Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 13:06
Static task
static1
Behavioral task
behavioral1
Sample
72c048439122d689c407bbcd9d0333073707e00c273bc07955b977d69da7232e.exe
Resource
win10v2004-20230220-en
General
-
Target
72c048439122d689c407bbcd9d0333073707e00c273bc07955b977d69da7232e.exe
-
Size
294KB
-
MD5
62f713cefee729f375a973adca2d3d38
-
SHA1
a6c561e5b342c82ca428dd65785875fd22b987b0
-
SHA256
72c048439122d689c407bbcd9d0333073707e00c273bc07955b977d69da7232e
-
SHA512
353083b53de3bdc36d33ffd1ee2daad33616dcd8263f2f8e2021a2107168853b312c3e829ef167f75ef8f6418e09b789b1a86d1ba14dfc602c29e85c5b9781e1
-
SSDEEP
3072:ic8EQZM8uwwlAbIn9nfz9Ion8qPrasO7AN9ZQCOLzXSDkFx1GRElmc2toiDTBg:XkMXXAbunfVasOa7QCWXSw1IVtDDTS
Malware Config
Extracted
smokeloader
sprg
Extracted
smokeloader
2022
http://hoh0aeghwugh2gie.com/
http://hie7doodohpae4na.com/
http://aek0aicifaloh1yo.com/
http://yic0oosaeiy7ahng.com/
http://wa5zu7sekai8xeih.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
21A1.exepid process 1008 21A1.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1868 1008 WerFault.exe 21A1.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
72c048439122d689c407bbcd9d0333073707e00c273bc07955b977d69da7232e.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 72c048439122d689c407bbcd9d0333073707e00c273bc07955b977d69da7232e.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 72c048439122d689c407bbcd9d0333073707e00c273bc07955b977d69da7232e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 72c048439122d689c407bbcd9d0333073707e00c273bc07955b977d69da7232e.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
72c048439122d689c407bbcd9d0333073707e00c273bc07955b977d69da7232e.exepid process 4136 72c048439122d689c407bbcd9d0333073707e00c273bc07955b977d69da7232e.exe 4136 72c048439122d689c407bbcd9d0333073707e00c273bc07955b977d69da7232e.exe 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3160 -
Suspicious behavior: MapViewOfSection 19 IoCs
Processes:
72c048439122d689c407bbcd9d0333073707e00c273bc07955b977d69da7232e.exepid process 4136 72c048439122d689c407bbcd9d0333073707e00c273bc07955b977d69da7232e.exe 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 3160 Token: SeCreatePagefilePrivilege 3160 Token: SeShutdownPrivilege 3160 Token: SeCreatePagefilePrivilege 3160 Token: SeShutdownPrivilege 3160 Token: SeCreatePagefilePrivilege 3160 Token: SeShutdownPrivilege 3160 Token: SeCreatePagefilePrivilege 3160 Token: SeShutdownPrivilege 3160 Token: SeCreatePagefilePrivilege 3160 -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
description pid process target process PID 3160 wrote to memory of 1008 3160 21A1.exe PID 3160 wrote to memory of 1008 3160 21A1.exe PID 3160 wrote to memory of 1008 3160 21A1.exe PID 3160 wrote to memory of 4640 3160 explorer.exe PID 3160 wrote to memory of 4640 3160 explorer.exe PID 3160 wrote to memory of 4640 3160 explorer.exe PID 3160 wrote to memory of 4640 3160 explorer.exe PID 3160 wrote to memory of 2656 3160 explorer.exe PID 3160 wrote to memory of 2656 3160 explorer.exe PID 3160 wrote to memory of 2656 3160 explorer.exe PID 3160 wrote to memory of 4268 3160 explorer.exe PID 3160 wrote to memory of 4268 3160 explorer.exe PID 3160 wrote to memory of 4268 3160 explorer.exe PID 3160 wrote to memory of 4268 3160 explorer.exe PID 3160 wrote to memory of 4016 3160 explorer.exe PID 3160 wrote to memory of 4016 3160 explorer.exe PID 3160 wrote to memory of 4016 3160 explorer.exe PID 3160 wrote to memory of 3728 3160 explorer.exe PID 3160 wrote to memory of 3728 3160 explorer.exe PID 3160 wrote to memory of 3728 3160 explorer.exe PID 3160 wrote to memory of 3728 3160 explorer.exe PID 3160 wrote to memory of 1652 3160 explorer.exe PID 3160 wrote to memory of 1652 3160 explorer.exe PID 3160 wrote to memory of 1652 3160 explorer.exe PID 3160 wrote to memory of 1652 3160 explorer.exe PID 3160 wrote to memory of 4152 3160 explorer.exe PID 3160 wrote to memory of 4152 3160 explorer.exe PID 3160 wrote to memory of 4152 3160 explorer.exe PID 3160 wrote to memory of 4152 3160 explorer.exe PID 3160 wrote to memory of 4980 3160 explorer.exe PID 3160 wrote to memory of 4980 3160 explorer.exe PID 3160 wrote to memory of 4980 3160 explorer.exe PID 3160 wrote to memory of 1600 3160 explorer.exe PID 3160 wrote to memory of 1600 3160 explorer.exe PID 3160 wrote to memory of 1600 3160 explorer.exe PID 3160 wrote to memory of 1600 3160 explorer.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\72c048439122d689c407bbcd9d0333073707e00c273bc07955b977d69da7232e.exe"C:\Users\Admin\AppData\Local\Temp\72c048439122d689c407bbcd9d0333073707e00c273bc07955b977d69da7232e.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\21A1.exeC:\Users\Admin\AppData\Local\Temp\21A1.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 2842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1008 -ip 10081⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\21A1.exeFilesize
244KB
MD54638297fa590abadecce57f700cee38b
SHA159fbbb8e393fe24d2f2998b3424ac7822fab1a80
SHA256966129eb14c12490628a54d8013eccbb00215314ed14be5d5ef7f57d00928f7d
SHA51290ab739edff8fd8a191929338db777580cc2347b6231b304ccf353789d61c4d50866545b1aee33bc4e3e2f0cbf1406085873d721087741648c0fc37e8d6f6b05
-
C:\Users\Admin\AppData\Local\Temp\21A1.exeFilesize
244KB
MD54638297fa590abadecce57f700cee38b
SHA159fbbb8e393fe24d2f2998b3424ac7822fab1a80
SHA256966129eb14c12490628a54d8013eccbb00215314ed14be5d5ef7f57d00928f7d
SHA51290ab739edff8fd8a191929338db777580cc2347b6231b304ccf353789d61c4d50866545b1aee33bc4e3e2f0cbf1406085873d721087741648c0fc37e8d6f6b05
-
memory/1600-172-0x0000000000D50000-0x0000000000D5B000-memory.dmpFilesize
44KB
-
memory/1600-182-0x0000000000F20000-0x0000000000F2D000-memory.dmpFilesize
52KB
-
memory/1600-174-0x0000000000D50000-0x0000000000D5B000-memory.dmpFilesize
44KB
-
memory/1600-173-0x0000000000F20000-0x0000000000F2D000-memory.dmpFilesize
52KB
-
memory/1652-164-0x0000000000A80000-0x0000000000A89000-memory.dmpFilesize
36KB
-
memory/1652-179-0x0000000000EB0000-0x0000000000ED7000-memory.dmpFilesize
156KB
-
memory/1652-166-0x0000000000A80000-0x0000000000A89000-memory.dmpFilesize
36KB
-
memory/1652-165-0x0000000000EB0000-0x0000000000ED7000-memory.dmpFilesize
156KB
-
memory/2656-176-0x00000000002E0000-0x00000000002EB000-memory.dmpFilesize
44KB
-
memory/2656-154-0x0000000000690000-0x000000000069F000-memory.dmpFilesize
60KB
-
memory/2656-155-0x0000000000690000-0x000000000069F000-memory.dmpFilesize
60KB
-
memory/3160-135-0x0000000000B70000-0x0000000000B86000-memory.dmpFilesize
88KB
-
memory/3728-162-0x0000000000390000-0x000000000039C000-memory.dmpFilesize
48KB
-
memory/3728-161-0x0000000000EB0000-0x0000000000ED7000-memory.dmpFilesize
156KB
-
memory/3728-163-0x0000000000EB0000-0x0000000000ED7000-memory.dmpFilesize
156KB
-
memory/3728-178-0x0000000000390000-0x000000000039C000-memory.dmpFilesize
48KB
-
memory/4016-160-0x0000000000390000-0x000000000039C000-memory.dmpFilesize
48KB
-
memory/4016-177-0x0000000000B00000-0x0000000000B09000-memory.dmpFilesize
36KB
-
memory/4016-159-0x0000000000390000-0x000000000039C000-memory.dmpFilesize
48KB
-
memory/4136-136-0x0000000000400000-0x0000000002B77000-memory.dmpFilesize
39.5MB
-
memory/4136-134-0x0000000002D10000-0x0000000002D19000-memory.dmpFilesize
36KB
-
memory/4152-167-0x00000000009F0000-0x00000000009FB000-memory.dmpFilesize
44KB
-
memory/4152-180-0x0000000000A80000-0x0000000000A89000-memory.dmpFilesize
36KB
-
memory/4152-168-0x00000000009F0000-0x00000000009FB000-memory.dmpFilesize
44KB
-
memory/4268-156-0x0000000000B00000-0x0000000000B09000-memory.dmpFilesize
36KB
-
memory/4268-157-0x0000000000690000-0x000000000069F000-memory.dmpFilesize
60KB
-
memory/4268-158-0x0000000000B00000-0x0000000000B09000-memory.dmpFilesize
36KB
-
memory/4640-153-0x00000000002E0000-0x00000000002EB000-memory.dmpFilesize
44KB
-
memory/4640-175-0x0000000002D10000-0x0000000002D19000-memory.dmpFilesize
36KB
-
memory/4640-151-0x00000000002E0000-0x00000000002EB000-memory.dmpFilesize
44KB
-
memory/4640-152-0x0000000002D10000-0x0000000002D19000-memory.dmpFilesize
36KB
-
memory/4980-170-0x00000000009F0000-0x00000000009FB000-memory.dmpFilesize
44KB
-
memory/4980-171-0x0000000000F20000-0x0000000000F2D000-memory.dmpFilesize
52KB
-
memory/4980-181-0x00000000009F0000-0x00000000009FB000-memory.dmpFilesize
44KB
-
memory/4980-169-0x0000000000F20000-0x0000000000F2D000-memory.dmpFilesize
52KB