Analysis
-
max time kernel
138s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 08:10
Static task
static1
Behavioral task
behavioral1
Sample
a26ae7e4512744e5b4fd634374ab9ad4ba200a346ef5825b45f1db7caa416c43.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
a26ae7e4512744e5b4fd634374ab9ad4ba200a346ef5825b45f1db7caa416c43.exe
Resource
win10v2004-20240508-en
General
-
Target
a26ae7e4512744e5b4fd634374ab9ad4ba200a346ef5825b45f1db7caa416c43.exe
-
Size
188KB
-
MD5
843754146d2c72fb332985f7a5cfab38
-
SHA1
a40a6fdfa57406c86bd2dc454f868a40a5a4e4df
-
SHA256
a26ae7e4512744e5b4fd634374ab9ad4ba200a346ef5825b45f1db7caa416c43
-
SHA512
2994c8475dcd8c5d82505111f1f3a43ba7c976a9c28b65892fe7f51d5b148981c73d8b971dedf9ec2fcac7c223509c2b61f6dd2129290812d7a9f414ffbeae70
-
SSDEEP
1536:Qei7HziSWtkjAIueNPuq5NG6UYfrie9oQlLTCWwZIy/9cWDScjj/rX5IDQc9j9e1:ImeP5NnUWxTsHaWDSm5ID
Malware Config
Extracted
smokeloader
pub1
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2936 396 WerFault.exe a26ae7e4512744e5b4fd634374ab9ad4ba200a346ef5825b45f1db7caa416c43.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
a26ae7e4512744e5b4fd634374ab9ad4ba200a346ef5825b45f1db7caa416c43.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a26ae7e4512744e5b4fd634374ab9ad4ba200a346ef5825b45f1db7caa416c43.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a26ae7e4512744e5b4fd634374ab9ad4ba200a346ef5825b45f1db7caa416c43.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a26ae7e4512744e5b4fd634374ab9ad4ba200a346ef5825b45f1db7caa416c43.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a26ae7e4512744e5b4fd634374ab9ad4ba200a346ef5825b45f1db7caa416c43.exe"C:\Users\Admin\AppData\Local\Temp\a26ae7e4512744e5b4fd634374ab9ad4ba200a346ef5825b45f1db7caa416c43.exe"1⤵
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 3522⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 396 -ip 3961⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/396-3-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/396-2-0x0000000003A80000-0x0000000003A8B000-memory.dmpFilesize
44KB
-
memory/396-1-0x0000000002160000-0x0000000002260000-memory.dmpFilesize
1024KB
-
memory/396-5-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/396-4-0x0000000000400000-0x0000000001F7A000-memory.dmpFilesize
27.5MB