Resubmissions
09-09-2020 09:18
200909-ev13telmdn 1008-09-2020 17:08
200908-br2a8ynnpn 1008-09-2020 17:07
200908-2bbw72ekmn 1008-09-2020 16:54
200908-qgbye23mhs 1008-09-2020 16:46
200908-p5f4c5cdzj 10Analysis
-
max time kernel
23s -
max time network
26s -
platform
windows10_x64 -
resource
win10 -
submitted
08-09-2020 17:07
Static task
static1
Behavioral task
behavioral1
Sample
23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
Errors
Reason
Machine shutdown
General
-
Target
23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe
-
Size
154KB
-
MD5
91879bdd73625ac38c31fe5225310e92
-
SHA1
a007b979483ee6b57b93a11340932a60f5781570
-
SHA256
23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b
-
SHA512
22678f18385ed177ed34cac52fc8667c6d6cdc2953b1818a6e530411894aa6947b04408320137af8ebd5b1d6d733f374a1d962608e0e6c234e5a43b89fe9de3c
Score
10/10
Malware Config
Extracted
Family
smokeloader
Version
2020
C2
http://dkajsdjiqwdwnfj.info/
http://2831ujedkdajsdj.info/
http://928eijdksasnfss.info/
https://dkajsdjiqwdwnfj.info/
https://2831ujedkdajsdj.info/
https://928eijdksasnfss.info/
rc4.i32
rc4.i32
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Modifies WinLogon to allow AutoLogon 2 TTPs 1 IoCs
Enables rebooting of the machine without requiring login credentials.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoLogonChecked LogonUI.exe -
Loads dropped DLL 1 IoCs
pid Process 3056 23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat svchost.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe -
Modifies data under HKEY_USERS 21 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1" LogonUI.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = 138dd51b0286d601 svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe -
Suspicious behavior: EnumeratesProcesses 282 IoCs
pid Process 3056 23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe 3056 23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3008 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3056 23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeShutdownPrivilege 3928 svchost.exe Token: SeCreatePagefilePrivilege 3928 svchost.exe Token: SeShutdownPrivilege 3008 Process not Found Token: SeCreatePagefilePrivilege 3008 Process not Found Token: SeShutdownPrivilege 3008 Process not Found Token: SeCreatePagefilePrivilege 3008 Process not Found Token: SeShutdownPrivilege 3008 Process not Found Token: SeCreatePagefilePrivilege 3008 Process not Found -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found -
Suspicious use of SendNotifyMessage 23 IoCs
pid Process 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2788 LogonUI.exe 2788 LogonUI.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe"C:\Users\Admin\AppData\Local\Temp\23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe"1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3056
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3928
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3ad2055 /state1:0x41c64e6d1⤵
- Modifies WinLogon to allow AutoLogon
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2788