Analysis
- max time kernel
150s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
30/03/2023, 07:31
General
- Target 22f50ef32d23e0f441da489071ca1ecb.exe
- Size 597KB
- Sample230330-jcegfsbe39
- SHA256 50ae1cc086fc3faeeb453c5923097b9328b63bbe19ed9f9c226bbb1b49a1917d
Malware Config
Extracted
-
smokeloader
-
swo
Extracted
-
smokeloader
-
2020
-
http://akmedia.in/js/k/index.php
-
http://bethesdaserukam.org/setting/k/index.php
-
http://stemschools.in/js/k/index.php
-
http://dejarestaurant.com/wp-admin/js/k/index.php
-
http://moabscript.ir/wp-admin/js/k/index.php
-
http://nicehybridseeds.com/image/catalog/k/index.php
-
http://imaker.io/picktail/js/k/index.php
-
http://nanavatisworld.com/assets/js/k/index.php
-
http://smartbubox.com/img/k/index.php
-
http://krigenpharmaceuticals.com/js/k/index.php
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\22f50ef32d23e0f441da489071ca1ecb.exe"C:\Users\Admin\AppData\Local\Temp\22f50ef32d23e0f441da489071ca1ecb.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\22f50ef32d23e0f441da489071ca1ecb.exe"{path}"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 8762⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4704 -ip 47041⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1696-134-0x0000000005510000-0x00000000055AC000-memory.dmp
memory/1696-135-0x0000000005B60000-0x0000000006104000-memory.dmp
memory/1696-136-0x0000000005650000-0x00000000056E2000-memory.dmp
memory/1696-138-0x00000000056F0000-0x0000000005746000-memory.dmp
memory/1696-137-0x00000000054F0000-0x00000000054FA000-memory.dmp
memory/1696-139-0x0000000005850000-0x0000000005860000-memory.dmp
memory/1696-140-0x0000000005850000-0x0000000005860000-memory.dmp
memory/1696-133-0x0000000000AD0000-0x0000000000B6C000-memory.dmp
memory/3132-144-0x0000000003080000-0x0000000003096000-memory.dmp
memory/3352-141-0x0000000000400000-0x0000000000409000-memory.dmp
memory/3352-143-0x0000000000400000-0x0000000000409000-memory.dmp
memory/3352-145-0x0000000000400000-0x0000000000409000-memory.dmp
memory/4004-158-0x0000000000F70000-0x0000000000F7C000-memory.dmp
memory/4004-159-0x0000000000F70000-0x0000000000F7C000-memory.dmp
memory/4704-155-0x0000000000500000-0x000000000056B000-memory.dmp
memory/4704-156-0x0000000000570000-0x00000000005F0000-memory.dmp
memory/4704-157-0x0000000000500000-0x000000000056B000-memory.dmp