Analysis
-
max time kernel
157s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
25-06-2022 22:05
Static task
static1
Behavioral task
behavioral1
Sample
37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe
Resource
win10v2004-20220414-en
General
-
Target
37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe
-
Size
235KB
-
MD5
190b6674a4b8403b85ed63c57223e601
-
SHA1
278552a9deb9fe4c449b459b93f7bcb64b5db793
-
SHA256
37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51
-
SHA512
991a6793a1d017aa415efaf3bfb1818707750f17bc3b6b84f74695511e4dcd72bc588af8aeb687bb9d441a5a5cc69da866bf3dee19964baf7212661b52809488
Malware Config
Extracted
smokeloader
2018
http://ghjuytr33r.net/
http://selebtiti.net/
http://justinbiberpiror.net/
http://rebnunino.net/
http://indamixtuy.net/
http://iluiloinu.net/
http://gretianopelletua.top/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe -
Drops file in System32 directory 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{256696D3-D30C-4841-A9EB-28210A89594D}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{5BF00F4A-DC42-464A-926E-2880DE65D04D}.catalogItem svchost.exe -
Checks SCSI registry key(s) 3 TTPs 2 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU svchost.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exepid process 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe -
Suspicious use of SetWindowsHookAW 64 IoCs
Processes:
37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exepid process 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe 4644 37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe"C:\Users\Admin\AppData\Local\Temp\37cec47f7e010eb81cdbacbe8ad5b9f46999f0f90f8bed4d2c440e358e224c51.exe"1⤵
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookAW
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3052-132-0x0000000002F30000-0x0000000002F45000-memory.dmpFilesize
84KB
-
memory/4644-130-0x00000000004C0000-0x00000000004C9000-memory.dmpFilesize
36KB
-
memory/4644-131-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/4644-133-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB