Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
20-03-2023 12:39
Static task
static1
Behavioral task
behavioral1
Sample
400f588f2e07946fb70f43a51bc838b90cb01ebe61074199289a343a2a6f9c96.exe
Resource
win10v2004-20230220-en
General
-
Target
400f588f2e07946fb70f43a51bc838b90cb01ebe61074199289a343a2a6f9c96.exe
-
Size
178KB
-
MD5
d2b0521f656b6808ef648e63f53e16e9
-
SHA1
26cd29952ec302b4ee7f1e4c85dd66b1b0144d73
-
SHA256
400f588f2e07946fb70f43a51bc838b90cb01ebe61074199289a343a2a6f9c96
-
SHA512
82a5209e8c65301ed9e922b71bc49ca0a2653c781da391af6243966ee7572c301f25a41e7fb8f0b513b9a25899d0ca0a898f9a6e9204da016a6b9ee4c333aedb
-
SSDEEP
3072:rlDHoyGiMXPsLoXeq5p07hdlRR4jcPGdh+:FIydta5p0XR4jEG
Malware Config
Extracted
smokeloader
lab
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 2 IoCs
Processes:
utrwihsutrwihspid process 1748 utrwihs 448 utrwihs -
Suspicious use of SetThreadContext 2 IoCs
Processes:
400f588f2e07946fb70f43a51bc838b90cb01ebe61074199289a343a2a6f9c96.exeutrwihsdescription pid process target process PID 2180 set thread context of 2980 2180 400f588f2e07946fb70f43a51bc838b90cb01ebe61074199289a343a2a6f9c96.exe 400f588f2e07946fb70f43a51bc838b90cb01ebe61074199289a343a2a6f9c96.exe PID 1748 set thread context of 448 1748 utrwihs utrwihs -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
400f588f2e07946fb70f43a51bc838b90cb01ebe61074199289a343a2a6f9c96.exeutrwihsdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 400f588f2e07946fb70f43a51bc838b90cb01ebe61074199289a343a2a6f9c96.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 400f588f2e07946fb70f43a51bc838b90cb01ebe61074199289a343a2a6f9c96.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 400f588f2e07946fb70f43a51bc838b90cb01ebe61074199289a343a2a6f9c96.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI utrwihs Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI utrwihs Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI utrwihs -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
400f588f2e07946fb70f43a51bc838b90cb01ebe61074199289a343a2a6f9c96.exepid process 2980 400f588f2e07946fb70f43a51bc838b90cb01ebe61074199289a343a2a6f9c96.exe 2980 400f588f2e07946fb70f43a51bc838b90cb01ebe61074199289a343a2a6f9c96.exe 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3156 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
400f588f2e07946fb70f43a51bc838b90cb01ebe61074199289a343a2a6f9c96.exeutrwihspid process 2980 400f588f2e07946fb70f43a51bc838b90cb01ebe61074199289a343a2a6f9c96.exe 448 utrwihs -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 3156 Token: SeCreatePagefilePrivilege 3156 -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
400f588f2e07946fb70f43a51bc838b90cb01ebe61074199289a343a2a6f9c96.exeutrwihsdescription pid process target process PID 2180 wrote to memory of 2980 2180 400f588f2e07946fb70f43a51bc838b90cb01ebe61074199289a343a2a6f9c96.exe 400f588f2e07946fb70f43a51bc838b90cb01ebe61074199289a343a2a6f9c96.exe PID 2180 wrote to memory of 2980 2180 400f588f2e07946fb70f43a51bc838b90cb01ebe61074199289a343a2a6f9c96.exe 400f588f2e07946fb70f43a51bc838b90cb01ebe61074199289a343a2a6f9c96.exe PID 2180 wrote to memory of 2980 2180 400f588f2e07946fb70f43a51bc838b90cb01ebe61074199289a343a2a6f9c96.exe 400f588f2e07946fb70f43a51bc838b90cb01ebe61074199289a343a2a6f9c96.exe PID 2180 wrote to memory of 2980 2180 400f588f2e07946fb70f43a51bc838b90cb01ebe61074199289a343a2a6f9c96.exe 400f588f2e07946fb70f43a51bc838b90cb01ebe61074199289a343a2a6f9c96.exe PID 2180 wrote to memory of 2980 2180 400f588f2e07946fb70f43a51bc838b90cb01ebe61074199289a343a2a6f9c96.exe 400f588f2e07946fb70f43a51bc838b90cb01ebe61074199289a343a2a6f9c96.exe PID 2180 wrote to memory of 2980 2180 400f588f2e07946fb70f43a51bc838b90cb01ebe61074199289a343a2a6f9c96.exe 400f588f2e07946fb70f43a51bc838b90cb01ebe61074199289a343a2a6f9c96.exe PID 1748 wrote to memory of 448 1748 utrwihs utrwihs PID 1748 wrote to memory of 448 1748 utrwihs utrwihs PID 1748 wrote to memory of 448 1748 utrwihs utrwihs PID 1748 wrote to memory of 448 1748 utrwihs utrwihs PID 1748 wrote to memory of 448 1748 utrwihs utrwihs PID 1748 wrote to memory of 448 1748 utrwihs utrwihs -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\400f588f2e07946fb70f43a51bc838b90cb01ebe61074199289a343a2a6f9c96.exe"C:\Users\Admin\AppData\Local\Temp\400f588f2e07946fb70f43a51bc838b90cb01ebe61074199289a343a2a6f9c96.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\400f588f2e07946fb70f43a51bc838b90cb01ebe61074199289a343a2a6f9c96.exe"C:\Users\Admin\AppData\Local\Temp\400f588f2e07946fb70f43a51bc838b90cb01ebe61074199289a343a2a6f9c96.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\utrwihsC:\Users\Admin\AppData\Roaming\utrwihs1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\utrwihsC:\Users\Admin\AppData\Roaming\utrwihs2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\utrwihsFilesize
178KB
MD5d2b0521f656b6808ef648e63f53e16e9
SHA126cd29952ec302b4ee7f1e4c85dd66b1b0144d73
SHA256400f588f2e07946fb70f43a51bc838b90cb01ebe61074199289a343a2a6f9c96
SHA51282a5209e8c65301ed9e922b71bc49ca0a2653c781da391af6243966ee7572c301f25a41e7fb8f0b513b9a25899d0ca0a898f9a6e9204da016a6b9ee4c333aedb
-
C:\Users\Admin\AppData\Roaming\utrwihsFilesize
178KB
MD5d2b0521f656b6808ef648e63f53e16e9
SHA126cd29952ec302b4ee7f1e4c85dd66b1b0144d73
SHA256400f588f2e07946fb70f43a51bc838b90cb01ebe61074199289a343a2a6f9c96
SHA51282a5209e8c65301ed9e922b71bc49ca0a2653c781da391af6243966ee7572c301f25a41e7fb8f0b513b9a25899d0ca0a898f9a6e9204da016a6b9ee4c333aedb
-
C:\Users\Admin\AppData\Roaming\utrwihsFilesize
178KB
MD5d2b0521f656b6808ef648e63f53e16e9
SHA126cd29952ec302b4ee7f1e4c85dd66b1b0144d73
SHA256400f588f2e07946fb70f43a51bc838b90cb01ebe61074199289a343a2a6f9c96
SHA51282a5209e8c65301ed9e922b71bc49ca0a2653c781da391af6243966ee7572c301f25a41e7fb8f0b513b9a25899d0ca0a898f9a6e9204da016a6b9ee4c333aedb
-
memory/448-150-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/448-154-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2180-135-0x0000000000530000-0x0000000000539000-memory.dmpFilesize
36KB
-
memory/2980-134-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2980-136-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2980-138-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3156-137-0x0000000002E30000-0x0000000002E46000-memory.dmpFilesize
88KB
-
memory/3156-151-0x0000000002E70000-0x0000000002E86000-memory.dmpFilesize
88KB