Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
06-06-2023 13:21
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
General
-
Target
file.exe
-
Size
241KB
-
MD5
dc076ed6da7792af479120129fad2716
-
SHA1
5950886a02ed459d9ffa92b98a1c4b0462e0de88
-
SHA256
a51b880c04fcc66cc1c561b3b490b04db675f2775bbf1dfc299572d2401e706d
-
SHA512
e58ff229a7649f58f75ed3fba90c72be7d1b378a9f8d2e184039dd9bbd7b04e925a556f410176b4711497caa7edbc7bff87d1e09870077cabf338def098e8a85
-
SSDEEP
3072:zfFQgZdMFWaC7RMgxSMGyfTuyyHM3IZcY+5wxv+mG+O3VKdFp7CnYTRqKV/c:zFQkMFxhgxSMGyyLUzSR+1+GXYM
Malware Config
Extracted
smokeloader
pub1
Extracted
smokeloader
2022
http://toobussy.com/tmp/
http://wuc11.com/tmp/
http://ladogatur.ru/tmp/
http://kingpirate.ru/tmp/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
DFC6.exepid process 2936 DFC6.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4488 2936 WerFault.exe DFC6.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
file.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
file.exepid process 5056 file.exe 5056 file.exe 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3152 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
file.exepid process 5056 file.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
DFC6.exedescription pid process Token: SeDebugPrivilege 2936 DFC6.exe Token: SeShutdownPrivilege 3152 Token: SeCreatePagefilePrivilege 3152 Token: SeShutdownPrivilege 3152 Token: SeCreatePagefilePrivilege 3152 Token: SeShutdownPrivilege 3152 Token: SeCreatePagefilePrivilege 3152 Token: SeShutdownPrivilege 3152 Token: SeCreatePagefilePrivilege 3152 Token: SeShutdownPrivilege 3152 Token: SeCreatePagefilePrivilege 3152 -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
description pid process target process PID 3152 wrote to memory of 2936 3152 DFC6.exe PID 3152 wrote to memory of 2936 3152 DFC6.exe PID 3152 wrote to memory of 2936 3152 DFC6.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\DFC6.exeC:\Users\Admin\AppData\Local\Temp\DFC6.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 12362⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2936 -ip 29361⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DFC6.exeFilesize
338KB
MD5f01d05137762dd36a5c548279246b113
SHA17105ba81779f4e2353565819e8b0f8934132348d
SHA25636613338c586fb7ddf36d7cda3c336180127030cc16f558e20e725f8542f01e6
SHA51238aa9e9dad0e4dfb4de06d34d952172be854d7174e7a9e87bd98a12d9fcf5eb2cbe179ed34f83a570c7da46f14eb545427e7cca382c08014de9cdf57525c0bf3
-
C:\Users\Admin\AppData\Local\Temp\DFC6.exeFilesize
338KB
MD5f01d05137762dd36a5c548279246b113
SHA17105ba81779f4e2353565819e8b0f8934132348d
SHA25636613338c586fb7ddf36d7cda3c336180127030cc16f558e20e725f8542f01e6
SHA51238aa9e9dad0e4dfb4de06d34d952172be854d7174e7a9e87bd98a12d9fcf5eb2cbe179ed34f83a570c7da46f14eb545427e7cca382c08014de9cdf57525c0bf3
-
memory/2936-147-0x0000000004940000-0x000000000497D000-memory.dmpFilesize
244KB
-
memory/2936-148-0x0000000007400000-0x00000000079A4000-memory.dmpFilesize
5.6MB
-
memory/2936-149-0x00000000079E0000-0x0000000007FF8000-memory.dmpFilesize
6.1MB
-
memory/2936-150-0x0000000008070000-0x0000000008082000-memory.dmpFilesize
72KB
-
memory/2936-151-0x0000000008090000-0x000000000819A000-memory.dmpFilesize
1.0MB
-
memory/2936-152-0x00000000081A0000-0x00000000081DC000-memory.dmpFilesize
240KB
-
memory/2936-153-0x00000000073F0000-0x0000000007400000-memory.dmpFilesize
64KB
-
memory/2936-154-0x00000000073F0000-0x0000000007400000-memory.dmpFilesize
64KB
-
memory/2936-155-0x00000000083B0000-0x0000000008416000-memory.dmpFilesize
408KB
-
memory/2936-156-0x0000000008BB0000-0x0000000008C42000-memory.dmpFilesize
584KB
-
memory/2936-157-0x0000000008C50000-0x0000000008CC6000-memory.dmpFilesize
472KB
-
memory/2936-158-0x0000000008CF0000-0x0000000008D0E000-memory.dmpFilesize
120KB
-
memory/2936-159-0x0000000008EB0000-0x0000000009072000-memory.dmpFilesize
1.8MB
-
memory/2936-160-0x00000000090A0000-0x00000000095CC000-memory.dmpFilesize
5.2MB
-
memory/2936-182-0x0000000000400000-0x0000000002CFB000-memory.dmpFilesize
41.0MB
-
memory/3152-174-0x0000000007F90000-0x0000000007FA0000-memory.dmpFilesize
64KB
-
memory/3152-185-0x0000000008BB0000-0x0000000008BC0000-memory.dmpFilesize
64KB
-
memory/3152-163-0x0000000007F90000-0x0000000007FA0000-memory.dmpFilesize
64KB
-
memory/3152-164-0x0000000007F90000-0x0000000007FA0000-memory.dmpFilesize
64KB
-
memory/3152-165-0x0000000007F90000-0x0000000007FA0000-memory.dmpFilesize
64KB
-
memory/3152-166-0x0000000007F90000-0x0000000007FA0000-memory.dmpFilesize
64KB
-
memory/3152-167-0x0000000007F90000-0x0000000007FA0000-memory.dmpFilesize
64KB
-
memory/3152-168-0x0000000007F90000-0x0000000007FA0000-memory.dmpFilesize
64KB
-
memory/3152-169-0x0000000007F90000-0x0000000007FA0000-memory.dmpFilesize
64KB
-
memory/3152-170-0x0000000007F90000-0x0000000007FA0000-memory.dmpFilesize
64KB
-
memory/3152-171-0x0000000007F90000-0x0000000007FA0000-memory.dmpFilesize
64KB
-
memory/3152-172-0x0000000007F90000-0x0000000007FA0000-memory.dmpFilesize
64KB
-
memory/3152-173-0x0000000007F90000-0x0000000007FA0000-memory.dmpFilesize
64KB
-
memory/3152-135-0x0000000001240000-0x0000000001256000-memory.dmpFilesize
88KB
-
memory/3152-175-0x0000000007F90000-0x0000000007FA0000-memory.dmpFilesize
64KB
-
memory/3152-176-0x0000000007F90000-0x0000000007FA0000-memory.dmpFilesize
64KB
-
memory/3152-177-0x0000000007F90000-0x0000000007FA0000-memory.dmpFilesize
64KB
-
memory/3152-178-0x0000000007FA0000-0x0000000007FB0000-memory.dmpFilesize
64KB
-
memory/3152-179-0x0000000008BB0000-0x0000000008BC0000-memory.dmpFilesize
64KB
-
memory/3152-180-0x0000000008BB0000-0x0000000008BC0000-memory.dmpFilesize
64KB
-
memory/3152-181-0x0000000008BB0000-0x0000000008BC0000-memory.dmpFilesize
64KB
-
memory/3152-183-0x0000000008BB0000-0x0000000008BC0000-memory.dmpFilesize
64KB
-
memory/3152-184-0x0000000008BB0000-0x0000000008BC0000-memory.dmpFilesize
64KB
-
memory/3152-162-0x0000000007F90000-0x0000000007FA0000-memory.dmpFilesize
64KB
-
memory/3152-186-0x0000000007F90000-0x0000000007FA0000-memory.dmpFilesize
64KB
-
memory/3152-187-0x0000000007F90000-0x0000000007FA0000-memory.dmpFilesize
64KB
-
memory/3152-188-0x0000000007F90000-0x0000000007FA0000-memory.dmpFilesize
64KB
-
memory/3152-189-0x0000000007F90000-0x0000000007FA0000-memory.dmpFilesize
64KB
-
memory/3152-190-0x0000000007F90000-0x0000000007FA0000-memory.dmpFilesize
64KB
-
memory/3152-191-0x0000000007F90000-0x0000000007FA0000-memory.dmpFilesize
64KB
-
memory/3152-192-0x0000000007F90000-0x0000000007FA0000-memory.dmpFilesize
64KB
-
memory/3152-193-0x0000000007F90000-0x0000000007FA0000-memory.dmpFilesize
64KB
-
memory/3152-194-0x0000000007F90000-0x0000000007FA0000-memory.dmpFilesize
64KB
-
memory/3152-195-0x0000000007F90000-0x0000000007FA0000-memory.dmpFilesize
64KB
-
memory/3152-196-0x0000000007F90000-0x0000000007FA0000-memory.dmpFilesize
64KB
-
memory/3152-197-0x0000000007F90000-0x0000000007FA0000-memory.dmpFilesize
64KB
-
memory/3152-198-0x0000000007F90000-0x0000000007FA0000-memory.dmpFilesize
64KB
-
memory/3152-199-0x0000000007F90000-0x0000000007FA0000-memory.dmpFilesize
64KB
-
memory/3152-200-0x0000000007F90000-0x0000000007FA0000-memory.dmpFilesize
64KB
-
memory/3152-201-0x0000000007F90000-0x0000000007FA0000-memory.dmpFilesize
64KB
-
memory/3152-202-0x00000000032A0000-0x00000000032A2000-memory.dmpFilesize
8KB
-
memory/3152-203-0x00000000032C0000-0x00000000032C3000-memory.dmpFilesize
12KB
-
memory/3152-204-0x00000000032B0000-0x00000000032BB000-memory.dmpFilesize
44KB
-
memory/5056-134-0x0000000002E40000-0x0000000002E49000-memory.dmpFilesize
36KB
-
memory/5056-136-0x0000000000400000-0x0000000002CE3000-memory.dmpFilesize
40.9MB