Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/07/2023, 11:54

General

  • Target

    SecuriteInfo.com.FileRepMalware.16560.22720.exe

  • Size

    703KB

  • MD5

    a8a27695f1bc25512354f2c6b5e9d037

  • SHA1

    d39c5146f3560a6d55657eaa384a8794e25c97ad

  • SHA256

    4365ff3c93ee1faa413ab7cf6838884c449053479d3039e995a6cdfe590125e4

  • SHA512

    58e1eb8588514730e5727c684839f35e45390c429e52514d8394d607a332cc8b3be7a733f3dbc856c696d55607d1073289c8dca2d0bc30d1c46de640c262a913

  • SSDEEP

    12288:/fyw2ahjxbe1SORR84Rl7hChlA4aEISAe43v:/6NanbivDChdrnXm

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://cletonmy.com/

http://alpatrik.com/

rc4.i32
rc4.i32

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Checks QEMU agent file 2 TTPs 2 IoCs

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 3 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.16560.22720.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.16560.22720.exe"
    1⤵
    • Checks QEMU agent file
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:640
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.16560.22720.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.16560.22720.exe"
      2⤵
      • Checks QEMU agent file
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:3500
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k netsvcs -p
    1⤵
    • Drops file in System32 directory
    • Checks processor information in registry
    • Enumerates system info in registry
    PID:5056

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\nsr6468.tmp\System.dll

          Filesize

          11KB

          MD5

          375e8a08471dc6f85f3828488b1147b3

          SHA1

          1941484ac710fc301a7d31d6f1345e32a21546af

          SHA256

          4c86b238e64ecfaabe322a70fd78db229a663ccc209920f3385596a6e3205f78

          SHA512

          5ba29db13723ddf27b265a4548606274b850d076ae1f050c64044f8ccd020585ad766c85c3e20003a22f356875f76fb3679c89547b0962580d8e5a42b082b9a8

        • C:\Users\Admin\AppData\Local\Temp\wsu9FAB.tmp

          Filesize

          14KB

          MD5

          c01eaa0bdcd7c30a42bbb35a9acbf574

          SHA1

          0aee3e1b873e41d040f1991819d0027b6cc68f54

          SHA256

          32297224427103aa1834dba276bf5d49cd5dd6bda0291422e47ad0d0706c6d40

          SHA512

          d26ff775ad39425933cd3df92209faa53ec5b701e65bfbcccc64ce8dd3e79f619a9bad7cc975a98a95f2006ae89e50551877fc315a3050e48d5ab89e0802e2b7

        • C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NCBCSZSJRSB.dat

          Filesize

          29KB

          MD5

          fcf69b7c66858ca81004756f45598f76

          SHA1

          3daed9d03545261f5ecc3f95e3069f57b6256c80

          SHA256

          43e7c454dafb6c635980c1074fd8308755a241a69d8abb7c1b382a01db6866e1

          SHA512

          659914f01c9bc4e4df73c2c26950e19d73f80f9cea417939cc599ed51b3ce895a001224677db03bd61c5b16bfb32de50803e2f5305216f8bc0e75709ae799c37

        • memory/640-141-0x0000000004A50000-0x00000000061E1000-memory.dmp

          Filesize

          23.6MB

        • memory/640-143-0x0000000004A50000-0x00000000061E1000-memory.dmp

          Filesize

          23.6MB

        • memory/640-175-0x0000000077DA1000-0x0000000077EC1000-memory.dmp

          Filesize

          1.1MB

        • memory/640-176-0x0000000010000000-0x0000000010006000-memory.dmp

          Filesize

          24KB

        • memory/3168-184-0x0000000002B30000-0x0000000002B46000-memory.dmp

          Filesize

          88KB

        • memory/3500-178-0x0000000001660000-0x0000000002DF1000-memory.dmp

          Filesize

          23.6MB

        • memory/3500-179-0x0000000001660000-0x0000000002DF1000-memory.dmp

          Filesize

          23.6MB

        • memory/3500-180-0x0000000077E28000-0x0000000077E29000-memory.dmp

          Filesize

          4KB

        • memory/3500-181-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/3500-182-0x0000000001660000-0x0000000002DF1000-memory.dmp

          Filesize

          23.6MB

        • memory/3500-183-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/3500-177-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/3500-185-0x0000000001660000-0x0000000002DF1000-memory.dmp

          Filesize

          23.6MB

        • memory/3500-188-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/3500-189-0x0000000077DA1000-0x0000000077EC1000-memory.dmp

          Filesize

          1.1MB