Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
01-05-2024 19:53
Static task
static1
Behavioral task
behavioral1
Sample
f95c4a9c2b9106af8039629e43ca93d9079dceb7960f49dc77b8ae7a0e3e3c25.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
f95c4a9c2b9106af8039629e43ca93d9079dceb7960f49dc77b8ae7a0e3e3c25.exe
Resource
win11-20240419-en
General
-
Target
f95c4a9c2b9106af8039629e43ca93d9079dceb7960f49dc77b8ae7a0e3e3c25.exe
-
Size
259KB
-
MD5
d8a73e39f2b56637fa317cdadd6aa35e
-
SHA1
1fd8d602b58a6c74c0fec737d8a8818bfe21e77e
-
SHA256
f95c4a9c2b9106af8039629e43ca93d9079dceb7960f49dc77b8ae7a0e3e3c25
-
SHA512
32706d17566af1e75bcedbd441b38ccb7500a44d288baee820a1547e929467371ce88a130f21713fda3ff199c86ed36ba251b9b2f8e17b675dc9715b98656987
-
SSDEEP
1536:f6InnEHyf6c3fFp/bUk+GgIysb4PvjRBtmVuh9Dfjc5hVM4Zq7YQM0363B5WmwxE:fPpFpgIyl1jmArku7s5WmwSqg1fd
Malware Config
Extracted
smokeloader
pub1
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4236 2368 WerFault.exe f95c4a9c2b9106af8039629e43ca93d9079dceb7960f49dc77b8ae7a0e3e3c25.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
f95c4a9c2b9106af8039629e43ca93d9079dceb7960f49dc77b8ae7a0e3e3c25.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f95c4a9c2b9106af8039629e43ca93d9079dceb7960f49dc77b8ae7a0e3e3c25.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f95c4a9c2b9106af8039629e43ca93d9079dceb7960f49dc77b8ae7a0e3e3c25.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f95c4a9c2b9106af8039629e43ca93d9079dceb7960f49dc77b8ae7a0e3e3c25.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f95c4a9c2b9106af8039629e43ca93d9079dceb7960f49dc77b8ae7a0e3e3c25.exe"C:\Users\Admin\AppData\Local\Temp\f95c4a9c2b9106af8039629e43ca93d9079dceb7960f49dc77b8ae7a0e3e3c25.exe"1⤵
- Checks SCSI registry key(s)
PID:2368 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 3522⤵
- Program crash
PID:4236
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2368 -ip 23681⤵PID:2492