Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 01:33
Static task
static1
Behavioral task
behavioral1
Sample
9f253f6abcd703cb920e2825df26b468164d15ca2d50f154a5b12fbf84c05ca5.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
9f253f6abcd703cb920e2825df26b468164d15ca2d50f154a5b12fbf84c05ca5.exe
Resource
win10v2004-20230220-en
General
-
Target
9f253f6abcd703cb920e2825df26b468164d15ca2d50f154a5b12fbf84c05ca5.exe
-
Size
274KB
-
MD5
59ab8997244079855e9af6aa577cb8c3
-
SHA1
0aecd525dddccda85aec5ea07a5648cfa8fad1e9
-
SHA256
9f253f6abcd703cb920e2825df26b468164d15ca2d50f154a5b12fbf84c05ca5
-
SHA512
66188ad1bd708fd2e11aec23b638048bd8aae63c55091805a8c445884dbe5405db4f3809c9cb0600185dd31db2842d2023f937827260d23926a6a83db11c5ee7
-
SSDEEP
3072:j3uRWX6TzugTWRYcSu6u+bZh7YzgNIs8ukBosYg3/rGpNN4TJY:iX1TSYcby38uoL/r8NN4T
Malware Config
Extracted
smokeloader
sprg
Extracted
smokeloader
2022
http://hoh0aeghwugh2gie.com/
http://hie7doodohpae4na.com/
http://aek0aicifaloh1yo.com/
http://yic0oosaeiy7ahng.com/
http://wa5zu7sekai8xeih.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
9f253f6abcd703cb920e2825df26b468164d15ca2d50f154a5b12fbf84c05ca5.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9f253f6abcd703cb920e2825df26b468164d15ca2d50f154a5b12fbf84c05ca5.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9f253f6abcd703cb920e2825df26b468164d15ca2d50f154a5b12fbf84c05ca5.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9f253f6abcd703cb920e2825df26b468164d15ca2d50f154a5b12fbf84c05ca5.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
9f253f6abcd703cb920e2825df26b468164d15ca2d50f154a5b12fbf84c05ca5.exepid process 3968 9f253f6abcd703cb920e2825df26b468164d15ca2d50f154a5b12fbf84c05ca5.exe 3968 9f253f6abcd703cb920e2825df26b468164d15ca2d50f154a5b12fbf84c05ca5.exe 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 804 -
Suspicious behavior: MapViewOfSection 19 IoCs
Processes:
9f253f6abcd703cb920e2825df26b468164d15ca2d50f154a5b12fbf84c05ca5.exepid process 3968 9f253f6abcd703cb920e2825df26b468164d15ca2d50f154a5b12fbf84c05ca5.exe 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 804 -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
description pid process target process PID 804 wrote to memory of 1320 804 explorer.exe PID 804 wrote to memory of 1320 804 explorer.exe PID 804 wrote to memory of 1320 804 explorer.exe PID 804 wrote to memory of 1320 804 explorer.exe PID 804 wrote to memory of 5096 804 explorer.exe PID 804 wrote to memory of 5096 804 explorer.exe PID 804 wrote to memory of 5096 804 explorer.exe PID 804 wrote to memory of 1692 804 explorer.exe PID 804 wrote to memory of 1692 804 explorer.exe PID 804 wrote to memory of 1692 804 explorer.exe PID 804 wrote to memory of 1692 804 explorer.exe PID 804 wrote to memory of 4288 804 explorer.exe PID 804 wrote to memory of 4288 804 explorer.exe PID 804 wrote to memory of 4288 804 explorer.exe PID 804 wrote to memory of 1888 804 explorer.exe PID 804 wrote to memory of 1888 804 explorer.exe PID 804 wrote to memory of 1888 804 explorer.exe PID 804 wrote to memory of 1888 804 explorer.exe PID 804 wrote to memory of 4664 804 explorer.exe PID 804 wrote to memory of 4664 804 explorer.exe PID 804 wrote to memory of 4664 804 explorer.exe PID 804 wrote to memory of 4664 804 explorer.exe PID 804 wrote to memory of 4048 804 explorer.exe PID 804 wrote to memory of 4048 804 explorer.exe PID 804 wrote to memory of 4048 804 explorer.exe PID 804 wrote to memory of 4048 804 explorer.exe PID 804 wrote to memory of 2804 804 explorer.exe PID 804 wrote to memory of 2804 804 explorer.exe PID 804 wrote to memory of 2804 804 explorer.exe PID 804 wrote to memory of 380 804 explorer.exe PID 804 wrote to memory of 380 804 explorer.exe PID 804 wrote to memory of 380 804 explorer.exe PID 804 wrote to memory of 380 804 explorer.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f253f6abcd703cb920e2825df26b468164d15ca2d50f154a5b12fbf84c05ca5.exe"C:\Users\Admin\AppData\Local\Temp\9f253f6abcd703cb920e2825df26b468164d15ca2d50f154a5b12fbf84c05ca5.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/380-170-0x00000000005A0000-0x00000000005AB000-memory.dmpFilesize
44KB
-
memory/380-179-0x0000000000C00000-0x0000000000C0D000-memory.dmpFilesize
52KB
-
memory/380-171-0x00000000005A0000-0x00000000005AB000-memory.dmpFilesize
44KB
-
memory/804-135-0x0000000002E40000-0x0000000002E56000-memory.dmpFilesize
88KB
-
memory/1320-146-0x0000000000880000-0x000000000088B000-memory.dmpFilesize
44KB
-
memory/1320-147-0x0000000002BC0000-0x0000000002BC9000-memory.dmpFilesize
36KB
-
memory/1320-148-0x0000000000880000-0x000000000088B000-memory.dmpFilesize
44KB
-
memory/1320-172-0x0000000002BC0000-0x0000000002BC9000-memory.dmpFilesize
36KB
-
memory/1692-152-0x0000000000880000-0x0000000000889000-memory.dmpFilesize
36KB
-
memory/1692-153-0x00000000001F0000-0x00000000001FF000-memory.dmpFilesize
60KB
-
memory/1692-154-0x0000000000880000-0x0000000000889000-memory.dmpFilesize
36KB
-
memory/1888-175-0x0000000000BD0000-0x0000000000BDC000-memory.dmpFilesize
48KB
-
memory/1888-158-0x0000000000110000-0x0000000000137000-memory.dmpFilesize
156KB
-
memory/1888-159-0x0000000000110000-0x0000000000137000-memory.dmpFilesize
156KB
-
memory/2804-178-0x0000000000F60000-0x0000000000F6B000-memory.dmpFilesize
44KB
-
memory/2804-169-0x0000000000C00000-0x0000000000C0D000-memory.dmpFilesize
52KB
-
memory/2804-168-0x0000000000F60000-0x0000000000F6B000-memory.dmpFilesize
44KB
-
memory/2804-167-0x0000000000C00000-0x0000000000C0D000-memory.dmpFilesize
52KB
-
memory/3968-134-0x0000000002BC0000-0x0000000002BC9000-memory.dmpFilesize
36KB
-
memory/3968-136-0x0000000000400000-0x0000000002B72000-memory.dmpFilesize
39.4MB
-
memory/4048-165-0x0000000000C90000-0x0000000000C99000-memory.dmpFilesize
36KB
-
memory/4048-166-0x0000000000F60000-0x0000000000F6B000-memory.dmpFilesize
44KB
-
memory/4048-164-0x0000000000F60000-0x0000000000F6B000-memory.dmpFilesize
44KB
-
memory/4048-177-0x0000000000C90000-0x0000000000C99000-memory.dmpFilesize
36KB
-
memory/4288-174-0x0000000000880000-0x0000000000889000-memory.dmpFilesize
36KB
-
memory/4288-155-0x0000000000BD0000-0x0000000000BDC000-memory.dmpFilesize
48KB
-
memory/4288-156-0x0000000000880000-0x0000000000889000-memory.dmpFilesize
36KB
-
memory/4288-157-0x0000000000BD0000-0x0000000000BDC000-memory.dmpFilesize
48KB
-
memory/4664-162-0x0000000000110000-0x0000000000137000-memory.dmpFilesize
156KB
-
memory/4664-176-0x0000000000110000-0x0000000000137000-memory.dmpFilesize
156KB
-
memory/4664-161-0x0000000000C90000-0x0000000000C99000-memory.dmpFilesize
36KB
-
memory/4664-163-0x0000000000C90000-0x0000000000C99000-memory.dmpFilesize
36KB
-
memory/5096-173-0x0000000000880000-0x000000000088B000-memory.dmpFilesize
44KB
-
memory/5096-149-0x00000000001F0000-0x00000000001FF000-memory.dmpFilesize
60KB
-
memory/5096-150-0x0000000000880000-0x000000000088B000-memory.dmpFilesize
44KB
-
memory/5096-151-0x00000000001F0000-0x00000000001FF000-memory.dmpFilesize
60KB