Analysis
-
max time kernel
150s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 17:28
Static task
static1
Behavioral task
behavioral1
Sample
1173d7bd9c7ef2e080400b5636e07f7195d08b5d5ea06dd686ed3a99951c82a3.exe
Resource
win10v2004-20230220-en
General
-
Target
1173d7bd9c7ef2e080400b5636e07f7195d08b5d5ea06dd686ed3a99951c82a3.exe
-
Size
297KB
-
MD5
7b1f8e9efd3695e7d7b9426863c210fd
-
SHA1
2138360299267ef49d092ef5573661ab3fe91225
-
SHA256
1173d7bd9c7ef2e080400b5636e07f7195d08b5d5ea06dd686ed3a99951c82a3
-
SHA512
30e00a4e7348a5f1edd5dac249dfa05b7313a6a0a84b054e0b4d54f3ecb134abed3726069cf917a868c4f5ee0210c8dc52da096999807bfc3afc5e744099ca8b
-
SSDEEP
3072:JbQ1zKwmBRTyzgJ4E6euMl1T11oq3aJDW6oUR1Q/bv7B8TUUTuBWvQfu:RoqBRTn4EBu2h6oEm/bjB84Pb
Malware Config
Extracted
smokeloader
sprg
Extracted
smokeloader
2022
http://hoh0aeghwugh2gie.com/
http://hie7doodohpae4na.com/
http://aek0aicifaloh1yo.com/
http://yic0oosaeiy7ahng.com/
http://wa5zu7sekai8xeih.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 1 IoCs
Processes:
hctucftpid process 2628 hctucft -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
hctucft1173d7bd9c7ef2e080400b5636e07f7195d08b5d5ea06dd686ed3a99951c82a3.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hctucft Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hctucft Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hctucft Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1173d7bd9c7ef2e080400b5636e07f7195d08b5d5ea06dd686ed3a99951c82a3.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1173d7bd9c7ef2e080400b5636e07f7195d08b5d5ea06dd686ed3a99951c82a3.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1173d7bd9c7ef2e080400b5636e07f7195d08b5d5ea06dd686ed3a99951c82a3.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
1173d7bd9c7ef2e080400b5636e07f7195d08b5d5ea06dd686ed3a99951c82a3.exepid process 4360 1173d7bd9c7ef2e080400b5636e07f7195d08b5d5ea06dd686ed3a99951c82a3.exe 4360 1173d7bd9c7ef2e080400b5636e07f7195d08b5d5ea06dd686ed3a99951c82a3.exe 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3128 -
Suspicious behavior: MapViewOfSection 20 IoCs
Processes:
1173d7bd9c7ef2e080400b5636e07f7195d08b5d5ea06dd686ed3a99951c82a3.exehctucftpid process 4360 1173d7bd9c7ef2e080400b5636e07f7195d08b5d5ea06dd686ed3a99951c82a3.exe 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 2628 hctucft -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
description pid process target process PID 3128 wrote to memory of 2404 3128 explorer.exe PID 3128 wrote to memory of 2404 3128 explorer.exe PID 3128 wrote to memory of 2404 3128 explorer.exe PID 3128 wrote to memory of 2404 3128 explorer.exe PID 3128 wrote to memory of 1092 3128 explorer.exe PID 3128 wrote to memory of 1092 3128 explorer.exe PID 3128 wrote to memory of 1092 3128 explorer.exe PID 3128 wrote to memory of 448 3128 explorer.exe PID 3128 wrote to memory of 448 3128 explorer.exe PID 3128 wrote to memory of 448 3128 explorer.exe PID 3128 wrote to memory of 448 3128 explorer.exe PID 3128 wrote to memory of 2444 3128 explorer.exe PID 3128 wrote to memory of 2444 3128 explorer.exe PID 3128 wrote to memory of 2444 3128 explorer.exe PID 3128 wrote to memory of 852 3128 explorer.exe PID 3128 wrote to memory of 852 3128 explorer.exe PID 3128 wrote to memory of 852 3128 explorer.exe PID 3128 wrote to memory of 852 3128 explorer.exe PID 3128 wrote to memory of 3016 3128 explorer.exe PID 3128 wrote to memory of 3016 3128 explorer.exe PID 3128 wrote to memory of 3016 3128 explorer.exe PID 3128 wrote to memory of 3016 3128 explorer.exe PID 3128 wrote to memory of 3632 3128 explorer.exe PID 3128 wrote to memory of 3632 3128 explorer.exe PID 3128 wrote to memory of 3632 3128 explorer.exe PID 3128 wrote to memory of 3632 3128 explorer.exe PID 3128 wrote to memory of 2488 3128 explorer.exe PID 3128 wrote to memory of 2488 3128 explorer.exe PID 3128 wrote to memory of 2488 3128 explorer.exe PID 3128 wrote to memory of 3784 3128 explorer.exe PID 3128 wrote to memory of 3784 3128 explorer.exe PID 3128 wrote to memory of 3784 3128 explorer.exe PID 3128 wrote to memory of 3784 3128 explorer.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1173d7bd9c7ef2e080400b5636e07f7195d08b5d5ea06dd686ed3a99951c82a3.exe"C:\Users\Admin\AppData\Local\Temp\1173d7bd9c7ef2e080400b5636e07f7195d08b5d5ea06dd686ed3a99951c82a3.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Users\Admin\AppData\Roaming\hctucftC:\Users\Admin\AppData\Roaming\hctucft1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\hctucftFilesize
297KB
MD57b1f8e9efd3695e7d7b9426863c210fd
SHA12138360299267ef49d092ef5573661ab3fe91225
SHA2561173d7bd9c7ef2e080400b5636e07f7195d08b5d5ea06dd686ed3a99951c82a3
SHA51230e00a4e7348a5f1edd5dac249dfa05b7313a6a0a84b054e0b4d54f3ecb134abed3726069cf917a868c4f5ee0210c8dc52da096999807bfc3afc5e744099ca8b
-
C:\Users\Admin\AppData\Roaming\hctucftFilesize
297KB
MD57b1f8e9efd3695e7d7b9426863c210fd
SHA12138360299267ef49d092ef5573661ab3fe91225
SHA2561173d7bd9c7ef2e080400b5636e07f7195d08b5d5ea06dd686ed3a99951c82a3
SHA51230e00a4e7348a5f1edd5dac249dfa05b7313a6a0a84b054e0b4d54f3ecb134abed3726069cf917a868c4f5ee0210c8dc52da096999807bfc3afc5e744099ca8b
-
memory/448-153-0x00000000007D0000-0x00000000007D5000-memory.dmpFilesize
20KB
-
memory/448-174-0x00000000007D0000-0x00000000007D5000-memory.dmpFilesize
20KB
-
memory/448-154-0x00000000007C0000-0x00000000007C9000-memory.dmpFilesize
36KB
-
memory/448-152-0x00000000007C0000-0x00000000007C9000-memory.dmpFilesize
36KB
-
memory/852-176-0x0000000001080000-0x00000000010A2000-memory.dmpFilesize
136KB
-
memory/852-160-0x0000000001050000-0x0000000001077000-memory.dmpFilesize
156KB
-
memory/852-159-0x0000000001080000-0x00000000010A2000-memory.dmpFilesize
136KB
-
memory/852-158-0x0000000001050000-0x0000000001077000-memory.dmpFilesize
156KB
-
memory/1092-173-0x0000000000330000-0x0000000000339000-memory.dmpFilesize
36KB
-
memory/1092-151-0x0000000000320000-0x000000000032F000-memory.dmpFilesize
60KB
-
memory/1092-150-0x0000000000330000-0x0000000000339000-memory.dmpFilesize
36KB
-
memory/1092-149-0x0000000000320000-0x000000000032F000-memory.dmpFilesize
60KB
-
memory/2404-148-0x0000000001210000-0x000000000121B000-memory.dmpFilesize
44KB
-
memory/2404-146-0x0000000001210000-0x000000000121B000-memory.dmpFilesize
44KB
-
memory/2404-147-0x0000000001220000-0x0000000001227000-memory.dmpFilesize
28KB
-
memory/2404-172-0x0000000001220000-0x0000000001227000-memory.dmpFilesize
28KB
-
memory/2444-155-0x0000000000520000-0x000000000052C000-memory.dmpFilesize
48KB
-
memory/2444-157-0x0000000000520000-0x000000000052C000-memory.dmpFilesize
48KB
-
memory/2444-156-0x0000000000530000-0x0000000000536000-memory.dmpFilesize
24KB
-
memory/2444-175-0x0000000000530000-0x0000000000536000-memory.dmpFilesize
24KB
-
memory/2488-168-0x0000000000EC0000-0x0000000000ECD000-memory.dmpFilesize
52KB
-
memory/2488-167-0x0000000000ED0000-0x0000000000ED7000-memory.dmpFilesize
28KB
-
memory/2488-179-0x0000000000ED0000-0x0000000000ED7000-memory.dmpFilesize
28KB
-
memory/2488-166-0x0000000000EC0000-0x0000000000ECD000-memory.dmpFilesize
52KB
-
memory/2628-185-0x0000000000400000-0x0000000002B77000-memory.dmpFilesize
39.5MB
-
memory/3016-162-0x0000000000D80000-0x0000000000D89000-memory.dmpFilesize
36KB
-
memory/3016-177-0x0000000000D90000-0x0000000000D95000-memory.dmpFilesize
20KB
-
memory/3016-161-0x0000000000D80000-0x0000000000D89000-memory.dmpFilesize
36KB
-
memory/3128-184-0x0000000003110000-0x0000000003126000-memory.dmpFilesize
88KB
-
memory/3128-135-0x0000000003180000-0x0000000003196000-memory.dmpFilesize
88KB
-
memory/3632-178-0x0000000001110000-0x0000000001116000-memory.dmpFilesize
24KB
-
memory/3632-163-0x0000000001100000-0x000000000110B000-memory.dmpFilesize
44KB
-
memory/3632-164-0x0000000001110000-0x0000000001116000-memory.dmpFilesize
24KB
-
memory/3632-165-0x0000000001100000-0x000000000110B000-memory.dmpFilesize
44KB
-
memory/3784-171-0x0000000000D80000-0x0000000000D8B000-memory.dmpFilesize
44KB
-
memory/3784-180-0x0000000000D90000-0x0000000000D98000-memory.dmpFilesize
32KB
-
memory/3784-170-0x0000000000D90000-0x0000000000D98000-memory.dmpFilesize
32KB
-
memory/3784-169-0x0000000000D80000-0x0000000000D8B000-memory.dmpFilesize
44KB
-
memory/4360-134-0x0000000002D30000-0x0000000002D39000-memory.dmpFilesize
36KB
-
memory/4360-136-0x0000000000400000-0x0000000002B77000-memory.dmpFilesize
39.5MB