Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
26/04/2023, 09:35 UTC
General
-
Target
985e977864a3bf31e1953cf1de4465a3ce5eeafac9908598a730de1e9af1a1da.exe
-
Size
223KB
-
MD5
10a23e5e5c59b8d1470248a72be5faeb
-
SHA1
48cdf8db907f4efc039c477198b11d9541306395
-
SHA256
985e977864a3bf31e1953cf1de4465a3ce5eeafac9908598a730de1e9af1a1da
-
SHA512
c618b4d7c0c41629f0279e1d6c14f84908d2da6f3b8cd98be444757c1c12e236068604e55f81b3b05bbb2e2cc1cad0e3a88e586361a71dbce3e213061765a295
-
SSDEEP
3072:WIMolJB8OtFSTWZk9FRhKUMb4jYgQLRZiitUPX4q56lm22Td:LDUTWCiNqgTzt1oT
Score
10/10
Malware Config
Extracted
Family
smokeloader
Botnet
pu10
Extracted
Family
smokeloader
Version
2020
C2
http://host-file-host6.com/
http://host-host-file8.com/
rc4.i32
1
0x33f8f0d2
rc4.i32
1
0xaa0488bb
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of SetThreadContext 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\985e977864a3bf31e1953cf1de4465a3ce5eeafac9908598a730de1e9af1a1da.exe"C:\Users\Admin\AppData\Local\Temp\985e977864a3bf31e1953cf1de4465a3ce5eeafac9908598a730de1e9af1a1da.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\985e977864a3bf31e1953cf1de4465a3ce5eeafac9908598a730de1e9af1a1da.exe"C:\Users\Admin\AppData\Local\Temp\985e977864a3bf31e1953cf1de4465a3ce5eeafac9908598a730de1e9af1a1da.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
Network
-
DNS58.55.71.13.in-addr.arpaRemote address:8.8.8.8:53Request58.55.71.13.in-addr.arpaIN PTRResponse -
DNS73.31.126.40.in-addr.arpaRemote address:8.8.8.8:53Request73.31.126.40.in-addr.arpaIN PTRResponse
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
DNS42.220.44.20.in-addr.arpaRemote address:8.8.8.8:53Request42.220.44.20.in-addr.arpaIN PTRResponse
-
DNShost-file-host6.comRemote address:8.8.8.8:53Requesthost-file-host6.comIN AResponsehost-file-host6.comIN A193.233.134.82
-
POSThttp://host-file-host6.com/Remote address:193.233.134.82:80RequestPOST / HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://olttcqylat.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Content-Length: 201
Host: host-file-host6.com
ResponseHTTP/1.1 200 OK
Server: nginx/1.20.2
Date: Wed, 26 Apr 2023 09:36:07 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
-
DNShost-host-file8.comRemote address:8.8.8.8:53Requesthost-host-file8.comIN AResponse
-
DNShost-host-file8.comRemote address:8.8.8.8:53Requesthost-host-file8.comIN AResponse
-
DNShost-host-file8.comRemote address:8.8.8.8:53Requesthost-host-file8.comIN AResponse
-
DNShost-host-file8.comRemote address:8.8.8.8:53Requesthost-host-file8.comIN AResponse
-
DNS82.134.233.193.in-addr.arpaRemote address:8.8.8.8:53Request82.134.233.193.in-addr.arpaIN PTRResponse82.134.233.193.in-addr.arpaIN PTRhosted-bybenderrdp
-
DNS73.159.190.20.in-addr.arpaRemote address:8.8.8.8:53Request73.159.190.20.in-addr.arpaIN PTRResponse
-
DNS232.168.11.51.in-addr.arpaRemote address:8.8.8.8:53Request232.168.11.51.in-addr.arpaIN PTRResponse
-
DNS86.8.109.52.in-addr.arpaRemote address:8.8.8.8:53Request86.8.109.52.in-addr.arpaIN PTRResponse
-
193.233.134.82:80http://host-file-host6.com/http
HTTP Request
POST http://host-file-host6.com/HTTP Response
200 -
52.152.110.14:443
-
52.182.141.63:443
-
173.223.113.164:443 -
204.79.197.203:80
-
52.152.110.14:443
-
13.107.4.50:80
-
52.152.110.14:443
-
52.152.110.14:443
-
52.152.110.14:443
-
52.152.110.14:443
-
8.8.8.8:5358.55.71.13.in-addr.arpadns
DNS Request
58.55.71.13.in-addr.arpa
-
8.8.8.8:5373.31.126.40.in-addr.arpadns
DNS Request
73.31.126.40.in-addr.arpa
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa
-
8.8.8.8:5342.220.44.20.in-addr.arpadns
DNS Request
42.220.44.20.in-addr.arpa
-
8.8.8.8:53host-file-host6.comdns
DNS Request
host-file-host6.com
DNS Response
193.233.134.82
-
8.8.8.8:53host-host-file8.comdns
DNS Request
host-host-file8.com
DNS Request
host-host-file8.com
DNS Request
host-host-file8.com
DNS Request
host-host-file8.com
-
8.8.8.8:5382.134.233.193.in-addr.arpadns
DNS Request
82.134.233.193.in-addr.arpa
-
8.8.8.8:5373.159.190.20.in-addr.arpadns
DNS Request
73.159.190.20.in-addr.arpa
-
8.8.8.8:53232.168.11.51.in-addr.arpadns
DNS Request
232.168.11.51.in-addr.arpa
-
8.8.8.8:5386.8.109.52.in-addr.arpadns
DNS Request
86.8.109.52.in-addr.arpa
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
-
Filesize
88KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
8KB
-
Filesize
44KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
8KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
36KB