Analysis
-
max time kernel
102s -
max time network
96s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-01-2022 15:55
Static task
static1
Behavioral task
behavioral1
Sample
c10ebeb0d29119a2a7177f857318d012.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
c10ebeb0d29119a2a7177f857318d012.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
c10ebeb0d29119a2a7177f857318d012.exe
-
Size
337KB
-
MD5
c10ebeb0d29119a2a7177f857318d012
-
SHA1
687672a6b2001376c192991c1b5237cf6467f393
-
SHA256
4eb02a90be27af84c49a2f62da8e179e5117d82db4e25c7a2c80e2954583bdb3
-
SHA512
447e1010864262bc642613b1f597507689d92353930a398bd85a24e2728ea7eb6ad75c413943966a5828422b380de2eff69725c0e5468125e2d9fa35a16df292
Score
10/10
Malware Config
Extracted
Family
smokeloader
Version
2020
C2
http://linavanandr11.club/
http://iselaharty12.club/
http://giovaninardo13.club/
http://zayneliann14.club/
http://zorinosali15.club/
rc4.i32
rc4.i32
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid Process 3036 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
c10ebeb0d29119a2a7177f857318d012.exedescription pid Process procid_target PID 3536 set thread context of 3308 3536 c10ebeb0d29119a2a7177f857318d012.exe 68 -
Drops file in Windows directory 9 IoCs
Processes:
taskmgr.exeSystemSettings.exetaskmgr.exedescription ioc Process File created C:\Windows\rescache\_merged\4183903823\97717462.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\1361672858.pri taskmgr.exe File created C:\Windows\rescache\_merged\3060194815\1650753000.pri SystemSettings.exe File created C:\Windows\rescache\_merged\1742034116\1961760673.pri SystemSettings.exe File created C:\Windows\rescache\_merged\2717123927\1253081315.pri File created C:\Windows\rescache\_merged\2717123927\1253081315.pri SystemSettings.exe File created C:\Windows\rescache\_merged\2717123927\1253081315.pri taskmgr.exe File created C:\Windows\rescache\_merged\4183903823\97717462.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\1361672858.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 13 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
c10ebeb0d29119a2a7177f857318d012.exetaskmgr.exeSystemSettings.exetaskmgr.exedescription ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c10ebeb0d29119a2a7177f857318d012.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 SystemSettings.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c10ebeb0d29119a2a7177f857318d012.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID SystemSettings.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 SystemSettings.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID SystemSettings.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c10ebeb0d29119a2a7177f857318d012.exe -
Modifies registry class 1 IoCs
Processes:
description ioc Process Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\windows.immersivecontrolpanel_cw5n1h2txyewy\SplashScreen -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
c10ebeb0d29119a2a7177f857318d012.exepid Process 3308 c10ebeb0d29119a2a7177f857318d012.exe 3308 c10ebeb0d29119a2a7177f857318d012.exe 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid Process 3036 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
c10ebeb0d29119a2a7177f857318d012.exepid Process 3308 c10ebeb0d29119a2a7177f857318d012.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
taskmgr.exeSystemSettings.exedescription pid Process Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeDebugPrivilege 2648 taskmgr.exe Token: SeSystemProfilePrivilege 2648 taskmgr.exe Token: SeCreateGlobalPrivilege 2648 taskmgr.exe Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 1952 SystemSettings.exe Token: SeCreatePagefilePrivilege 1952 SystemSettings.exe Token: SeShutdownPrivilege 1952 SystemSettings.exe Token: SeCreatePagefilePrivilege 1952 SystemSettings.exe Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: 33 2648 taskmgr.exe Token: SeIncBasePriorityPrivilege 2648 taskmgr.exe Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeTakeOwnershipPrivilege 3036 Token: SeRestorePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exeSystemSettings.exetaskmgr.exepid Process 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 1952 SystemSettings.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exeSystemSettings.exetaskmgr.exepid Process 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 1952 SystemSettings.exe 1952 SystemSettings.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
SystemSettings.exepid Process 3036 1952 SystemSettings.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
c10ebeb0d29119a2a7177f857318d012.exedescription pid Process procid_target PID 3536 wrote to memory of 3308 3536 c10ebeb0d29119a2a7177f857318d012.exe 68 PID 3536 wrote to memory of 3308 3536 c10ebeb0d29119a2a7177f857318d012.exe 68 PID 3536 wrote to memory of 3308 3536 c10ebeb0d29119a2a7177f857318d012.exe 68 PID 3536 wrote to memory of 3308 3536 c10ebeb0d29119a2a7177f857318d012.exe 68 PID 3536 wrote to memory of 3308 3536 c10ebeb0d29119a2a7177f857318d012.exe 68 PID 3536 wrote to memory of 3308 3536 c10ebeb0d29119a2a7177f857318d012.exe 68 PID 3036 wrote to memory of 2648 3036 72 PID 3036 wrote to memory of 2648 3036 72 PID 3036 wrote to memory of 1136 3036 74 PID 3036 wrote to memory of 1136 3036 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\c10ebeb0d29119a2a7177f857318d012.exe"C:\Users\Admin\AppData\Local\Temp\c10ebeb0d29119a2a7177f857318d012.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\c10ebeb0d29119a2a7177f857318d012.exe"C:\Users\Admin\AppData\Local\Temp\c10ebeb0d29119a2a7177f857318d012.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3308
-
-
C:\Windows\ImmersiveControlPanel\SystemSettings.exe"C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1952
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2648
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1136
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
050f862ebe4280881ec261b7de17a5eb
SHA1f88837dcc7727abd92298f2868a4e603e36dd4ae
SHA2565a9ee4039e88417093c55cfb4c7b7aea8c5f09695a111fd1c2a78b170536afb4
SHA512b77852e2179808744c1d0234d93f6a11dc7c1b74f2f2951af6b21bce10a0fba95b643af159c64ab3168074855cd26aa30aa625a8363f69b1dd98ca49c90b14b3
-
MD5
b6001b9e5fc5c3d537375f572212762b
SHA1f03b0351d2730994e847d9afcf118395c331e400
SHA2560ee6fb6ae927f06a3f74721d0a2be1d7b2158e171e9d32b68747121054e7f910
SHA512918db362fd4f49d8720c34299dcc1f119bc7a0981f48d9939fcad29e14c58262daab23a131cd386437587bf8084a1dce43a58218dec757074e0004794db1129b