Analysis

  • max time kernel
    600s
  • max time network
    444s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-es
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-eslocale:es-esos:windows10-2004-x64systemwindows
  • submitted
    14/07/2023, 19:54

General

  • Target

    wins.exe

  • Size

    703KB

  • MD5

    a8a27695f1bc25512354f2c6b5e9d037

  • SHA1

    d39c5146f3560a6d55657eaa384a8794e25c97ad

  • SHA256

    4365ff3c93ee1faa413ab7cf6838884c449053479d3039e995a6cdfe590125e4

  • SHA512

    58e1eb8588514730e5727c684839f35e45390c429e52514d8394d607a332cc8b3be7a733f3dbc856c696d55607d1073289c8dca2d0bc30d1c46de640c262a913

  • SSDEEP

    12288:/fyw2ahjxbe1SORR84Rl7hChlA4aEISAe43v:/6NanbivDChdrnXm

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://cletonmy.com/

http://alpatrik.com/

rc4.i32
rc4.i32

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Checks QEMU agent file 2 TTPs 4 IoCs

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 6 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\wins.exe
    "C:\Users\Admin\AppData\Local\Temp\wins.exe"
    1⤵
    • Checks QEMU agent file
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1232
    • C:\Users\Admin\AppData\Local\Temp\wins.exe
      "C:\Users\Admin\AppData\Local\Temp\wins.exe"
      2⤵
      • Checks QEMU agent file
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:4788
  • C:\Users\Admin\AppData\Roaming\hdsjfva
    C:\Users\Admin\AppData\Roaming\hdsjfva
    1⤵
    • Checks QEMU agent file
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:396
    • C:\Users\Admin\AppData\Roaming\hdsjfva
      C:\Users\Admin\AppData\Roaming\hdsjfva
      2⤵
      • Checks QEMU agent file
      • Loads dropped DLL
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:5096

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\nsf8780.tmp\System.dll

          Filesize

          11KB

          MD5

          375e8a08471dc6f85f3828488b1147b3

          SHA1

          1941484ac710fc301a7d31d6f1345e32a21546af

          SHA256

          4c86b238e64ecfaabe322a70fd78db229a663ccc209920f3385596a6e3205f78

          SHA512

          5ba29db13723ddf27b265a4548606274b850d076ae1f050c64044f8ccd020585ad766c85c3e20003a22f356875f76fb3679c89547b0962580d8e5a42b082b9a8

        • C:\Users\Admin\AppData\Local\Temp\nsg194D.tmp\System.dll

          Filesize

          11KB

          MD5

          375e8a08471dc6f85f3828488b1147b3

          SHA1

          1941484ac710fc301a7d31d6f1345e32a21546af

          SHA256

          4c86b238e64ecfaabe322a70fd78db229a663ccc209920f3385596a6e3205f78

          SHA512

          5ba29db13723ddf27b265a4548606274b850d076ae1f050c64044f8ccd020585ad766c85c3e20003a22f356875f76fb3679c89547b0962580d8e5a42b082b9a8

        • C:\Users\Admin\AppData\Local\Temp\nsg194D.tmp\System.dll

          Filesize

          11KB

          MD5

          375e8a08471dc6f85f3828488b1147b3

          SHA1

          1941484ac710fc301a7d31d6f1345e32a21546af

          SHA256

          4c86b238e64ecfaabe322a70fd78db229a663ccc209920f3385596a6e3205f78

          SHA512

          5ba29db13723ddf27b265a4548606274b850d076ae1f050c64044f8ccd020585ad766c85c3e20003a22f356875f76fb3679c89547b0962580d8e5a42b082b9a8

        • C:\Users\Admin\AppData\Roaming\Havesanger\Nondyspeptic\Soten34\Igniting\Rockere128\Earn\Airways_14.bmp

          Filesize

          7KB

          MD5

          4500ee6294e6dd7ebc558442a45cd4a2

          SHA1

          e8dadc287fdc1d254e00fe6797732a6d7665ea61

          SHA256

          2d00f2194e9c74b879c37b05af189682dbd551c8366f5145fc5d84200070a265

          SHA512

          64686bcb6b028b9dfb80b6b4d2b3b8b57b8fbd5ac30e5140cebf2131c2f9c10175c6304134c59f363ea2adfd733fd6282e870d8930f352adf253e649530a1ace

        • C:\Users\Admin\AppData\Roaming\hdsjfva

          Filesize

          703KB

          MD5

          a8a27695f1bc25512354f2c6b5e9d037

          SHA1

          d39c5146f3560a6d55657eaa384a8794e25c97ad

          SHA256

          4365ff3c93ee1faa413ab7cf6838884c449053479d3039e995a6cdfe590125e4

          SHA512

          58e1eb8588514730e5727c684839f35e45390c429e52514d8394d607a332cc8b3be7a733f3dbc856c696d55607d1073289c8dca2d0bc30d1c46de640c262a913

        • C:\Users\Admin\AppData\Roaming\hdsjfva

          Filesize

          703KB

          MD5

          a8a27695f1bc25512354f2c6b5e9d037

          SHA1

          d39c5146f3560a6d55657eaa384a8794e25c97ad

          SHA256

          4365ff3c93ee1faa413ab7cf6838884c449053479d3039e995a6cdfe590125e4

          SHA512

          58e1eb8588514730e5727c684839f35e45390c429e52514d8394d607a332cc8b3be7a733f3dbc856c696d55607d1073289c8dca2d0bc30d1c46de640c262a913

        • C:\Users\Admin\AppData\Roaming\hdsjfva

          Filesize

          703KB

          MD5

          a8a27695f1bc25512354f2c6b5e9d037

          SHA1

          d39c5146f3560a6d55657eaa384a8794e25c97ad

          SHA256

          4365ff3c93ee1faa413ab7cf6838884c449053479d3039e995a6cdfe590125e4

          SHA512

          58e1eb8588514730e5727c684839f35e45390c429e52514d8394d607a332cc8b3be7a733f3dbc856c696d55607d1073289c8dca2d0bc30d1c46de640c262a913

        • memory/1232-144-0x0000000010000000-0x0000000010006000-memory.dmp

          Filesize

          24KB

        • memory/1232-143-0x0000000076FF1000-0x0000000077111000-memory.dmp

          Filesize

          1.1MB

        • memory/1232-142-0x0000000004A80000-0x0000000006211000-memory.dmp

          Filesize

          23.6MB

        • memory/1232-141-0x0000000004A80000-0x0000000006211000-memory.dmp

          Filesize

          23.6MB

        • memory/3184-214-0x00000000026F0000-0x0000000002700000-memory.dmp

          Filesize

          64KB

        • memory/3184-227-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-165-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-167-0x0000000002710000-0x0000000002720000-memory.dmp

          Filesize

          64KB

        • memory/3184-169-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-168-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-171-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-170-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-173-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-174-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-175-0x0000000002730000-0x0000000002740000-memory.dmp

          Filesize

          64KB

        • memory/3184-176-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-177-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-178-0x0000000002730000-0x0000000002740000-memory.dmp

          Filesize

          64KB

        • memory/3184-179-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-181-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-183-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-185-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-187-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-188-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-189-0x0000000002730000-0x0000000002740000-memory.dmp

          Filesize

          64KB

        • memory/3184-190-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-192-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-193-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-191-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-194-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-196-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-197-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-198-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-199-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-200-0x00000000026F0000-0x0000000002700000-memory.dmp

          Filesize

          64KB

        • memory/3184-201-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-202-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-203-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-205-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-204-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-207-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-210-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-209-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-211-0x00000000026F0000-0x0000000002700000-memory.dmp

          Filesize

          64KB

        • memory/3184-212-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-213-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-215-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-217-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-152-0x0000000002610000-0x0000000002626000-memory.dmp

          Filesize

          88KB

        • memory/3184-221-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-219-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-223-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-224-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-225-0x00000000026F0000-0x0000000002700000-memory.dmp

          Filesize

          64KB

        • memory/3184-226-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-229-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-228-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-162-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-230-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-232-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-231-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-233-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-234-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-235-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-237-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-236-0x00000000009B0000-0x00000000009C0000-memory.dmp

          Filesize

          64KB

        • memory/3184-238-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-239-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-241-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-240-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-243-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-242-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-245-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-246-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-247-0x00000000009C0000-0x00000000009D0000-memory.dmp

          Filesize

          64KB

        • memory/3184-248-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-250-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-252-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-254-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-251-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-249-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-256-0x00000000009B0000-0x00000000009C0000-memory.dmp

          Filesize

          64KB

        • memory/3184-255-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-258-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-259-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-260-0x00000000009C0000-0x00000000009D0000-memory.dmp

          Filesize

          64KB

        • memory/3184-261-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-263-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-265-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-267-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-269-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-272-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-274-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-276-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-277-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-283-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-164-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-163-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/3184-166-0x0000000002700000-0x0000000002710000-memory.dmp

          Filesize

          64KB

        • memory/4788-145-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4788-146-0x0000000001660000-0x0000000002DF1000-memory.dmp

          Filesize

          23.6MB

        • memory/4788-147-0x0000000001660000-0x0000000002DF1000-memory.dmp

          Filesize

          23.6MB

        • memory/4788-148-0x0000000077078000-0x0000000077079000-memory.dmp

          Filesize

          4KB

        • memory/4788-150-0x0000000001660000-0x0000000002DF1000-memory.dmp

          Filesize

          23.6MB

        • memory/4788-149-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4788-151-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4788-153-0x0000000001660000-0x0000000002DF1000-memory.dmp

          Filesize

          23.6MB

        • memory/4788-156-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/4788-157-0x0000000076FF1000-0x0000000077111000-memory.dmp

          Filesize

          1.1MB