Analysis
-
max time kernel
150s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 15:38
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20230220-en
General
-
Target
file.exe
-
Size
295KB
-
MD5
cdafc8e7d71f4a536cdc3565a1b4591f
-
SHA1
c40edb3878575e883fb4536975f7a46294c0138b
-
SHA256
cbdbfd2c90310024a46e2395bf6210b5352c932fc5d27dba5ebef0b1aec21aa8
-
SHA512
aadf7c55c44dc7eba4a6824e1ebfb2fea42b9cf6a3cfb24a08ccf26f3fc1e832b2951c3d17ce1ff76717d5cd1ec1e0c46222b48530b864d787e863503910b05b
-
SSDEEP
3072:Vyd2NE86t5B/4lAHX3BCIOM+oPMEz9JtZh00O2LD16kZstdbY7dlmc2toiDTSW:MGE8u/4l83B2ExZmWckizbFtDDT9
Malware Config
Extracted
smokeloader
lab
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 2 IoCs
Processes:
divggffdivggffpid process 4856 divggff 3288 divggff -
Suspicious use of SetThreadContext 2 IoCs
Processes:
file.exedivggffdescription pid process target process PID 4680 set thread context of 4684 4680 file.exe file.exe PID 4856 set thread context of 3288 4856 divggff divggff -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
divggfffile.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI divggff Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI divggff Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI divggff -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
file.exepid process 4684 file.exe 4684 file.exe 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 3160 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3160 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
file.exedivggffpid process 4684 file.exe 3288 divggff -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 3160 Token: SeCreatePagefilePrivilege 3160 -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
file.exedivggffdescription pid process target process PID 4680 wrote to memory of 4684 4680 file.exe file.exe PID 4680 wrote to memory of 4684 4680 file.exe file.exe PID 4680 wrote to memory of 4684 4680 file.exe file.exe PID 4680 wrote to memory of 4684 4680 file.exe file.exe PID 4680 wrote to memory of 4684 4680 file.exe file.exe PID 4680 wrote to memory of 4684 4680 file.exe file.exe PID 4856 wrote to memory of 3288 4856 divggff divggff PID 4856 wrote to memory of 3288 4856 divggff divggff PID 4856 wrote to memory of 3288 4856 divggff divggff PID 4856 wrote to memory of 3288 4856 divggff divggff PID 4856 wrote to memory of 3288 4856 divggff divggff PID 4856 wrote to memory of 3288 4856 divggff divggff -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\divggffC:\Users\Admin\AppData\Roaming\divggff1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\divggffC:\Users\Admin\AppData\Roaming\divggff2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\divggffFilesize
295KB
MD5cdafc8e7d71f4a536cdc3565a1b4591f
SHA1c40edb3878575e883fb4536975f7a46294c0138b
SHA256cbdbfd2c90310024a46e2395bf6210b5352c932fc5d27dba5ebef0b1aec21aa8
SHA512aadf7c55c44dc7eba4a6824e1ebfb2fea42b9cf6a3cfb24a08ccf26f3fc1e832b2951c3d17ce1ff76717d5cd1ec1e0c46222b48530b864d787e863503910b05b
-
C:\Users\Admin\AppData\Roaming\divggffFilesize
295KB
MD5cdafc8e7d71f4a536cdc3565a1b4591f
SHA1c40edb3878575e883fb4536975f7a46294c0138b
SHA256cbdbfd2c90310024a46e2395bf6210b5352c932fc5d27dba5ebef0b1aec21aa8
SHA512aadf7c55c44dc7eba4a6824e1ebfb2fea42b9cf6a3cfb24a08ccf26f3fc1e832b2951c3d17ce1ff76717d5cd1ec1e0c46222b48530b864d787e863503910b05b
-
C:\Users\Admin\AppData\Roaming\divggffFilesize
295KB
MD5cdafc8e7d71f4a536cdc3565a1b4591f
SHA1c40edb3878575e883fb4536975f7a46294c0138b
SHA256cbdbfd2c90310024a46e2395bf6210b5352c932fc5d27dba5ebef0b1aec21aa8
SHA512aadf7c55c44dc7eba4a6824e1ebfb2fea42b9cf6a3cfb24a08ccf26f3fc1e832b2951c3d17ce1ff76717d5cd1ec1e0c46222b48530b864d787e863503910b05b
-
memory/3160-137-0x0000000000E50000-0x0000000000E66000-memory.dmpFilesize
88KB
-
memory/3160-151-0x0000000000DD0000-0x0000000000DE6000-memory.dmpFilesize
88KB
-
memory/3288-150-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3288-152-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4680-135-0x00000000048B0000-0x00000000048B9000-memory.dmpFilesize
36KB
-
memory/4684-134-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4684-136-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4684-138-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB