Analysis
- max time kernel
102s - max time network
96s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
24/01/2022, 15:55
Static task
static1
Behavioral task
behavioral1
Sample
c10ebeb0d29119a2a7177f857318d012.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
c10ebeb0d29119a2a7177f857318d012.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
- Target c10ebeb0d29119a2a7177f857318d012.exe
- Size 337KB
- Sample220124-tcsn7afch2
- SHA256 4eb02a90be27af84c49a2f62da8e179e5117d82db4e25c7a2c80e2954583bdb3
- MD5 c10ebeb0d29119a2a7177f857318d012
- SHA1 687672a6b2001376c192991c1b5237cf6467f393
- SHA512 447e1010864262bc642613b1f597507689d92353930a398bd85a24e2728ea7eb6ad75c413943966a5828422b380de2eff69725c0e5468125e2d9fa35a16df292
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://linavanandr11.club/
-
http://iselaharty12.club/
-
http://giovaninardo13.club/
-
http://zayneliann14.club/
-
http://zorinosali15.club/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Deletes itself 1 IoCs
pid Process 3036 Process not Found - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3536 set thread context of 3308 3536 c10ebeb0d29119a2a7177f857318d012.exe 68 - Drops file in Windows directory 9 IoCs
description ioc Process File created C:\Windows\rescache\_merged\4183903823\97717462.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\1361672858.pri taskmgr.exe File created C:\Windows\rescache\_merged\3060194815\1650753000.pri SystemSettings.exe File created C:\Windows\rescache\_merged\1742034116\1961760673.pri SystemSettings.exe File created C:\Windows\rescache\_merged\2717123927\1253081315.pri Process not Found File created C:\Windows\rescache\_merged\2717123927\1253081315.pri SystemSettings.exe File created C:\Windows\rescache\_merged\2717123927\1253081315.pri taskmgr.exe File created C:\Windows\rescache\_merged\4183903823\97717462.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\1361672858.pri taskmgr.exe - Checks SCSI registry key(s) 3 TTPs 13 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c10ebeb0d29119a2a7177f857318d012.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 SystemSettings.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c10ebeb0d29119a2a7177f857318d012.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID SystemSettings.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 SystemSettings.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID SystemSettings.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c10ebeb0d29119a2a7177f857318d012.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\windows.immersivecontrolpanel_cw5n1h2txyewy\SplashScreen Process not Found - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3308 c10ebeb0d29119a2a7177f857318d012.exe 3308 c10ebeb0d29119a2a7177f857318d012.exe 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found 3036 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3036 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3308 c10ebeb0d29119a2a7177f857318d012.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3036 Process not Found Token: SeCreatePagefilePrivilege 3036 Process not Found Token: SeShutdownPrivilege 3036 Process not Found Token: SeCreatePagefilePrivilege 3036 Process not Found Token: SeDebugPrivilege 2648 taskmgr.exe Token: SeSystemProfilePrivilege 2648 taskmgr.exe Token: SeCreateGlobalPrivilege 2648 taskmgr.exe Token: SeShutdownPrivilege 3036 Process not Found Token: SeCreatePagefilePrivilege 3036 Process not Found Token: SeShutdownPrivilege 3036 Process not Found Token: SeCreatePagefilePrivilege 3036 Process not Found Token: SeShutdownPrivilege 1952 SystemSettings.exe Token: SeCreatePagefilePrivilege 1952 SystemSettings.exe Token: SeShutdownPrivilege 1952 SystemSettings.exe Token: SeCreatePagefilePrivilege 1952 SystemSettings.exe Token: SeShutdownPrivilege 3036 Process not Found Token: SeCreatePagefilePrivilege 3036 Process not Found Token: SeShutdownPrivilege 3036 Process not Found Token: SeCreatePagefilePrivilege 3036 Process not Found Token: SeShutdownPrivilege 3036 Process not Found Token: SeCreatePagefilePrivilege 3036 Process not Found Token: SeShutdownPrivilege 3036 Process not Found Token: SeCreatePagefilePrivilege 3036 Process not Found Token: SeShutdownPrivilege 3036 Process not Found Token: SeCreatePagefilePrivilege 3036 Process not Found Token: 33 2648 taskmgr.exe Token: SeIncBasePriorityPrivilege 2648 taskmgr.exe Token: SeShutdownPrivilege 3036 Process not Found Token: SeCreatePagefilePrivilege 3036 Process not Found Token: SeShutdownPrivilege 3036 Process not Found Token: SeCreatePagefilePrivilege 3036 Process not Found Token: SeShutdownPrivilege 3036 Process not Found Token: SeCreatePagefilePrivilege 3036 Process not Found Token: SeShutdownPrivilege 3036 Process not Found Token: SeCreatePagefilePrivilege 3036 Process not Found Token: SeShutdownPrivilege 3036 Process not Found Token: SeCreatePagefilePrivilege 3036 Process not Found Token: SeShutdownPrivilege 3036 Process not Found Token: SeCreatePagefilePrivilege 3036 Process not Found Token: SeTakeOwnershipPrivilege 3036 Process not Found Token: SeRestorePrivilege 3036 Process not Found Token: SeShutdownPrivilege 3036 Process not Found Token: SeCreatePagefilePrivilege 3036 Process not Found Token: SeShutdownPrivilege 3036 Process not Found Token: SeCreatePagefilePrivilege 3036 Process not Found Token: SeShutdownPrivilege 3036 Process not Found Token: SeCreatePagefilePrivilege 3036 Process not Found Token: SeShutdownPrivilege 3036 Process not Found Token: SeCreatePagefilePrivilege 3036 Process not Found Token: SeShutdownPrivilege 3036 Process not Found Token: SeCreatePagefilePrivilege 3036 Process not Found Token: SeShutdownPrivilege 3036 Process not Found Token: SeCreatePagefilePrivilege 3036 Process not Found Token: SeShutdownPrivilege 3036 Process not Found Token: SeCreatePagefilePrivilege 3036 Process not Found Token: SeShutdownPrivilege 3036 Process not Found Token: SeCreatePagefilePrivilege 3036 Process not Found Token: SeShutdownPrivilege 3036 Process not Found Token: SeCreatePagefilePrivilege 3036 Process not Found Token: SeShutdownPrivilege 3036 Process not Found Token: SeCreatePagefilePrivilege 3036 Process not Found Token: SeShutdownPrivilege 3036 Process not Found Token: SeCreatePagefilePrivilege 3036 Process not Found Token: SeShutdownPrivilege 3036 Process not Found - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 1952 SystemSettings.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 1952 SystemSettings.exe 1952 SystemSettings.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 2648 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3036 Process not Found 1952 SystemSettings.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3536 wrote to memory of 3308 3536 c10ebeb0d29119a2a7177f857318d012.exe 68 PID 3536 wrote to memory of 3308 3536 c10ebeb0d29119a2a7177f857318d012.exe 68 PID 3536 wrote to memory of 3308 3536 c10ebeb0d29119a2a7177f857318d012.exe 68 PID 3536 wrote to memory of 3308 3536 c10ebeb0d29119a2a7177f857318d012.exe 68 PID 3536 wrote to memory of 3308 3536 c10ebeb0d29119a2a7177f857318d012.exe 68 PID 3536 wrote to memory of 3308 3536 c10ebeb0d29119a2a7177f857318d012.exe 68 PID 3036 wrote to memory of 2648 3036 Process not Found 72 PID 3036 wrote to memory of 2648 3036 Process not Found 72 PID 3036 wrote to memory of 1136 3036 Process not Found 74 PID 3036 wrote to memory of 1136 3036 Process not Found 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\c10ebeb0d29119a2a7177f857318d012.exe"C:\Users\Admin\AppData\Local\Temp\c10ebeb0d29119a2a7177f857318d012.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\c10ebeb0d29119a2a7177f857318d012.exe"C:\Users\Admin\AppData\Local\Temp\c10ebeb0d29119a2a7177f857318d012.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3308
-
-
C:\Windows\ImmersiveControlPanel\SystemSettings.exe"C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1952
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2648
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1136