Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 16:16
Static task
static1
Behavioral task
behavioral1
Sample
6c0975817e255a00753d5bf3c48d67f8.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
6c0975817e255a00753d5bf3c48d67f8.exe
Resource
win10v2004-20230220-en
General
-
Target
6c0975817e255a00753d5bf3c48d67f8.exe
-
Size
296KB
-
MD5
6c0975817e255a00753d5bf3c48d67f8
-
SHA1
38c1825ea17a47b0a63a0592c395423bf20a427e
-
SHA256
4fbad19a6629f2dbbaa4bebd6066dbc1548b7ee3890226ca3d4b70e97d1dcacd
-
SHA512
2052624292424c1067bf32c935955ea8a0180159c04feb07d6da0b221dfb1a0d32739eaf0433e2f8c596cc03f8769cec5715ed5d5daa39966bfbd812f027407b
-
SSDEEP
3072:Cldy/5idB5Df4RJvLAIeMcAP4hhhhhhQ0ewt+BjsbMxA1kCtjjs0uZIGbp9XAFle:GSc5DfcvLq6sYwjs0Gbp57tDDT9
Malware Config
Extracted
smokeloader
lab
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
6c0975817e255a00753d5bf3c48d67f8.exedescription pid process target process PID 1180 set thread context of 552 1180 6c0975817e255a00753d5bf3c48d67f8.exe 6c0975817e255a00753d5bf3c48d67f8.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
6c0975817e255a00753d5bf3c48d67f8.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6c0975817e255a00753d5bf3c48d67f8.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6c0975817e255a00753d5bf3c48d67f8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6c0975817e255a00753d5bf3c48d67f8.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
6c0975817e255a00753d5bf3c48d67f8.exepid process 552 6c0975817e255a00753d5bf3c48d67f8.exe 552 6c0975817e255a00753d5bf3c48d67f8.exe 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 3144 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3144 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
6c0975817e255a00753d5bf3c48d67f8.exepid process 552 6c0975817e255a00753d5bf3c48d67f8.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
6c0975817e255a00753d5bf3c48d67f8.exedescription pid process target process PID 1180 wrote to memory of 552 1180 6c0975817e255a00753d5bf3c48d67f8.exe 6c0975817e255a00753d5bf3c48d67f8.exe PID 1180 wrote to memory of 552 1180 6c0975817e255a00753d5bf3c48d67f8.exe 6c0975817e255a00753d5bf3c48d67f8.exe PID 1180 wrote to memory of 552 1180 6c0975817e255a00753d5bf3c48d67f8.exe 6c0975817e255a00753d5bf3c48d67f8.exe PID 1180 wrote to memory of 552 1180 6c0975817e255a00753d5bf3c48d67f8.exe 6c0975817e255a00753d5bf3c48d67f8.exe PID 1180 wrote to memory of 552 1180 6c0975817e255a00753d5bf3c48d67f8.exe 6c0975817e255a00753d5bf3c48d67f8.exe PID 1180 wrote to memory of 552 1180 6c0975817e255a00753d5bf3c48d67f8.exe 6c0975817e255a00753d5bf3c48d67f8.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c0975817e255a00753d5bf3c48d67f8.exe"C:\Users\Admin\AppData\Local\Temp\6c0975817e255a00753d5bf3c48d67f8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6c0975817e255a00753d5bf3c48d67f8.exe"C:\Users\Admin\AppData\Local\Temp\6c0975817e255a00753d5bf3c48d67f8.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/552-134-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/552-136-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/552-138-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1180-135-0x0000000002D10000-0x0000000002D19000-memory.dmpFilesize
36KB
-
memory/3144-137-0x0000000000D70000-0x0000000000D86000-memory.dmpFilesize
88KB