Analysis
-
max time kernel
280s -
max time network
300s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
01-05-2024 23:03
Static task
static1
Behavioral task
behavioral1
Sample
4a312d9b5d2ad81ce5da704369f201268fda30a8274136c3595767203e463e9d.exe
Resource
win7-20240221-en
General
-
Target
4a312d9b5d2ad81ce5da704369f201268fda30a8274136c3595767203e463e9d.exe
-
Size
1.6MB
-
MD5
7a1a1ef5364d1de84ccda20479a6be66
-
SHA1
4141826fdaf7c15e6ee2f23ea0bdc2c5ef1e09ae
-
SHA256
4a312d9b5d2ad81ce5da704369f201268fda30a8274136c3595767203e463e9d
-
SHA512
7d2cf5b4894af33c56497883b6dc9d0d69ce6beb7bc6615ee2ad0b3bf1467b4e6080ca570cacd112dd011e2764b0bd663a3d05d0a72462cbbbbf49a05a7cca36
-
SSDEEP
24576:kmZ+I9s6x+YxgS7WvwCB06006XU6DixBQuGmTm:kmZ+Iqyri2NCBL6XU6mbQrm
Malware Config
Extracted
smokeloader
pub3
Signatures
-
Detect ZGRat V1 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1176-16-0x0000000000400000-0x00000000004B4000-memory.dmp family_zgrat_v1 -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
4a312d9b5d2ad81ce5da704369f201268fda30a8274136c3595767203e463e9d.exeAddInProcess32.exedescription pid process target process PID 500 set thread context of 3156 500 4a312d9b5d2ad81ce5da704369f201268fda30a8274136c3595767203e463e9d.exe AddInProcess32.exe PID 500 set thread context of 2088 500 4a312d9b5d2ad81ce5da704369f201268fda30a8274136c3595767203e463e9d.exe AddInProcess32.exe PID 3156 set thread context of 1176 3156 AddInProcess32.exe InstallUtil.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
AddInProcess32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AddInProcess32.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AddInProcess32.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AddInProcess32.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
4a312d9b5d2ad81ce5da704369f201268fda30a8274136c3595767203e463e9d.exeAddInProcess32.exeInstallUtil.exepid process 500 4a312d9b5d2ad81ce5da704369f201268fda30a8274136c3595767203e463e9d.exe 500 4a312d9b5d2ad81ce5da704369f201268fda30a8274136c3595767203e463e9d.exe 3156 AddInProcess32.exe 3156 AddInProcess32.exe 3156 AddInProcess32.exe 3156 AddInProcess32.exe 1176 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
4a312d9b5d2ad81ce5da704369f201268fda30a8274136c3595767203e463e9d.exeAddInProcess32.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 500 4a312d9b5d2ad81ce5da704369f201268fda30a8274136c3595767203e463e9d.exe Token: SeDebugPrivilege 3156 AddInProcess32.exe Token: SeDebugPrivilege 1176 InstallUtil.exe Token: SeBackupPrivilege 1176 InstallUtil.exe Token: SeSecurityPrivilege 1176 InstallUtil.exe Token: SeSecurityPrivilege 1176 InstallUtil.exe Token: SeSecurityPrivilege 1176 InstallUtil.exe Token: SeSecurityPrivilege 1176 InstallUtil.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
4a312d9b5d2ad81ce5da704369f201268fda30a8274136c3595767203e463e9d.exeAddInProcess32.exedescription pid process target process PID 500 wrote to memory of 3156 500 4a312d9b5d2ad81ce5da704369f201268fda30a8274136c3595767203e463e9d.exe AddInProcess32.exe PID 500 wrote to memory of 3156 500 4a312d9b5d2ad81ce5da704369f201268fda30a8274136c3595767203e463e9d.exe AddInProcess32.exe PID 500 wrote to memory of 3156 500 4a312d9b5d2ad81ce5da704369f201268fda30a8274136c3595767203e463e9d.exe AddInProcess32.exe PID 500 wrote to memory of 3156 500 4a312d9b5d2ad81ce5da704369f201268fda30a8274136c3595767203e463e9d.exe AddInProcess32.exe PID 500 wrote to memory of 3156 500 4a312d9b5d2ad81ce5da704369f201268fda30a8274136c3595767203e463e9d.exe AddInProcess32.exe PID 500 wrote to memory of 3156 500 4a312d9b5d2ad81ce5da704369f201268fda30a8274136c3595767203e463e9d.exe AddInProcess32.exe PID 500 wrote to memory of 3156 500 4a312d9b5d2ad81ce5da704369f201268fda30a8274136c3595767203e463e9d.exe AddInProcess32.exe PID 500 wrote to memory of 3156 500 4a312d9b5d2ad81ce5da704369f201268fda30a8274136c3595767203e463e9d.exe AddInProcess32.exe PID 500 wrote to memory of 2088 500 4a312d9b5d2ad81ce5da704369f201268fda30a8274136c3595767203e463e9d.exe AddInProcess32.exe PID 500 wrote to memory of 2088 500 4a312d9b5d2ad81ce5da704369f201268fda30a8274136c3595767203e463e9d.exe AddInProcess32.exe PID 500 wrote to memory of 2088 500 4a312d9b5d2ad81ce5da704369f201268fda30a8274136c3595767203e463e9d.exe AddInProcess32.exe PID 500 wrote to memory of 2088 500 4a312d9b5d2ad81ce5da704369f201268fda30a8274136c3595767203e463e9d.exe AddInProcess32.exe PID 500 wrote to memory of 2088 500 4a312d9b5d2ad81ce5da704369f201268fda30a8274136c3595767203e463e9d.exe AddInProcess32.exe PID 500 wrote to memory of 2088 500 4a312d9b5d2ad81ce5da704369f201268fda30a8274136c3595767203e463e9d.exe AddInProcess32.exe PID 3156 wrote to memory of 4000 3156 AddInProcess32.exe InstallUtil.exe PID 3156 wrote to memory of 4000 3156 AddInProcess32.exe InstallUtil.exe PID 3156 wrote to memory of 4000 3156 AddInProcess32.exe InstallUtil.exe PID 3156 wrote to memory of 4000 3156 AddInProcess32.exe InstallUtil.exe PID 3156 wrote to memory of 4000 3156 AddInProcess32.exe InstallUtil.exe PID 3156 wrote to memory of 4000 3156 AddInProcess32.exe InstallUtil.exe PID 3156 wrote to memory of 4000 3156 AddInProcess32.exe InstallUtil.exe PID 3156 wrote to memory of 4000 3156 AddInProcess32.exe InstallUtil.exe PID 3156 wrote to memory of 1176 3156 AddInProcess32.exe InstallUtil.exe PID 3156 wrote to memory of 1176 3156 AddInProcess32.exe InstallUtil.exe PID 3156 wrote to memory of 1176 3156 AddInProcess32.exe InstallUtil.exe PID 3156 wrote to memory of 1176 3156 AddInProcess32.exe InstallUtil.exe PID 3156 wrote to memory of 1176 3156 AddInProcess32.exe InstallUtil.exe PID 3156 wrote to memory of 1176 3156 AddInProcess32.exe InstallUtil.exe PID 3156 wrote to memory of 1176 3156 AddInProcess32.exe InstallUtil.exe PID 3156 wrote to memory of 1176 3156 AddInProcess32.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a312d9b5d2ad81ce5da704369f201268fda30a8274136c3595767203e463e9d.exe"C:\Users\Admin\AppData\Local\Temp\4a312d9b5d2ad81ce5da704369f201268fda30a8274136c3595767203e463e9d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:500 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵PID:4000
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1176 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- Checks SCSI registry key(s)
PID:2088
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/500-0-0x00007FFC97260000-0x00007FFC9743B000-memory.dmpFilesize
1.9MB
-
memory/500-1-0x0000000000330000-0x00000000004D4000-memory.dmpFilesize
1.6MB
-
memory/500-2-0x00000000053D0000-0x00000000058CE000-memory.dmpFilesize
5.0MB
-
memory/500-3-0x0000000004ED0000-0x0000000004F62000-memory.dmpFilesize
584KB
-
memory/500-4-0x0000000004F70000-0x000000000500C000-memory.dmpFilesize
624KB
-
memory/500-5-0x0000000004E40000-0x0000000004E84000-memory.dmpFilesize
272KB
-
memory/500-6-0x0000000000E20000-0x0000000000E2A000-memory.dmpFilesize
40KB
-
memory/500-7-0x0000000006B20000-0x0000000006B3A000-memory.dmpFilesize
104KB
-
memory/500-8-0x00000000053C0000-0x00000000053C6000-memory.dmpFilesize
24KB
-
memory/1176-20-0x0000000008510000-0x0000000008522000-memory.dmpFilesize
72KB
-
memory/1176-22-0x00000000086E0000-0x000000000872B000-memory.dmpFilesize
300KB
-
memory/1176-27-0x000000000AB00000-0x000000000B02C000-memory.dmpFilesize
5.2MB
-
memory/1176-26-0x000000000A400000-0x000000000A5C2000-memory.dmpFilesize
1.8MB
-
memory/1176-25-0x00000000089B0000-0x00000000089CE000-memory.dmpFilesize
120KB
-
memory/1176-16-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/1176-18-0x0000000008A50000-0x0000000009056000-memory.dmpFilesize
6.0MB
-
memory/1176-19-0x00000000085D0000-0x00000000086DA000-memory.dmpFilesize
1.0MB
-
memory/1176-21-0x0000000008570000-0x00000000085AE000-memory.dmpFilesize
248KB
-
memory/1176-24-0x0000000009160000-0x00000000091D6000-memory.dmpFilesize
472KB
-
memory/1176-23-0x00000000087F0000-0x0000000008856000-memory.dmpFilesize
408KB
-
memory/2088-15-0x00007FFC97260000-0x00007FFC9743B000-memory.dmpFilesize
1.9MB
-
memory/2088-13-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3156-11-0x0000000000400000-0x0000000000506000-memory.dmpFilesize
1.0MB
-
memory/3156-9-0x0000000000400000-0x0000000000506000-memory.dmpFilesize
1.0MB
-
memory/3156-12-0x00007FFC97260000-0x00007FFC9743B000-memory.dmpFilesize
1.9MB