Analysis
-
max time kernel
150s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
27-03-2023 21:38
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20230221-en
General
-
Target
file.exe
-
Size
264KB
-
MD5
603e1c4b337563620dd3b0873efd2242
-
SHA1
f334f318213431b357aa7fab4a869f0d300ac079
-
SHA256
0efe59a8f13a80ac3ee5c71b2282972bd42d9e609afbff88d9bf8b9092743bd7
-
SHA512
e2791bd7c7476ecdad9d123274abf55bae7b88fb099fc7b6f438f6abfca415ed77719d908b748341034be7f74da789943e6906513ae96493d460301cb4099d4d
-
SSDEEP
3072:E3zCCRHyE0rYUXLHYLZ3zG9G6xHtPnBvsM+xUDzFQz1LlL5kYYCU3wsUf:EDz5yERUXL4Yzf2VkZ2oY
Malware Config
Extracted
smokeloader
lab
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
file.exedescription pid process target process PID 1712 set thread context of 2028 1712 file.exe file.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
file.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
file.exepid process 2028 file.exe 2028 file.exe 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1228 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
file.exepid process 2028 file.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
file.exedescription pid process target process PID 1712 wrote to memory of 2028 1712 file.exe file.exe PID 1712 wrote to memory of 2028 1712 file.exe file.exe PID 1712 wrote to memory of 2028 1712 file.exe file.exe PID 1712 wrote to memory of 2028 1712 file.exe file.exe PID 1712 wrote to memory of 2028 1712 file.exe file.exe PID 1712 wrote to memory of 2028 1712 file.exe file.exe PID 1712 wrote to memory of 2028 1712 file.exe file.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1228-59-0x0000000002140000-0x0000000002156000-memory.dmpFilesize
88KB
-
memory/1712-57-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/2028-55-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2028-56-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2028-58-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2028-60-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB