Analysis

  • max time kernel
    151s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    14/07/2023, 06:48

General

  • Target

    Pedido- 1253-360.xls

  • Size

    1.4MB

  • MD5

    3aaea611bbf04af88f795927bca16b9d

  • SHA1

    74084df258e08f86c5c8d62abc51b14649fd8660

  • SHA256

    ebd76ed616fef2f1a27deb6f252ffe2d62ab99bc90189d72e99f95fbf737200d

  • SHA512

    584b38eb5ef6572569c20b6d99f50ddc4d4aa8f07e03ab9b4e73e0467d336875b06b74b00af3066d32caf411405534de2dc71581ee4058468cb5b1123f4ddafe

  • SSDEEP

    24576:Mu9VTtZyxw6V4OZyCw6VxeHBlEzp7uTeRbgcwFA5DATMHYwV6x:MubXh6V4Y+6VIhOzJgjF9TSYz

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://cletonmy.com/

http://alpatrik.com/

rc4.i32
rc4.i32

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Checks QEMU agent file 2 TTPs 4 IoCs

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 18 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Pedido- 1253-360.xls"
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:492
  • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
    1⤵
    • Blocklisted process makes network request
    • Loads dropped DLL
    • Launches Equation Editor
    • Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Users\Admin\AppData\Local\Temp\IBM_Cent.EXE
      "C:\Users\Admin\AppData\Local\Temp\IBM_Cent.EXE"
      2⤵
      • Checks QEMU agent file
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2988
      • C:\Users\Admin\AppData\Local\Temp\IBM_Cent.EXE
        "C:\Users\Admin\AppData\Local\Temp\IBM_Cent.EXE"
        3⤵
        • Checks QEMU agent file
        • Loads dropped DLL
        • Suspicious use of NtCreateThreadExHideFromDebugger
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        PID:2756
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {6A1EF188-2D9F-454D-802B-E8520E0E5FC9} S-1-5-21-1014134971-2480516131-292343513-1000:NYBYVYTJ\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2028
    • C:\Users\Admin\AppData\Roaming\uetiudg
      C:\Users\Admin\AppData\Roaming\uetiudg
      2⤵
      • Checks QEMU agent file
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:932
      • C:\Users\Admin\AppData\Roaming\uetiudg
        C:\Users\Admin\AppData\Roaming\uetiudg
        3⤵
        • Checks QEMU agent file
        • Loads dropped DLL
        PID:2780

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\CEA3BB5C.emf

          Filesize

          1.4MB

          MD5

          a01b9617553432807b9b58025b338d97

          SHA1

          439bdcc450408b9735b2428c2d53d2e6977fa58c

          SHA256

          7a0426ed2e2349916969ff7087c0f76089fb8ce7f4627f3d11ccbc1aaefcedce

          SHA512

          312cc2563fa865d6a939fea85a520627c73ed9a95bafc98c89495f21d535dc658825be74b64f0f5c5815d1d234fc6e77a71779247e4973e39ba8dccec2f09bee

        • C:\Users\Admin\AppData\Local\Temp\IBM_Cent.EXE

          Filesize

          703KB

          MD5

          a8a27695f1bc25512354f2c6b5e9d037

          SHA1

          d39c5146f3560a6d55657eaa384a8794e25c97ad

          SHA256

          4365ff3c93ee1faa413ab7cf6838884c449053479d3039e995a6cdfe590125e4

          SHA512

          58e1eb8588514730e5727c684839f35e45390c429e52514d8394d607a332cc8b3be7a733f3dbc856c696d55607d1073289c8dca2d0bc30d1c46de640c262a913

        • C:\Users\Admin\AppData\Local\Temp\IBM_Cent.EXE

          Filesize

          703KB

          MD5

          a8a27695f1bc25512354f2c6b5e9d037

          SHA1

          d39c5146f3560a6d55657eaa384a8794e25c97ad

          SHA256

          4365ff3c93ee1faa413ab7cf6838884c449053479d3039e995a6cdfe590125e4

          SHA512

          58e1eb8588514730e5727c684839f35e45390c429e52514d8394d607a332cc8b3be7a733f3dbc856c696d55607d1073289c8dca2d0bc30d1c46de640c262a913

        • C:\Users\Admin\AppData\Local\Temp\IBM_Cent.EXE

          Filesize

          703KB

          MD5

          a8a27695f1bc25512354f2c6b5e9d037

          SHA1

          d39c5146f3560a6d55657eaa384a8794e25c97ad

          SHA256

          4365ff3c93ee1faa413ab7cf6838884c449053479d3039e995a6cdfe590125e4

          SHA512

          58e1eb8588514730e5727c684839f35e45390c429e52514d8394d607a332cc8b3be7a733f3dbc856c696d55607d1073289c8dca2d0bc30d1c46de640c262a913

        • C:\Users\Admin\AppData\Local\Temp\IBM_Cent.EXE

          Filesize

          703KB

          MD5

          a8a27695f1bc25512354f2c6b5e9d037

          SHA1

          d39c5146f3560a6d55657eaa384a8794e25c97ad

          SHA256

          4365ff3c93ee1faa413ab7cf6838884c449053479d3039e995a6cdfe590125e4

          SHA512

          58e1eb8588514730e5727c684839f35e45390c429e52514d8394d607a332cc8b3be7a733f3dbc856c696d55607d1073289c8dca2d0bc30d1c46de640c262a913

        • C:\Users\Admin\AppData\Local\Temp\nse8F55.tmp\System.dll

          Filesize

          11KB

          MD5

          375e8a08471dc6f85f3828488b1147b3

          SHA1

          1941484ac710fc301a7d31d6f1345e32a21546af

          SHA256

          4c86b238e64ecfaabe322a70fd78db229a663ccc209920f3385596a6e3205f78

          SHA512

          5ba29db13723ddf27b265a4548606274b850d076ae1f050c64044f8ccd020585ad766c85c3e20003a22f356875f76fb3679c89547b0962580d8e5a42b082b9a8

        • C:\Users\Admin\AppData\Roaming\uetiudg

          Filesize

          703KB

          MD5

          a8a27695f1bc25512354f2c6b5e9d037

          SHA1

          d39c5146f3560a6d55657eaa384a8794e25c97ad

          SHA256

          4365ff3c93ee1faa413ab7cf6838884c449053479d3039e995a6cdfe590125e4

          SHA512

          58e1eb8588514730e5727c684839f35e45390c429e52514d8394d607a332cc8b3be7a733f3dbc856c696d55607d1073289c8dca2d0bc30d1c46de640c262a913

        • C:\Users\Admin\AppData\Roaming\uetiudg

          Filesize

          703KB

          MD5

          a8a27695f1bc25512354f2c6b5e9d037

          SHA1

          d39c5146f3560a6d55657eaa384a8794e25c97ad

          SHA256

          4365ff3c93ee1faa413ab7cf6838884c449053479d3039e995a6cdfe590125e4

          SHA512

          58e1eb8588514730e5727c684839f35e45390c429e52514d8394d607a332cc8b3be7a733f3dbc856c696d55607d1073289c8dca2d0bc30d1c46de640c262a913

        • C:\Users\Admin\AppData\Roaming\uetiudg

          Filesize

          703KB

          MD5

          a8a27695f1bc25512354f2c6b5e9d037

          SHA1

          d39c5146f3560a6d55657eaa384a8794e25c97ad

          SHA256

          4365ff3c93ee1faa413ab7cf6838884c449053479d3039e995a6cdfe590125e4

          SHA512

          58e1eb8588514730e5727c684839f35e45390c429e52514d8394d607a332cc8b3be7a733f3dbc856c696d55607d1073289c8dca2d0bc30d1c46de640c262a913

        • \Users\Admin\AppData\Local\Temp\IBM_Cent.EXE

          Filesize

          703KB

          MD5

          a8a27695f1bc25512354f2c6b5e9d037

          SHA1

          d39c5146f3560a6d55657eaa384a8794e25c97ad

          SHA256

          4365ff3c93ee1faa413ab7cf6838884c449053479d3039e995a6cdfe590125e4

          SHA512

          58e1eb8588514730e5727c684839f35e45390c429e52514d8394d607a332cc8b3be7a733f3dbc856c696d55607d1073289c8dca2d0bc30d1c46de640c262a913

        • \Users\Admin\AppData\Local\Temp\IBM_Cent.EXE

          Filesize

          703KB

          MD5

          a8a27695f1bc25512354f2c6b5e9d037

          SHA1

          d39c5146f3560a6d55657eaa384a8794e25c97ad

          SHA256

          4365ff3c93ee1faa413ab7cf6838884c449053479d3039e995a6cdfe590125e4

          SHA512

          58e1eb8588514730e5727c684839f35e45390c429e52514d8394d607a332cc8b3be7a733f3dbc856c696d55607d1073289c8dca2d0bc30d1c46de640c262a913

        • \Users\Admin\AppData\Local\Temp\nse8F55.tmp\System.dll

          Filesize

          11KB

          MD5

          375e8a08471dc6f85f3828488b1147b3

          SHA1

          1941484ac710fc301a7d31d6f1345e32a21546af

          SHA256

          4c86b238e64ecfaabe322a70fd78db229a663ccc209920f3385596a6e3205f78

          SHA512

          5ba29db13723ddf27b265a4548606274b850d076ae1f050c64044f8ccd020585ad766c85c3e20003a22f356875f76fb3679c89547b0962580d8e5a42b082b9a8

        • \Users\Admin\AppData\Local\Temp\nso10B.tmp\System.dll

          Filesize

          11KB

          MD5

          375e8a08471dc6f85f3828488b1147b3

          SHA1

          1941484ac710fc301a7d31d6f1345e32a21546af

          SHA256

          4c86b238e64ecfaabe322a70fd78db229a663ccc209920f3385596a6e3205f78

          SHA512

          5ba29db13723ddf27b265a4548606274b850d076ae1f050c64044f8ccd020585ad766c85c3e20003a22f356875f76fb3679c89547b0962580d8e5a42b082b9a8

        • memory/492-83-0x000000007313D000-0x0000000073148000-memory.dmp

          Filesize

          44KB

        • memory/492-55-0x000000007313D000-0x0000000073148000-memory.dmp

          Filesize

          44KB

        • memory/492-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

          Filesize

          64KB

        • memory/492-130-0x000000007313D000-0x0000000073148000-memory.dmp

          Filesize

          44KB

        • memory/492-115-0x000000005FFF0000-0x0000000060000000-memory.dmp

          Filesize

          64KB

        • memory/932-146-0x00000000038F0000-0x0000000005081000-memory.dmp

          Filesize

          23.6MB

        • memory/932-147-0x00000000038F0000-0x0000000005081000-memory.dmp

          Filesize

          23.6MB

        • memory/932-148-0x0000000076D40000-0x0000000076EE9000-memory.dmp

          Filesize

          1.7MB

        • memory/932-149-0x0000000010000000-0x0000000010006000-memory.dmp

          Filesize

          24KB

        • memory/1340-101-0x0000000002B20000-0x0000000002B36000-memory.dmp

          Filesize

          88KB

        • memory/2756-97-0x0000000001470000-0x0000000002C01000-memory.dmp

          Filesize

          23.6MB

        • memory/2756-91-0x0000000001470000-0x0000000002C01000-memory.dmp

          Filesize

          23.6MB

        • memory/2756-102-0x0000000001470000-0x0000000002C01000-memory.dmp

          Filesize

          23.6MB

        • memory/2756-100-0x0000000000400000-0x0000000001462000-memory.dmp

          Filesize

          16.4MB

        • memory/2756-96-0x0000000000400000-0x0000000001462000-memory.dmp

          Filesize

          16.4MB

        • memory/2756-95-0x0000000076D40000-0x0000000076EE9000-memory.dmp

          Filesize

          1.7MB

        • memory/2756-94-0x0000000001470000-0x0000000002C01000-memory.dmp

          Filesize

          23.6MB

        • memory/2756-93-0x0000000000400000-0x0000000001462000-memory.dmp

          Filesize

          16.4MB

        • memory/2756-92-0x0000000076D40000-0x0000000076EE9000-memory.dmp

          Filesize

          1.7MB

        • memory/2756-105-0x0000000000400000-0x0000000001462000-memory.dmp

          Filesize

          16.4MB

        • memory/2756-90-0x0000000000400000-0x0000000001462000-memory.dmp

          Filesize

          16.4MB

        • memory/2780-151-0x0000000000400000-0x0000000001462000-memory.dmp

          Filesize

          16.4MB

        • memory/2780-152-0x0000000001470000-0x0000000002C01000-memory.dmp

          Filesize

          23.6MB

        • memory/2780-153-0x0000000076D40000-0x0000000076EE9000-memory.dmp

          Filesize

          1.7MB

        • memory/2988-88-0x0000000010000000-0x0000000010006000-memory.dmp

          Filesize

          24KB

        • memory/2988-86-0x0000000076F30000-0x0000000077006000-memory.dmp

          Filesize

          856KB

        • memory/2988-85-0x0000000076D40000-0x0000000076EE9000-memory.dmp

          Filesize

          1.7MB

        • memory/2988-84-0x0000000003760000-0x0000000004EF1000-memory.dmp

          Filesize

          23.6MB

        • memory/2988-82-0x0000000003760000-0x0000000004EF1000-memory.dmp

          Filesize

          23.6MB