Resubmissions

09/04/2024, 07:26

240409-h9p4sahe34 10

09/04/2024, 07:25

240409-h8859scg41 10

09/04/2024, 07:25

240409-h8ydrshd88 10

09/04/2024, 07:24

240409-h8gq1shd78 10

04/02/2024, 03:55

240204-eha9rsbddj 10

Analysis

  • max time kernel
    1192s
  • max time network
    868s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    09/04/2024, 07:25

General

  • Target

    c14c3db7340277d58f53d5ff4f28a67fda54636fdb9b07fba60992c9ed03ae57.exe

  • Size

    289KB

  • MD5

    982b330786cb34fd69849d9d7cb296a9

  • SHA1

    536c5f37004cd255cfbeff9330bf4d7f7795d87d

  • SHA256

    c14c3db7340277d58f53d5ff4f28a67fda54636fdb9b07fba60992c9ed03ae57

  • SHA512

    d9a943fb547d74acc2dc44fbf847729705426b2d81cf034daefdf680968a43defc2d1b9565a563e01cd7cdd7a9581527136018e573bb4516e861c3ede5562d70

  • SSDEEP

    3072:AfSJIG3VDgzl3rLJEBTdD96DttL2WHCfaTqCXyhZfLhaWblDmj3nnX7GHBrR4ulT:AnggFrLu5d96Dtt6Ww841kr7EBD5Fp6

Malware Config

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

Processes

  • C:\Users\Admin\AppData\Local\Temp\c14c3db7340277d58f53d5ff4f28a67fda54636fdb9b07fba60992c9ed03ae57.exe
    "C:\Users\Admin\AppData\Local\Temp\c14c3db7340277d58f53d5ff4f28a67fda54636fdb9b07fba60992c9ed03ae57.exe"
    1⤵
    • Checks SCSI registry key(s)
    PID:2764
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 492
      2⤵
      • Program crash
      PID:4948

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2764-1-0x0000000000850000-0x0000000000950000-memory.dmp

          Filesize

          1024KB

        • memory/2764-2-0x0000000000950000-0x000000000095B000-memory.dmp

          Filesize

          44KB

        • memory/2764-3-0x0000000000400000-0x00000000007D1000-memory.dmp

          Filesize

          3.8MB

        • memory/2764-6-0x0000000000850000-0x0000000000950000-memory.dmp

          Filesize

          1024KB