Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
28-03-2023 05:25
Static task
static1
Behavioral task
behavioral1
Sample
17a7ee5ed8d05595a2a73fb4ff85cbd9c2308b0faa3b6dea0bd105e92857ac92.exe
Resource
win10-20230220-en
General
-
Target
17a7ee5ed8d05595a2a73fb4ff85cbd9c2308b0faa3b6dea0bd105e92857ac92.exe
-
Size
270KB
-
MD5
e529b247bd899fa147357b27524ba9e2
-
SHA1
d73f7ebdba8ad3761f96def4475fe7e72a68f797
-
SHA256
17a7ee5ed8d05595a2a73fb4ff85cbd9c2308b0faa3b6dea0bd105e92857ac92
-
SHA512
04205c2b1f3a85f096f5a853d1677e800fcc67847a062119e2257ed0ac8ef85bf9c77feef7c1cee34377d91c9473c271b1f28583c26311aa80a62cc3ae9cf442
-
SSDEEP
3072:G6zQdKgnUO3SjgsDa48LpKuCUAV4abOgri/J40LQF3quUBlmhU:dbg33SjTDajCV4JN4tRUN
Malware Config
Extracted
smokeloader
lab
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3156 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
17a7ee5ed8d05595a2a73fb4ff85cbd9c2308b0faa3b6dea0bd105e92857ac92.exedescription pid process target process PID 2408 set thread context of 2596 2408 17a7ee5ed8d05595a2a73fb4ff85cbd9c2308b0faa3b6dea0bd105e92857ac92.exe 17a7ee5ed8d05595a2a73fb4ff85cbd9c2308b0faa3b6dea0bd105e92857ac92.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
17a7ee5ed8d05595a2a73fb4ff85cbd9c2308b0faa3b6dea0bd105e92857ac92.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 17a7ee5ed8d05595a2a73fb4ff85cbd9c2308b0faa3b6dea0bd105e92857ac92.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 17a7ee5ed8d05595a2a73fb4ff85cbd9c2308b0faa3b6dea0bd105e92857ac92.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 17a7ee5ed8d05595a2a73fb4ff85cbd9c2308b0faa3b6dea0bd105e92857ac92.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
17a7ee5ed8d05595a2a73fb4ff85cbd9c2308b0faa3b6dea0bd105e92857ac92.exepid process 2596 17a7ee5ed8d05595a2a73fb4ff85cbd9c2308b0faa3b6dea0bd105e92857ac92.exe 2596 17a7ee5ed8d05595a2a73fb4ff85cbd9c2308b0faa3b6dea0bd105e92857ac92.exe 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3156 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
17a7ee5ed8d05595a2a73fb4ff85cbd9c2308b0faa3b6dea0bd105e92857ac92.exepid process 2596 17a7ee5ed8d05595a2a73fb4ff85cbd9c2308b0faa3b6dea0bd105e92857ac92.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
17a7ee5ed8d05595a2a73fb4ff85cbd9c2308b0faa3b6dea0bd105e92857ac92.exedescription pid process target process PID 2408 wrote to memory of 2596 2408 17a7ee5ed8d05595a2a73fb4ff85cbd9c2308b0faa3b6dea0bd105e92857ac92.exe 17a7ee5ed8d05595a2a73fb4ff85cbd9c2308b0faa3b6dea0bd105e92857ac92.exe PID 2408 wrote to memory of 2596 2408 17a7ee5ed8d05595a2a73fb4ff85cbd9c2308b0faa3b6dea0bd105e92857ac92.exe 17a7ee5ed8d05595a2a73fb4ff85cbd9c2308b0faa3b6dea0bd105e92857ac92.exe PID 2408 wrote to memory of 2596 2408 17a7ee5ed8d05595a2a73fb4ff85cbd9c2308b0faa3b6dea0bd105e92857ac92.exe 17a7ee5ed8d05595a2a73fb4ff85cbd9c2308b0faa3b6dea0bd105e92857ac92.exe PID 2408 wrote to memory of 2596 2408 17a7ee5ed8d05595a2a73fb4ff85cbd9c2308b0faa3b6dea0bd105e92857ac92.exe 17a7ee5ed8d05595a2a73fb4ff85cbd9c2308b0faa3b6dea0bd105e92857ac92.exe PID 2408 wrote to memory of 2596 2408 17a7ee5ed8d05595a2a73fb4ff85cbd9c2308b0faa3b6dea0bd105e92857ac92.exe 17a7ee5ed8d05595a2a73fb4ff85cbd9c2308b0faa3b6dea0bd105e92857ac92.exe PID 2408 wrote to memory of 2596 2408 17a7ee5ed8d05595a2a73fb4ff85cbd9c2308b0faa3b6dea0bd105e92857ac92.exe 17a7ee5ed8d05595a2a73fb4ff85cbd9c2308b0faa3b6dea0bd105e92857ac92.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\17a7ee5ed8d05595a2a73fb4ff85cbd9c2308b0faa3b6dea0bd105e92857ac92.exe"C:\Users\Admin\AppData\Local\Temp\17a7ee5ed8d05595a2a73fb4ff85cbd9c2308b0faa3b6dea0bd105e92857ac92.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\17a7ee5ed8d05595a2a73fb4ff85cbd9c2308b0faa3b6dea0bd105e92857ac92.exe"C:\Users\Admin\AppData\Local\Temp\17a7ee5ed8d05595a2a73fb4ff85cbd9c2308b0faa3b6dea0bd105e92857ac92.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2408-123-0x0000000002D60000-0x0000000002D69000-memory.dmpFilesize
36KB
-
memory/2596-122-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2596-124-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2596-126-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3156-125-0x00000000005A0000-0x00000000005B6000-memory.dmpFilesize
88KB