Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
11-04-2023 15:07
Static task
static1
Behavioral task
behavioral1
Sample
3a3ebd46f67f51421694fdd2b6e1dd08a8afae823cba07f94f60c5b9357c5855.exe
Resource
win10v2004-20230220-en
General
-
Target
3a3ebd46f67f51421694fdd2b6e1dd08a8afae823cba07f94f60c5b9357c5855.exe
-
Size
209KB
-
MD5
bde94cd254621d8938c99113dbe5996d
-
SHA1
e797aca69bb2d241a461b6973a85406e2e2f1000
-
SHA256
3a3ebd46f67f51421694fdd2b6e1dd08a8afae823cba07f94f60c5b9357c5855
-
SHA512
7e0f02f3d46b386081fc2bcfdacedfc050eba2e093942e8a008e927dea0ab13773531d0d0ce2a2b71faab7530414e1ff98d93f9c15224f87210edeb6ecb46917
-
SSDEEP
3072:nXhMgq2enEcSHwpGpVC9Jxl1+D0yisW7fb0rcokNhcc1CfLkY75Sy1CRng:XegY/AX4Ll1+DeT7T0r/Uh7sjr4yAdg
Malware Config
Extracted
smokeloader
sprg
Extracted
smokeloader
2022
http://hoh0aeghwugh2gie.com/
http://hie7doodohpae4na.com/
http://aek0aicifaloh1yo.com/
http://yic0oosaeiy7ahng.com/
http://wa5zu7sekai8xeih.com/
Extracted
vidar
3.4
e749025c61b2caca10aa829a9e1a65a1
https://steamcommunity.com/profiles/76561199494593681
https://t.me/auftriebs
-
profile_id_v2
e749025c61b2caca10aa829a9e1a65a1
-
user_agent
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:105.0) Gecko/20100101 Firefox/105.0
Extracted
laplas
http://185.106.92.74
-
api_key
bc2dceabe69fa26dbf4dd8295d65e03e1990633a88c1c8410825c9266b239396
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation E489.exe Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation 30889335031728668981.exe -
Executes dropped EXE 5 IoCs
pid Process 4296 E489.exe 1172 18342874739404220901.exe 4156 30889335031728668981.exe 4712 svcservice.exe 5004 urjtaas -
Loads dropped DLL 2 IoCs
pid Process 4296 E489.exe 4296 E489.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/files/0x00060000000231af-266.dat upx behavioral1/files/0x00060000000231af-268.dat upx behavioral1/files/0x00060000000231af-269.dat upx behavioral1/memory/1172-272-0x0000000000A10000-0x0000000001873000-memory.dmp upx behavioral1/memory/1172-273-0x0000000000A10000-0x0000000001873000-memory.dmp upx -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\telemetry = "C:\\Users\\Admin\\AppData\\Roaming\\telemetry\\svcservice.exe" 30889335031728668981.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
pid Process 4156 30889335031728668981.exe 4156 30889335031728668981.exe 4712 svcservice.exe 4712 svcservice.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 2724 4296 WerFault.exe 89 -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3a3ebd46f67f51421694fdd2b6e1dd08a8afae823cba07f94f60c5b9357c5855.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3a3ebd46f67f51421694fdd2b6e1dd08a8afae823cba07f94f60c5b9357c5855.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3a3ebd46f67f51421694fdd2b6e1dd08a8afae823cba07f94f60c5b9357c5855.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI urjtaas Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI urjtaas Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI urjtaas -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 E489.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString E489.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 4340 timeout.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3036 3a3ebd46f67f51421694fdd2b6e1dd08a8afae823cba07f94f60c5b9357c5855.exe 3036 3a3ebd46f67f51421694fdd2b6e1dd08a8afae823cba07f94f60c5b9357c5855.exe 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3172 Process not Found -
Suspicious behavior: MapViewOfSection 20 IoCs
pid Process 3036 3a3ebd46f67f51421694fdd2b6e1dd08a8afae823cba07f94f60c5b9357c5855.exe 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 3172 Process not Found 5004 urjtaas -
Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeShutdownPrivilege 3172 Process not Found Token: SeCreatePagefilePrivilege 3172 Process not Found Token: SeShutdownPrivilege 3172 Process not Found Token: SeCreatePagefilePrivilege 3172 Process not Found Token: SeShutdownPrivilege 3172 Process not Found Token: SeCreatePagefilePrivilege 3172 Process not Found Token: SeShutdownPrivilege 3172 Process not Found Token: SeCreatePagefilePrivilege 3172 Process not Found Token: SeShutdownPrivilege 3172 Process not Found Token: SeCreatePagefilePrivilege 3172 Process not Found Token: SeShutdownPrivilege 3172 Process not Found Token: SeCreatePagefilePrivilege 3172 Process not Found Token: SeShutdownPrivilege 3172 Process not Found Token: SeCreatePagefilePrivilege 3172 Process not Found Token: SeShutdownPrivilege 3172 Process not Found Token: SeCreatePagefilePrivilege 3172 Process not Found -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 3172 wrote to memory of 4296 3172 Process not Found 89 PID 3172 wrote to memory of 4296 3172 Process not Found 89 PID 3172 wrote to memory of 4296 3172 Process not Found 89 PID 3172 wrote to memory of 4088 3172 Process not Found 90 PID 3172 wrote to memory of 4088 3172 Process not Found 90 PID 3172 wrote to memory of 4088 3172 Process not Found 90 PID 3172 wrote to memory of 4088 3172 Process not Found 90 PID 3172 wrote to memory of 3416 3172 Process not Found 91 PID 3172 wrote to memory of 3416 3172 Process not Found 91 PID 3172 wrote to memory of 3416 3172 Process not Found 91 PID 3172 wrote to memory of 3248 3172 Process not Found 92 PID 3172 wrote to memory of 3248 3172 Process not Found 92 PID 3172 wrote to memory of 3248 3172 Process not Found 92 PID 3172 wrote to memory of 3248 3172 Process not Found 92 PID 3172 wrote to memory of 4236 3172 Process not Found 94 PID 3172 wrote to memory of 4236 3172 Process not Found 94 PID 3172 wrote to memory of 4236 3172 Process not Found 94 PID 3172 wrote to memory of 1012 3172 Process not Found 95 PID 3172 wrote to memory of 1012 3172 Process not Found 95 PID 3172 wrote to memory of 1012 3172 Process not Found 95 PID 3172 wrote to memory of 1012 3172 Process not Found 95 PID 3172 wrote to memory of 1040 3172 Process not Found 96 PID 3172 wrote to memory of 1040 3172 Process not Found 96 PID 3172 wrote to memory of 1040 3172 Process not Found 96 PID 3172 wrote to memory of 1040 3172 Process not Found 96 PID 3172 wrote to memory of 2976 3172 Process not Found 97 PID 3172 wrote to memory of 2976 3172 Process not Found 97 PID 3172 wrote to memory of 2976 3172 Process not Found 97 PID 3172 wrote to memory of 2976 3172 Process not Found 97 PID 3172 wrote to memory of 1636 3172 Process not Found 98 PID 3172 wrote to memory of 1636 3172 Process not Found 98 PID 3172 wrote to memory of 1636 3172 Process not Found 98 PID 3172 wrote to memory of 4616 3172 Process not Found 99 PID 3172 wrote to memory of 4616 3172 Process not Found 99 PID 3172 wrote to memory of 4616 3172 Process not Found 99 PID 3172 wrote to memory of 4616 3172 Process not Found 99 PID 4296 wrote to memory of 1172 4296 E489.exe 100 PID 4296 wrote to memory of 1172 4296 E489.exe 100 PID 1172 wrote to memory of 2992 1172 18342874739404220901.exe 102 PID 1172 wrote to memory of 2992 1172 18342874739404220901.exe 102 PID 2992 wrote to memory of 3212 2992 cmd.exe 104 PID 2992 wrote to memory of 3212 2992 cmd.exe 104 PID 4296 wrote to memory of 4156 4296 E489.exe 105 PID 4296 wrote to memory of 4156 4296 E489.exe 105 PID 4296 wrote to memory of 4156 4296 E489.exe 105 PID 4296 wrote to memory of 4788 4296 E489.exe 106 PID 4296 wrote to memory of 4788 4296 E489.exe 106 PID 4296 wrote to memory of 4788 4296 E489.exe 106 PID 4788 wrote to memory of 4340 4788 cmd.exe 110 PID 4788 wrote to memory of 4340 4788 cmd.exe 110 PID 4788 wrote to memory of 4340 4788 cmd.exe 110 PID 4156 wrote to memory of 4712 4156 30889335031728668981.exe 112 PID 4156 wrote to memory of 4712 4156 30889335031728668981.exe 112 PID 4156 wrote to memory of 4712 4156 30889335031728668981.exe 112 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a3ebd46f67f51421694fdd2b6e1dd08a8afae823cba07f94f60c5b9357c5855.exe"C:\Users\Admin\AppData\Local\Temp\3a3ebd46f67f51421694fdd2b6e1dd08a8afae823cba07f94f60c5b9357c5855.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3036
-
C:\Users\Admin\AppData\Local\Temp\E489.exeC:\Users\Admin\AppData\Local\Temp\E489.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\ProgramData\18342874739404220901.exe"C:\ProgramData\18342874739404220901.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\ProgramData\18342874739404220901.exe3⤵
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 04⤵PID:3212
-
-
-
-
C:\ProgramData\30889335031728668981.exe"C:\ProgramData\30889335031728668981.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe"C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4712
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\E489.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\SysWOW64\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
PID:4340
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4296 -s 5802⤵
- Program crash
PID:2724
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4088
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3416
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3248
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4236
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1012
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1040
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2976
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1636
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4616
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4296 -ip 42961⤵PID:1388
-
C:\Users\Admin\AppData\Roaming\urjtaasC:\Users\Admin\AppData\Roaming\urjtaas1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5004
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.3MB
MD5c4ab3149ef02a36d663699a8c541933e
SHA167088f5eff9ec575775b711c9e3650d12d7f4d5c
SHA2560a0fbd6af9e5d110118f02b87f9a92f9f58fb100f6d9883d55a6aae6c548b4ce
SHA51288b10f81b2cd273fefeffb4c2078807e89b4b756d50110b61e9f89092715f29ba8d1803f64bc971c1293dc624b92d0b7f05612ae661dd8d24e47d39047a4b7b4
-
Filesize
4.3MB
MD5c4ab3149ef02a36d663699a8c541933e
SHA167088f5eff9ec575775b711c9e3650d12d7f4d5c
SHA2560a0fbd6af9e5d110118f02b87f9a92f9f58fb100f6d9883d55a6aae6c548b4ce
SHA51288b10f81b2cd273fefeffb4c2078807e89b4b756d50110b61e9f89092715f29ba8d1803f64bc971c1293dc624b92d0b7f05612ae661dd8d24e47d39047a4b7b4
-
Filesize
4.3MB
MD5c4ab3149ef02a36d663699a8c541933e
SHA167088f5eff9ec575775b711c9e3650d12d7f4d5c
SHA2560a0fbd6af9e5d110118f02b87f9a92f9f58fb100f6d9883d55a6aae6c548b4ce
SHA51288b10f81b2cd273fefeffb4c2078807e89b4b756d50110b61e9f89092715f29ba8d1803f64bc971c1293dc624b92d0b7f05612ae661dd8d24e47d39047a4b7b4
-
Filesize
7.2MB
MD5c5e0fb4ecaa8a7481a283099d604f7a0
SHA1df4b0c0cc823da2b0443076650c292b43dd9de33
SHA256c6c03e97c5de0c9eb264e4914d8c7f64d7e3528cc696f613e451a294262f3c42
SHA512375677d0cc802b09c7d1532d162a91a8eec4679f7639ef38dca9a9d3a03e20b3ab54707af7ffb138d00ec93ea4b34b6db0b33f365dc888ff9056c808a239bc57
-
Filesize
7.2MB
MD5c5e0fb4ecaa8a7481a283099d604f7a0
SHA1df4b0c0cc823da2b0443076650c292b43dd9de33
SHA256c6c03e97c5de0c9eb264e4914d8c7f64d7e3528cc696f613e451a294262f3c42
SHA512375677d0cc802b09c7d1532d162a91a8eec4679f7639ef38dca9a9d3a03e20b3ab54707af7ffb138d00ec93ea4b34b6db0b33f365dc888ff9056c808a239bc57
-
Filesize
7.2MB
MD5c5e0fb4ecaa8a7481a283099d604f7a0
SHA1df4b0c0cc823da2b0443076650c292b43dd9de33
SHA256c6c03e97c5de0c9eb264e4914d8c7f64d7e3528cc696f613e451a294262f3c42
SHA512375677d0cc802b09c7d1532d162a91a8eec4679f7639ef38dca9a9d3a03e20b3ab54707af7ffb138d00ec93ea4b34b6db0b33f365dc888ff9056c808a239bc57
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
320KB
MD5e749e6c90e0a52e6683bc8237b3a9198
SHA194f81c8ba9d2fb18a67ca27bd9c57921c5529847
SHA256e6ce1d285c0083ad58c8617f7270dd1630c7cd080c24a867cb44983936d7fb0e
SHA51252248dc0256249230fe78f5d6d58fc6b89785ae15aec070894850a37d0bcfc47fe1cbb32d9ebfdaadebf3d546170a25c2a1fe87cee8b875c7138be96a90866e4
-
Filesize
320KB
MD5e749e6c90e0a52e6683bc8237b3a9198
SHA194f81c8ba9d2fb18a67ca27bd9c57921c5529847
SHA256e6ce1d285c0083ad58c8617f7270dd1630c7cd080c24a867cb44983936d7fb0e
SHA51252248dc0256249230fe78f5d6d58fc6b89785ae15aec070894850a37d0bcfc47fe1cbb32d9ebfdaadebf3d546170a25c2a1fe87cee8b875c7138be96a90866e4
-
Filesize
723.2MB
MD52cb40e5e227eae6ee51d5ce474879cd6
SHA172518974e1b4bc8d516ec46f9d2b10cd30b03e7b
SHA2561f6614632787781eefd9bc262694f87f16bf9966561a31411cb515b996e674d9
SHA51228383b2d7dcbf9f1fe98b639ea81116552364f702a27cd50c5d658196ba9d88aaebf816713c4f8539a3eeaa6770c7dd53303e70891b65a59ef4aff49b63d18fb
-
Filesize
723.2MB
MD52cb40e5e227eae6ee51d5ce474879cd6
SHA172518974e1b4bc8d516ec46f9d2b10cd30b03e7b
SHA2561f6614632787781eefd9bc262694f87f16bf9966561a31411cb515b996e674d9
SHA51228383b2d7dcbf9f1fe98b639ea81116552364f702a27cd50c5d658196ba9d88aaebf816713c4f8539a3eeaa6770c7dd53303e70891b65a59ef4aff49b63d18fb
-
Filesize
209KB
MD5bde94cd254621d8938c99113dbe5996d
SHA1e797aca69bb2d241a461b6973a85406e2e2f1000
SHA2563a3ebd46f67f51421694fdd2b6e1dd08a8afae823cba07f94f60c5b9357c5855
SHA5127e0f02f3d46b386081fc2bcfdacedfc050eba2e093942e8a008e927dea0ab13773531d0d0ce2a2b71faab7530414e1ff98d93f9c15224f87210edeb6ecb46917
-
Filesize
209KB
MD5bde94cd254621d8938c99113dbe5996d
SHA1e797aca69bb2d241a461b6973a85406e2e2f1000
SHA2563a3ebd46f67f51421694fdd2b6e1dd08a8afae823cba07f94f60c5b9357c5855
SHA5127e0f02f3d46b386081fc2bcfdacedfc050eba2e093942e8a008e927dea0ab13773531d0d0ce2a2b71faab7530414e1ff98d93f9c15224f87210edeb6ecb46917