Analysis
-
max time kernel
151s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
06-06-2023 13:21
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
General
-
Target
file.exe
-
Size
241KB
-
MD5
dc076ed6da7792af479120129fad2716
-
SHA1
5950886a02ed459d9ffa92b98a1c4b0462e0de88
-
SHA256
a51b880c04fcc66cc1c561b3b490b04db675f2775bbf1dfc299572d2401e706d
-
SHA512
e58ff229a7649f58f75ed3fba90c72be7d1b378a9f8d2e184039dd9bbd7b04e925a556f410176b4711497caa7edbc7bff87d1e09870077cabf338def098e8a85
-
SSDEEP
3072:zfFQgZdMFWaC7RMgxSMGyfTuyyHM3IZcY+5wxv+mG+O3VKdFp7CnYTRqKV/c:zFQkMFxhgxSMGyyLUzSR+1+GXYM
Malware Config
Extracted
smokeloader
pub1
Extracted
smokeloader
2022
http://toobussy.com/tmp/
http://wuc11.com/tmp/
http://ladogatur.ru/tmp/
http://kingpirate.ru/tmp/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
CE51.exepid process 1720 CE51.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1324 1720 WerFault.exe CE51.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
file.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
file.exepid process 1416 file.exe 1416 file.exe 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 756 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 756 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
file.exepid process 1416 file.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes:
CE51.exedescription pid process Token: SeShutdownPrivilege 756 Token: SeCreatePagefilePrivilege 756 Token: SeShutdownPrivilege 756 Token: SeCreatePagefilePrivilege 756 Token: SeDebugPrivilege 1720 CE51.exe Token: SeShutdownPrivilege 756 Token: SeCreatePagefilePrivilege 756 Token: SeShutdownPrivilege 756 Token: SeCreatePagefilePrivilege 756 Token: SeShutdownPrivilege 756 Token: SeCreatePagefilePrivilege 756 Token: SeShutdownPrivilege 756 Token: SeCreatePagefilePrivilege 756 Token: SeShutdownPrivilege 756 Token: SeCreatePagefilePrivilege 756 -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
description pid process target process PID 756 wrote to memory of 1720 756 CE51.exe PID 756 wrote to memory of 1720 756 CE51.exe PID 756 wrote to memory of 1720 756 CE51.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\CE51.exeC:\Users\Admin\AppData\Local\Temp\CE51.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 12242⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1720 -ip 17201⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\CE51.exeFilesize
338KB
MD5f01d05137762dd36a5c548279246b113
SHA17105ba81779f4e2353565819e8b0f8934132348d
SHA25636613338c586fb7ddf36d7cda3c336180127030cc16f558e20e725f8542f01e6
SHA51238aa9e9dad0e4dfb4de06d34d952172be854d7174e7a9e87bd98a12d9fcf5eb2cbe179ed34f83a570c7da46f14eb545427e7cca382c08014de9cdf57525c0bf3
-
C:\Users\Admin\AppData\Local\Temp\CE51.exeFilesize
338KB
MD5f01d05137762dd36a5c548279246b113
SHA17105ba81779f4e2353565819e8b0f8934132348d
SHA25636613338c586fb7ddf36d7cda3c336180127030cc16f558e20e725f8542f01e6
SHA51238aa9e9dad0e4dfb4de06d34d952172be854d7174e7a9e87bd98a12d9fcf5eb2cbe179ed34f83a570c7da46f14eb545427e7cca382c08014de9cdf57525c0bf3
-
memory/756-182-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-199-0x0000000000CF0000-0x0000000000CFB000-memory.dmpFilesize
44KB
-
memory/756-141-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-140-0x0000000002E70000-0x0000000002E80000-memory.dmpFilesize
64KB
-
memory/756-142-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-144-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-145-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-143-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-146-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-147-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-148-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-149-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-150-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-151-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-152-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-153-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-154-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-155-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-156-0x0000000002E90000-0x0000000002E99000-memory.dmpFilesize
36KB
-
memory/756-218-0x0000000002EA0000-0x0000000002EB0000-memory.dmpFilesize
64KB
-
memory/756-135-0x0000000000980000-0x0000000000996000-memory.dmpFilesize
88KB
-
memory/756-217-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-216-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-214-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-213-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-212-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-211-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-210-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-209-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-208-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-207-0x0000000002E80000-0x0000000002E82000-memory.dmpFilesize
8KB
-
memory/756-206-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-205-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-204-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-203-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-179-0x0000000002E70000-0x0000000002E80000-memory.dmpFilesize
64KB
-
memory/756-202-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-215-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-139-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-184-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-185-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-186-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-187-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-188-0x0000000000CE0000-0x0000000000CE2000-memory.dmpFilesize
8KB
-
memory/756-189-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-190-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-191-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-192-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-193-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-194-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-195-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-196-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-197-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-198-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-183-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/756-200-0x0000000000CE0000-0x0000000000CE2000-memory.dmpFilesize
8KB
-
memory/756-201-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/1416-136-0x0000000000400000-0x0000000002CE3000-memory.dmpFilesize
40.9MB
-
memory/1416-134-0x0000000002E40000-0x0000000002E49000-memory.dmpFilesize
36KB
-
memory/1720-178-0x00000000090A0000-0x00000000095CC000-memory.dmpFilesize
5.2MB
-
memory/1720-177-0x0000000008EB0000-0x0000000009072000-memory.dmpFilesize
1.8MB
-
memory/1720-175-0x0000000008D40000-0x0000000008DB6000-memory.dmpFilesize
472KB
-
memory/1720-174-0x0000000008B70000-0x0000000008C02000-memory.dmpFilesize
584KB
-
memory/1720-173-0x0000000008370000-0x00000000083D6000-memory.dmpFilesize
408KB
-
memory/1720-170-0x0000000007FF0000-0x00000000080FA000-memory.dmpFilesize
1.0MB
-
memory/1720-171-0x0000000005030000-0x000000000506C000-memory.dmpFilesize
240KB
-
memory/1720-176-0x0000000008E00000-0x0000000008E1E000-memory.dmpFilesize
120KB
-
memory/1720-169-0x0000000005010000-0x0000000005022000-memory.dmpFilesize
72KB
-
memory/1720-168-0x00000000079D0000-0x0000000007FE8000-memory.dmpFilesize
6.1MB
-
memory/1720-167-0x0000000004EA0000-0x0000000004EB0000-memory.dmpFilesize
64KB
-
memory/1720-181-0x0000000000400000-0x0000000002CFB000-memory.dmpFilesize
41.0MB
-
memory/1720-166-0x0000000004810000-0x000000000484D000-memory.dmpFilesize
244KB
-
memory/1720-165-0x0000000007420000-0x00000000079C4000-memory.dmpFilesize
5.6MB
-
memory/1720-172-0x0000000004EA0000-0x0000000004EB0000-memory.dmpFilesize
64KB