Analysis
-
max time kernel
291s -
max time network
304s -
platform
windows10-1703_x64 -
resource
win10-20240319-en -
resource tags
arch:x64arch:x86image:win10-20240319-enlocale:en-usos:windows10-1703-x64system -
submitted
28-03-2024 22:40
Static task
static1
Behavioral task
behavioral1
Sample
a8f1ae296787ddc24e0e7a241d0bc5829631c98a5eb186a8cfd5795c6d287db9.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
a8f1ae296787ddc24e0e7a241d0bc5829631c98a5eb186a8cfd5795c6d287db9.exe
Resource
win10-20240319-en
General
-
Target
a8f1ae296787ddc24e0e7a241d0bc5829631c98a5eb186a8cfd5795c6d287db9.exe
-
Size
315KB
-
MD5
5fe67781ffe47ec36f91991abf707432
-
SHA1
137e6d50387a837bf929b0da70ab6b1512e95466
-
SHA256
a8f1ae296787ddc24e0e7a241d0bc5829631c98a5eb186a8cfd5795c6d287db9
-
SHA512
0e32d9a72b562d4c4a8c4edbd3d0ece54b67ee87c8ac382c6508c62b04b11a2dcd1fba23c3a78004fcd0c2b623dc854fd2fd82eb372dc7becdcbdd7ec7fe1b68
-
SSDEEP
3072:Q/uViE3w/D/5q+eF/2HjXuq4wQa+pOhKRIEcwE3G/uWQnDPPWCA6jeCKGAY:Q/uVi35q+bGVO7xSQPPfxahhY
Malware Config
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1228 1452 WerFault.exe a8f1ae296787ddc24e0e7a241d0bc5829631c98a5eb186a8cfd5795c6d287db9.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
a8f1ae296787ddc24e0e7a241d0bc5829631c98a5eb186a8cfd5795c6d287db9.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a8f1ae296787ddc24e0e7a241d0bc5829631c98a5eb186a8cfd5795c6d287db9.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a8f1ae296787ddc24e0e7a241d0bc5829631c98a5eb186a8cfd5795c6d287db9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a8f1ae296787ddc24e0e7a241d0bc5829631c98a5eb186a8cfd5795c6d287db9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8f1ae296787ddc24e0e7a241d0bc5829631c98a5eb186a8cfd5795c6d287db9.exe"C:\Users\Admin\AppData\Local\Temp\a8f1ae296787ddc24e0e7a241d0bc5829631c98a5eb186a8cfd5795c6d287db9.exe"1⤵
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1452 -s 4882⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1452-1-0x0000000002EC0000-0x0000000002FC0000-memory.dmpFilesize
1024KB
-
memory/1452-2-0x0000000002E90000-0x0000000002E9B000-memory.dmpFilesize
44KB
-
memory/1452-3-0x0000000000400000-0x0000000002D4D000-memory.dmpFilesize
41.3MB
-
memory/1452-5-0x0000000002EC0000-0x0000000002FC0000-memory.dmpFilesize
1024KB