59513dcc6

        • memory/656-71-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

        • memory/656-73-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

        • memory/1248-72-0x0000000002C00000-0x0000000002C16000-memory.dmp

          Filesize

          88KB

        • memory/1656-58-0x000000001B400000-0x000000001B6E2000-memory.dmp

          Filesize

          2.9MB

        • memory/1656-59-0x0000000001F90000-0x0000000001F98000-memory.dmp

          Filesize

          32KB

        • memory/1656-60-0x0000000002890000-0x0000000002910000-memory.dmp

          Filesize

          512KB

        • memory/1656-61-0x0000000002890000-0x0000000002910000-memory.dmp

          Filesize

          512KB

        • memory/1656-62-0x0000000002890000-0x0000000002910000-memory.dmp

          Filesize

          512KB

        • memory/1656-63-0x0000000002890000-0x0000000002910000-memory.dmp

          Filesize

          512KB