Resubmissions
09/04/2024, 07:26
240409-h9p4sahe34 1009/04/2024, 07:25
240409-h8859scg41 1009/04/2024, 07:25
240409-h8ydrshd88 1009/04/2024, 07:24
240409-h8gq1shd78 1004/02/2024, 03:55
240204-eha9rsbddj 10Analysis
-
max time kernel
1192s -
max time network
868s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
09/04/2024, 07:25
Static task
static1
Behavioral task
behavioral1
Sample
c14c3db7340277d58f53d5ff4f28a67fda54636fdb9b07fba60992c9ed03ae57.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
c14c3db7340277d58f53d5ff4f28a67fda54636fdb9b07fba60992c9ed03ae57.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
c14c3db7340277d58f53d5ff4f28a67fda54636fdb9b07fba60992c9ed03ae57.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
c14c3db7340277d58f53d5ff4f28a67fda54636fdb9b07fba60992c9ed03ae57.exe
Resource
win11-20240221-en
General
-
Target
c14c3db7340277d58f53d5ff4f28a67fda54636fdb9b07fba60992c9ed03ae57.exe
-
Size
289KB
-
MD5
982b330786cb34fd69849d9d7cb296a9
-
SHA1
536c5f37004cd255cfbeff9330bf4d7f7795d87d
-
SHA256
c14c3db7340277d58f53d5ff4f28a67fda54636fdb9b07fba60992c9ed03ae57
-
SHA512
d9a943fb547d74acc2dc44fbf847729705426b2d81cf034daefdf680968a43defc2d1b9565a563e01cd7cdd7a9581527136018e573bb4516e861c3ede5562d70
-
SSDEEP
3072:AfSJIG3VDgzl3rLJEBTdD96DttL2WHCfaTqCXyhZfLhaWblDmj3nnX7GHBrR4ulT:AnggFrLu5d96Dtt6Ww841kr7EBD5Fp6
Malware Config
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Program crash 1 IoCs
pid pid_target Process procid_target 4948 2764 WerFault.exe 71 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c14c3db7340277d58f53d5ff4f28a67fda54636fdb9b07fba60992c9ed03ae57.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c14c3db7340277d58f53d5ff4f28a67fda54636fdb9b07fba60992c9ed03ae57.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c14c3db7340277d58f53d5ff4f28a67fda54636fdb9b07fba60992c9ed03ae57.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c14c3db7340277d58f53d5ff4f28a67fda54636fdb9b07fba60992c9ed03ae57.exe"C:\Users\Admin\AppData\Local\Temp\c14c3db7340277d58f53d5ff4f28a67fda54636fdb9b07fba60992c9ed03ae57.exe"1⤵
- Checks SCSI registry key(s)
PID:2764 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 4922⤵
- Program crash
PID:4948
-