Resubmissions
09-01-2022 14:33
220109-rwxq5sdhcr 1009-01-2022 14:06
220109-rejg7aded7 1009-01-2022 08:20
220109-j8fz6addd9 10Analysis
-
max time kernel
1801s -
max time network
1564s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
09-01-2022 14:33
Static task
static1
Behavioral task
behavioral1
Sample
59ddabdcb5b43bbc66bbec89123d2627.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
59ddabdcb5b43bbc66bbec89123d2627.exe
Resource
win10-en-20211208
General
-
Target
59ddabdcb5b43bbc66bbec89123d2627.exe
-
Size
265KB
-
MD5
59ddabdcb5b43bbc66bbec89123d2627
-
SHA1
6c33dde51d6b45319ad99408c10f6ad8b1340e2f
-
SHA256
2d0bd38ea59864cdcd710759abea3f670449eb4505b54c8a8d22128691deefc1
-
SHA512
56463528dc37c141519535140a24d0ce02ca2227ef8c302494e422109e5d6b83a5d6ac5f2b698838e29661cd9dd986d9a2dc0f7c3c4f025f5283cebca052b8b3
Malware Config
Extracted
smokeloader
2020
http://nahbleiben.at/upload/
http://noblecreativeaz.com/upload/
http://tvqaq.cn/upload/
http://recmaster.ru/upload/
http://sovels.ru/upload/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 3 IoCs
Processes:
hwahtwfhwahtwfhwahtwfpid process 1496 hwahtwf 696 hwahtwf 2248 hwahtwf -
Deletes itself 1 IoCs
Processes:
pid process 3004 -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
59ddabdcb5b43bbc66bbec89123d2627.exehwahtwfhwahtwfhwahtwfdescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 59ddabdcb5b43bbc66bbec89123d2627.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hwahtwf Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hwahtwf Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hwahtwf Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hwahtwf Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hwahtwf Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hwahtwf Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hwahtwf Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 59ddabdcb5b43bbc66bbec89123d2627.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 59ddabdcb5b43bbc66bbec89123d2627.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hwahtwf Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hwahtwf -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
59ddabdcb5b43bbc66bbec89123d2627.exepid process 2712 59ddabdcb5b43bbc66bbec89123d2627.exe 2712 59ddabdcb5b43bbc66bbec89123d2627.exe 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3004 -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
59ddabdcb5b43bbc66bbec89123d2627.exehwahtwfhwahtwfhwahtwfpid process 2712 59ddabdcb5b43bbc66bbec89123d2627.exe 1496 hwahtwf 696 hwahtwf 2248 hwahtwf -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004
Processes
-
C:\Users\Admin\AppData\Local\Temp\59ddabdcb5b43bbc66bbec89123d2627.exe"C:\Users\Admin\AppData\Local\Temp\59ddabdcb5b43bbc66bbec89123d2627.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\hwahtwfC:\Users\Admin\AppData\Roaming\hwahtwf1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\hwahtwfC:\Users\Admin\AppData\Roaming\hwahtwf1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\hwahtwfC:\Users\Admin\AppData\Roaming\hwahtwf1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\hwahtwfMD5
59ddabdcb5b43bbc66bbec89123d2627
SHA16c33dde51d6b45319ad99408c10f6ad8b1340e2f
SHA2562d0bd38ea59864cdcd710759abea3f670449eb4505b54c8a8d22128691deefc1
SHA51256463528dc37c141519535140a24d0ce02ca2227ef8c302494e422109e5d6b83a5d6ac5f2b698838e29661cd9dd986d9a2dc0f7c3c4f025f5283cebca052b8b3
-
C:\Users\Admin\AppData\Roaming\hwahtwfMD5
59ddabdcb5b43bbc66bbec89123d2627
SHA16c33dde51d6b45319ad99408c10f6ad8b1340e2f
SHA2562d0bd38ea59864cdcd710759abea3f670449eb4505b54c8a8d22128691deefc1
SHA51256463528dc37c141519535140a24d0ce02ca2227ef8c302494e422109e5d6b83a5d6ac5f2b698838e29661cd9dd986d9a2dc0f7c3c4f025f5283cebca052b8b3
-
C:\Users\Admin\AppData\Roaming\hwahtwfMD5
59ddabdcb5b43bbc66bbec89123d2627
SHA16c33dde51d6b45319ad99408c10f6ad8b1340e2f
SHA2562d0bd38ea59864cdcd710759abea3f670449eb4505b54c8a8d22128691deefc1
SHA51256463528dc37c141519535140a24d0ce02ca2227ef8c302494e422109e5d6b83a5d6ac5f2b698838e29661cd9dd986d9a2dc0f7c3c4f025f5283cebca052b8b3
-
C:\Users\Admin\AppData\Roaming\hwahtwfMD5
59ddabdcb5b43bbc66bbec89123d2627
SHA16c33dde51d6b45319ad99408c10f6ad8b1340e2f
SHA2562d0bd38ea59864cdcd710759abea3f670449eb4505b54c8a8d22128691deefc1
SHA51256463528dc37c141519535140a24d0ce02ca2227ef8c302494e422109e5d6b83a5d6ac5f2b698838e29661cd9dd986d9a2dc0f7c3c4f025f5283cebca052b8b3
-
memory/696-124-0x0000000000400000-0x0000000002B79000-memory.dmpFilesize
39.5MB
-
memory/1496-121-0x0000000000400000-0x0000000002B79000-memory.dmpFilesize
39.5MB
-
memory/2248-127-0x0000000000400000-0x0000000002B79000-memory.dmpFilesize
39.5MB
-
memory/2712-115-0x0000000002CF0000-0x0000000002CF8000-memory.dmpFilesize
32KB
-
memory/2712-117-0x0000000000400000-0x0000000002B79000-memory.dmpFilesize
39.5MB
-
memory/2712-116-0x0000000002D00000-0x0000000002D09000-memory.dmpFilesize
36KB
-
memory/3004-122-0x00000000028C0000-0x00000000028D6000-memory.dmpFilesize
88KB
-
memory/3004-118-0x0000000000DC0000-0x0000000000DD6000-memory.dmpFilesize
88KB
-
memory/3004-125-0x00000000028F0000-0x0000000002906000-memory.dmpFilesize
88KB
-
memory/3004-128-0x0000000002950000-0x0000000002966000-memory.dmpFilesize
88KB