Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
29-03-2023 01:43
Static task
static1
Behavioral task
behavioral1
Sample
0b2760e66b0860dec87a83211ad1475ccac91ad20f1ee528f09d467b99079049.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
0b2760e66b0860dec87a83211ad1475ccac91ad20f1ee528f09d467b99079049.exe
Resource
win10v2004-20230220-en
General
-
Target
0b2760e66b0860dec87a83211ad1475ccac91ad20f1ee528f09d467b99079049.exe
-
Size
251KB
-
MD5
d114d458c6c4e36ec866be333027110a
-
SHA1
950c6e1301afaefbcf1913ef856f39de4f42335c
-
SHA256
0b2760e66b0860dec87a83211ad1475ccac91ad20f1ee528f09d467b99079049
-
SHA512
a560e73fbe618b14e03c4b4e54a716b63e374be6590925f5a860ba42bee4ce80147cee89fa45f3fcee78417951fbab05a1bff86b6bec3a40f9d1f8de194c8507
-
SSDEEP
6144:37qMKmkzLj/dohNFNeHFiGUw6oHOCTUnQWQENL:rUmkzf/SbFkl7jAHQ
Malware Config
Extracted
smokeloader
lab
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
0b2760e66b0860dec87a83211ad1475ccac91ad20f1ee528f09d467b99079049.exedescription pid process target process PID 540 set thread context of 4376 540 0b2760e66b0860dec87a83211ad1475ccac91ad20f1ee528f09d467b99079049.exe 0b2760e66b0860dec87a83211ad1475ccac91ad20f1ee528f09d467b99079049.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
0b2760e66b0860dec87a83211ad1475ccac91ad20f1ee528f09d467b99079049.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0b2760e66b0860dec87a83211ad1475ccac91ad20f1ee528f09d467b99079049.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0b2760e66b0860dec87a83211ad1475ccac91ad20f1ee528f09d467b99079049.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0b2760e66b0860dec87a83211ad1475ccac91ad20f1ee528f09d467b99079049.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
0b2760e66b0860dec87a83211ad1475ccac91ad20f1ee528f09d467b99079049.exepid process 4376 0b2760e66b0860dec87a83211ad1475ccac91ad20f1ee528f09d467b99079049.exe 4376 0b2760e66b0860dec87a83211ad1475ccac91ad20f1ee528f09d467b99079049.exe 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3152 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
0b2760e66b0860dec87a83211ad1475ccac91ad20f1ee528f09d467b99079049.exepid process 4376 0b2760e66b0860dec87a83211ad1475ccac91ad20f1ee528f09d467b99079049.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
0b2760e66b0860dec87a83211ad1475ccac91ad20f1ee528f09d467b99079049.exedescription pid process target process PID 540 wrote to memory of 4376 540 0b2760e66b0860dec87a83211ad1475ccac91ad20f1ee528f09d467b99079049.exe 0b2760e66b0860dec87a83211ad1475ccac91ad20f1ee528f09d467b99079049.exe PID 540 wrote to memory of 4376 540 0b2760e66b0860dec87a83211ad1475ccac91ad20f1ee528f09d467b99079049.exe 0b2760e66b0860dec87a83211ad1475ccac91ad20f1ee528f09d467b99079049.exe PID 540 wrote to memory of 4376 540 0b2760e66b0860dec87a83211ad1475ccac91ad20f1ee528f09d467b99079049.exe 0b2760e66b0860dec87a83211ad1475ccac91ad20f1ee528f09d467b99079049.exe PID 540 wrote to memory of 4376 540 0b2760e66b0860dec87a83211ad1475ccac91ad20f1ee528f09d467b99079049.exe 0b2760e66b0860dec87a83211ad1475ccac91ad20f1ee528f09d467b99079049.exe PID 540 wrote to memory of 4376 540 0b2760e66b0860dec87a83211ad1475ccac91ad20f1ee528f09d467b99079049.exe 0b2760e66b0860dec87a83211ad1475ccac91ad20f1ee528f09d467b99079049.exe PID 540 wrote to memory of 4376 540 0b2760e66b0860dec87a83211ad1475ccac91ad20f1ee528f09d467b99079049.exe 0b2760e66b0860dec87a83211ad1475ccac91ad20f1ee528f09d467b99079049.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b2760e66b0860dec87a83211ad1475ccac91ad20f1ee528f09d467b99079049.exe"C:\Users\Admin\AppData\Local\Temp\0b2760e66b0860dec87a83211ad1475ccac91ad20f1ee528f09d467b99079049.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0b2760e66b0860dec87a83211ad1475ccac91ad20f1ee528f09d467b99079049.exe"C:\Users\Admin\AppData\Local\Temp\0b2760e66b0860dec87a83211ad1475ccac91ad20f1ee528f09d467b99079049.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/540-138-0x0000000000840000-0x0000000000849000-memory.dmpFilesize
36KB
-
memory/3152-140-0x0000000002910000-0x0000000002926000-memory.dmpFilesize
88KB
-
memory/4376-137-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4376-139-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4376-141-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB