Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
30/03/2023, 07:31
General
-
Target
22f50ef32d23e0f441da489071ca1ecb.exe
-
Size
597KB
-
MD5
22f50ef32d23e0f441da489071ca1ecb
-
SHA1
b3d1136a952d4c15df83178595e89e2f643ac89e
-
SHA256
50ae1cc086fc3faeeb453c5923097b9328b63bbe19ed9f9c226bbb1b49a1917d
-
SHA512
15c4d386d866d97fd3abf4dbf0f70e3b1b0db6043a545f6f859977e41c10203e6f8410b5daf877b5c985e32ed759615bf59fab5f3960e6967b0574fd3997e1b1
-
SSDEEP
12288:xQxy0FBF2J5SWzDv7SMvUvH8QKuyywV36hu6:xkH2J5SWzDvC8QVwV3C1
Malware Config
Extracted
smokeloader
swo
Extracted
smokeloader
2020
http://akmedia.in/js/k/index.php
http://bethesdaserukam.org/setting/k/index.php
http://stemschools.in/js/k/index.php
http://dejarestaurant.com/wp-admin/js/k/index.php
http://moabscript.ir/wp-admin/js/k/index.php
http://nicehybridseeds.com/image/catalog/k/index.php
http://imaker.io/picktail/js/k/index.php
http://nanavatisworld.com/assets/js/k/index.php
http://smartbubox.com/img/k/index.php
http://krigenpharmaceuticals.com/js/k/index.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of SetThreadContext 1 IoCs
-
Program crash 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\22f50ef32d23e0f441da489071ca1ecb.exe"C:\Users\Admin\AppData\Local\Temp\22f50ef32d23e0f441da489071ca1ecb.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\22f50ef32d23e0f441da489071ca1ecb.exe"{path}"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 8762⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4704 -ip 47041⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
624KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
344KB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
624KB
-
Filesize
88KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
428KB
-
Filesize
512KB
-
Filesize
428KB