Analysis
-
max time kernel
151s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 06:07
Static task
static1
Behavioral task
behavioral1
Sample
77739c5d6a6613fb8d477ca5a79ffd35667a8a6139c8c2bcbf0dfd8865d137be.exe
Resource
win10v2004-20230221-en
General
-
Target
77739c5d6a6613fb8d477ca5a79ffd35667a8a6139c8c2bcbf0dfd8865d137be.exe
-
Size
269KB
-
MD5
2c28e4d5c442288c06720e825064200f
-
SHA1
0b3378466febe7acffee98a17db3a6c1a3e65393
-
SHA256
77739c5d6a6613fb8d477ca5a79ffd35667a8a6139c8c2bcbf0dfd8865d137be
-
SHA512
b957c2a04a7be72c03df272a0381d9e098d6bd047f8cbbedb6fb38f9a8b906c38c14bcd5f9940ab5bc1f86d59e85c0feaeff064d39775927a4a2d333b3a8d4a9
-
SSDEEP
3072:hdPQF2YPMOjAj7LWM81cvCLmfBpq3WLFHnk1A6jHRKv//aT/lmhU:3rYvjAPLWPma3QHnp0NTf
Malware Config
Extracted
smokeloader
sprg
Extracted
smokeloader
2022
http://hoh0aeghwugh2gie.com/
http://hie7doodohpae4na.com/
http://aek0aicifaloh1yo.com/
http://yic0oosaeiy7ahng.com/
http://wa5zu7sekai8xeih.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 1 IoCs
Processes:
whfwjwupid process 2452 whfwjwu -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
77739c5d6a6613fb8d477ca5a79ffd35667a8a6139c8c2bcbf0dfd8865d137be.exewhfwjwudescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 77739c5d6a6613fb8d477ca5a79ffd35667a8a6139c8c2bcbf0dfd8865d137be.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 77739c5d6a6613fb8d477ca5a79ffd35667a8a6139c8c2bcbf0dfd8865d137be.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 77739c5d6a6613fb8d477ca5a79ffd35667a8a6139c8c2bcbf0dfd8865d137be.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI whfwjwu Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI whfwjwu Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI whfwjwu -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
77739c5d6a6613fb8d477ca5a79ffd35667a8a6139c8c2bcbf0dfd8865d137be.exepid process 4592 77739c5d6a6613fb8d477ca5a79ffd35667a8a6139c8c2bcbf0dfd8865d137be.exe 4592 77739c5d6a6613fb8d477ca5a79ffd35667a8a6139c8c2bcbf0dfd8865d137be.exe 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3172 -
Suspicious behavior: MapViewOfSection 20 IoCs
Processes:
77739c5d6a6613fb8d477ca5a79ffd35667a8a6139c8c2bcbf0dfd8865d137be.exewhfwjwupid process 4592 77739c5d6a6613fb8d477ca5a79ffd35667a8a6139c8c2bcbf0dfd8865d137be.exe 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 3172 2452 whfwjwu -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 3172 Token: SeCreatePagefilePrivilege 3172 Token: SeShutdownPrivilege 3172 Token: SeCreatePagefilePrivilege 3172 Token: SeShutdownPrivilege 3172 Token: SeCreatePagefilePrivilege 3172 Token: SeShutdownPrivilege 3172 Token: SeCreatePagefilePrivilege 3172 -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
description pid process target process PID 3172 wrote to memory of 8 3172 explorer.exe PID 3172 wrote to memory of 8 3172 explorer.exe PID 3172 wrote to memory of 8 3172 explorer.exe PID 3172 wrote to memory of 8 3172 explorer.exe PID 3172 wrote to memory of 2276 3172 explorer.exe PID 3172 wrote to memory of 2276 3172 explorer.exe PID 3172 wrote to memory of 2276 3172 explorer.exe PID 3172 wrote to memory of 1436 3172 explorer.exe PID 3172 wrote to memory of 1436 3172 explorer.exe PID 3172 wrote to memory of 1436 3172 explorer.exe PID 3172 wrote to memory of 1436 3172 explorer.exe PID 3172 wrote to memory of 3128 3172 explorer.exe PID 3172 wrote to memory of 3128 3172 explorer.exe PID 3172 wrote to memory of 3128 3172 explorer.exe PID 3172 wrote to memory of 3000 3172 explorer.exe PID 3172 wrote to memory of 3000 3172 explorer.exe PID 3172 wrote to memory of 3000 3172 explorer.exe PID 3172 wrote to memory of 3000 3172 explorer.exe PID 3172 wrote to memory of 4560 3172 explorer.exe PID 3172 wrote to memory of 4560 3172 explorer.exe PID 3172 wrote to memory of 4560 3172 explorer.exe PID 3172 wrote to memory of 4560 3172 explorer.exe PID 3172 wrote to memory of 2804 3172 explorer.exe PID 3172 wrote to memory of 2804 3172 explorer.exe PID 3172 wrote to memory of 2804 3172 explorer.exe PID 3172 wrote to memory of 2804 3172 explorer.exe PID 3172 wrote to memory of 3368 3172 explorer.exe PID 3172 wrote to memory of 3368 3172 explorer.exe PID 3172 wrote to memory of 3368 3172 explorer.exe PID 3172 wrote to memory of 3144 3172 explorer.exe PID 3172 wrote to memory of 3144 3172 explorer.exe PID 3172 wrote to memory of 3144 3172 explorer.exe PID 3172 wrote to memory of 3144 3172 explorer.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\77739c5d6a6613fb8d477ca5a79ffd35667a8a6139c8c2bcbf0dfd8865d137be.exe"C:\Users\Admin\AppData\Local\Temp\77739c5d6a6613fb8d477ca5a79ffd35667a8a6139c8c2bcbf0dfd8865d137be.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Users\Admin\AppData\Roaming\whfwjwuC:\Users\Admin\AppData\Roaming\whfwjwu1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\whfwjwuFilesize
269KB
MD52c28e4d5c442288c06720e825064200f
SHA10b3378466febe7acffee98a17db3a6c1a3e65393
SHA25677739c5d6a6613fb8d477ca5a79ffd35667a8a6139c8c2bcbf0dfd8865d137be
SHA512b957c2a04a7be72c03df272a0381d9e098d6bd047f8cbbedb6fb38f9a8b906c38c14bcd5f9940ab5bc1f86d59e85c0feaeff064d39775927a4a2d333b3a8d4a9
-
C:\Users\Admin\AppData\Roaming\whfwjwuFilesize
269KB
MD52c28e4d5c442288c06720e825064200f
SHA10b3378466febe7acffee98a17db3a6c1a3e65393
SHA25677739c5d6a6613fb8d477ca5a79ffd35667a8a6139c8c2bcbf0dfd8865d137be
SHA512b957c2a04a7be72c03df272a0381d9e098d6bd047f8cbbedb6fb38f9a8b906c38c14bcd5f9940ab5bc1f86d59e85c0feaeff064d39775927a4a2d333b3a8d4a9
-
memory/8-189-0x0000000002E10000-0x0000000002E19000-memory.dmpFilesize
36KB
-
memory/8-146-0x00000000005C0000-0x00000000005CB000-memory.dmpFilesize
44KB
-
memory/8-147-0x0000000002E10000-0x0000000002E19000-memory.dmpFilesize
36KB
-
memory/8-148-0x00000000005C0000-0x00000000005CB000-memory.dmpFilesize
44KB
-
memory/1436-153-0x0000000000EE0000-0x0000000000EEF000-memory.dmpFilesize
60KB
-
memory/1436-191-0x0000000000EE0000-0x0000000000EEF000-memory.dmpFilesize
60KB
-
memory/1436-154-0x0000000001030000-0x0000000001039000-memory.dmpFilesize
36KB
-
memory/1436-152-0x0000000001030000-0x0000000001039000-memory.dmpFilesize
36KB
-
memory/2276-150-0x00000000005C0000-0x00000000005CB000-memory.dmpFilesize
44KB
-
memory/2276-151-0x0000000000EE0000-0x0000000000EEF000-memory.dmpFilesize
60KB
-
memory/2276-190-0x00000000005C0000-0x00000000005CB000-memory.dmpFilesize
44KB
-
memory/2276-149-0x0000000000EE0000-0x0000000000EEF000-memory.dmpFilesize
60KB
-
memory/2452-219-0x0000000000400000-0x0000000002B71000-memory.dmpFilesize
39.4MB
-
memory/2804-195-0x0000000000A90000-0x0000000000A99000-memory.dmpFilesize
36KB
-
memory/2804-181-0x0000000000B20000-0x0000000000B2B000-memory.dmpFilesize
44KB
-
memory/2804-182-0x0000000000B20000-0x0000000000B2B000-memory.dmpFilesize
44KB
-
memory/3000-159-0x00000000001D0000-0x00000000001DC000-memory.dmpFilesize
48KB
-
memory/3000-160-0x0000000000B20000-0x0000000000B47000-memory.dmpFilesize
156KB
-
memory/3000-158-0x0000000000B20000-0x0000000000B47000-memory.dmpFilesize
156KB
-
memory/3000-192-0x00000000001D0000-0x00000000001DC000-memory.dmpFilesize
48KB
-
memory/3128-157-0x00000000001D0000-0x00000000001DC000-memory.dmpFilesize
48KB
-
memory/3128-156-0x0000000001030000-0x0000000001039000-memory.dmpFilesize
36KB
-
memory/3128-155-0x00000000001D0000-0x00000000001DC000-memory.dmpFilesize
48KB
-
memory/3144-188-0x00000000012C0000-0x00000000012CB000-memory.dmpFilesize
44KB
-
memory/3144-187-0x0000000000310000-0x000000000031D000-memory.dmpFilesize
52KB
-
memory/3144-186-0x00000000012C0000-0x00000000012CB000-memory.dmpFilesize
44KB
-
memory/3172-180-0x0000000000A90000-0x0000000000A99000-memory.dmpFilesize
36KB
-
memory/3172-205-0x0000000008270000-0x0000000008280000-memory.dmpFilesize
64KB
-
memory/3172-173-0x0000000008270000-0x0000000008280000-memory.dmpFilesize
64KB
-
memory/3172-174-0x0000000008270000-0x0000000008280000-memory.dmpFilesize
64KB
-
memory/3172-175-0x0000000008270000-0x0000000008280000-memory.dmpFilesize
64KB
-
memory/3172-176-0x0000000008270000-0x0000000008280000-memory.dmpFilesize
64KB
-
memory/3172-177-0x0000000008270000-0x0000000008280000-memory.dmpFilesize
64KB
-
memory/3172-178-0x0000000008280000-0x0000000008290000-memory.dmpFilesize
64KB
-
memory/3172-135-0x0000000003280000-0x0000000003296000-memory.dmpFilesize
88KB
-
memory/3172-216-0x0000000001510000-0x0000000001526000-memory.dmpFilesize
88KB
-
memory/3172-171-0x0000000008270000-0x0000000008280000-memory.dmpFilesize
64KB
-
memory/3172-170-0x0000000008270000-0x0000000008280000-memory.dmpFilesize
64KB
-
memory/3172-161-0x0000000008270000-0x0000000008280000-memory.dmpFilesize
64KB
-
memory/3172-212-0x00000000012C0000-0x00000000012CB000-memory.dmpFilesize
44KB
-
memory/3172-211-0x0000000008270000-0x0000000008280000-memory.dmpFilesize
64KB
-
memory/3172-169-0x0000000008270000-0x0000000008280000-memory.dmpFilesize
64KB
-
memory/3172-210-0x0000000008270000-0x0000000008280000-memory.dmpFilesize
64KB
-
memory/3172-167-0x0000000008270000-0x0000000008280000-memory.dmpFilesize
64KB
-
memory/3172-166-0x0000000008270000-0x0000000008280000-memory.dmpFilesize
64KB
-
memory/3172-165-0x0000000008270000-0x0000000008280000-memory.dmpFilesize
64KB
-
memory/3172-164-0x0000000008270000-0x0000000008280000-memory.dmpFilesize
64KB
-
memory/3172-163-0x0000000008270000-0x0000000008280000-memory.dmpFilesize
64KB
-
memory/3172-193-0x0000000000A90000-0x0000000000A99000-memory.dmpFilesize
36KB
-
memory/3172-194-0x0000000000A90000-0x0000000000A99000-memory.dmpFilesize
36KB
-
memory/3172-162-0x0000000008270000-0x0000000008280000-memory.dmpFilesize
64KB
-
memory/3172-196-0x0000000008270000-0x0000000008280000-memory.dmpFilesize
64KB
-
memory/3172-197-0x0000000008270000-0x0000000008280000-memory.dmpFilesize
64KB
-
memory/3172-198-0x0000000008270000-0x0000000008280000-memory.dmpFilesize
64KB
-
memory/3172-199-0x0000000008270000-0x0000000008280000-memory.dmpFilesize
64KB
-
memory/3172-200-0x0000000008270000-0x0000000008280000-memory.dmpFilesize
64KB
-
memory/3172-201-0x0000000008270000-0x0000000008280000-memory.dmpFilesize
64KB
-
memory/3172-202-0x0000000008270000-0x0000000008280000-memory.dmpFilesize
64KB
-
memory/3172-203-0x0000000008270000-0x0000000008280000-memory.dmpFilesize
64KB
-
memory/3172-204-0x0000000008270000-0x0000000008280000-memory.dmpFilesize
64KB
-
memory/3172-172-0x0000000008270000-0x0000000008280000-memory.dmpFilesize
64KB
-
memory/3172-206-0x0000000008270000-0x0000000008280000-memory.dmpFilesize
64KB
-
memory/3172-207-0x0000000008270000-0x0000000008280000-memory.dmpFilesize
64KB
-
memory/3172-208-0x0000000008270000-0x0000000008280000-memory.dmpFilesize
64KB
-
memory/3172-209-0x0000000008270000-0x0000000008280000-memory.dmpFilesize
64KB
-
memory/3368-185-0x0000000000310000-0x000000000031D000-memory.dmpFilesize
52KB
-
memory/3368-184-0x0000000000B20000-0x0000000000B2B000-memory.dmpFilesize
44KB
-
memory/3368-183-0x0000000000310000-0x000000000031D000-memory.dmpFilesize
52KB
-
memory/4560-168-0x0000000000A90000-0x0000000000A99000-memory.dmpFilesize
36KB
-
memory/4560-179-0x0000000000A90000-0x0000000000A99000-memory.dmpFilesize
36KB
-
memory/4592-136-0x0000000000400000-0x0000000002B71000-memory.dmpFilesize
39.4MB
-
memory/4592-134-0x0000000002E10000-0x0000000002E19000-memory.dmpFilesize
36KB