Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    16/07/2023, 21:58

General

  • Target

    tmp.exe

  • Size

    703KB

  • MD5

    a8a27695f1bc25512354f2c6b5e9d037

  • SHA1

    d39c5146f3560a6d55657eaa384a8794e25c97ad

  • SHA256

    4365ff3c93ee1faa413ab7cf6838884c449053479d3039e995a6cdfe590125e4

  • SHA512

    58e1eb8588514730e5727c684839f35e45390c429e52514d8394d607a332cc8b3be7a733f3dbc856c696d55607d1073289c8dca2d0bc30d1c46de640c262a913

  • SSDEEP

    12288:/fyw2ahjxbe1SORR84Rl7hChlA4aEISAe43v:/6NanbivDChdrnXm

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://cletonmy.com/

http://alpatrik.com/

rc4.i32
rc4.i32

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Checks QEMU agent file 2 TTPs 4 IoCs

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 6 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Checks QEMU agent file
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1980
    • C:\Users\Admin\AppData\Local\Temp\tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
      2⤵
      • Checks QEMU agent file
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:664
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {1D83D415-1225-42F7-AC1D-6626401AAB34} S-1-5-21-4219371764-2579186923-3390623117-1000:NVACMPYA\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2736
    • C:\Users\Admin\AppData\Roaming\adrbfid
      C:\Users\Admin\AppData\Roaming\adrbfid
      2⤵
      • Checks QEMU agent file
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1548
      • C:\Users\Admin\AppData\Roaming\adrbfid
        C:\Users\Admin\AppData\Roaming\adrbfid
        3⤵
        • Checks QEMU agent file
        • Loads dropped DLL
        • Suspicious use of NtCreateThreadExHideFromDebugger
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        PID:1452

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\nsu3583.tmp\System.dll

          Filesize

          11KB

          MD5

          375e8a08471dc6f85f3828488b1147b3

          SHA1

          1941484ac710fc301a7d31d6f1345e32a21546af

          SHA256

          4c86b238e64ecfaabe322a70fd78db229a663ccc209920f3385596a6e3205f78

          SHA512

          5ba29db13723ddf27b265a4548606274b850d076ae1f050c64044f8ccd020585ad766c85c3e20003a22f356875f76fb3679c89547b0962580d8e5a42b082b9a8

        • C:\Users\Admin\AppData\Roaming\adrbfid

          Filesize

          703KB

          MD5

          a8a27695f1bc25512354f2c6b5e9d037

          SHA1

          d39c5146f3560a6d55657eaa384a8794e25c97ad

          SHA256

          4365ff3c93ee1faa413ab7cf6838884c449053479d3039e995a6cdfe590125e4

          SHA512

          58e1eb8588514730e5727c684839f35e45390c429e52514d8394d607a332cc8b3be7a733f3dbc856c696d55607d1073289c8dca2d0bc30d1c46de640c262a913

        • C:\Users\Admin\AppData\Roaming\adrbfid

          Filesize

          703KB

          MD5

          a8a27695f1bc25512354f2c6b5e9d037

          SHA1

          d39c5146f3560a6d55657eaa384a8794e25c97ad

          SHA256

          4365ff3c93ee1faa413ab7cf6838884c449053479d3039e995a6cdfe590125e4

          SHA512

          58e1eb8588514730e5727c684839f35e45390c429e52514d8394d607a332cc8b3be7a733f3dbc856c696d55607d1073289c8dca2d0bc30d1c46de640c262a913

        • C:\Users\Admin\AppData\Roaming\adrbfid

          Filesize

          703KB

          MD5

          a8a27695f1bc25512354f2c6b5e9d037

          SHA1

          d39c5146f3560a6d55657eaa384a8794e25c97ad

          SHA256

          4365ff3c93ee1faa413ab7cf6838884c449053479d3039e995a6cdfe590125e4

          SHA512

          58e1eb8588514730e5727c684839f35e45390c429e52514d8394d607a332cc8b3be7a733f3dbc856c696d55607d1073289c8dca2d0bc30d1c46de640c262a913

        • \Users\Admin\AppData\Local\Temp\nsj875A.tmp\System.dll

          Filesize

          11KB

          MD5

          375e8a08471dc6f85f3828488b1147b3

          SHA1

          1941484ac710fc301a7d31d6f1345e32a21546af

          SHA256

          4c86b238e64ecfaabe322a70fd78db229a663ccc209920f3385596a6e3205f78

          SHA512

          5ba29db13723ddf27b265a4548606274b850d076ae1f050c64044f8ccd020585ad766c85c3e20003a22f356875f76fb3679c89547b0962580d8e5a42b082b9a8

        • \Users\Admin\AppData\Local\Temp\nsu3583.tmp\System.dll

          Filesize

          11KB

          MD5

          375e8a08471dc6f85f3828488b1147b3

          SHA1

          1941484ac710fc301a7d31d6f1345e32a21546af

          SHA256

          4c86b238e64ecfaabe322a70fd78db229a663ccc209920f3385596a6e3205f78

          SHA512

          5ba29db13723ddf27b265a4548606274b850d076ae1f050c64044f8ccd020585ad766c85c3e20003a22f356875f76fb3679c89547b0962580d8e5a42b082b9a8

        • memory/664-70-0x0000000000400000-0x0000000001462000-memory.dmp

          Filesize

          16.4MB

        • memory/664-73-0x0000000000400000-0x0000000001462000-memory.dmp

          Filesize

          16.4MB

        • memory/664-74-0x0000000001470000-0x0000000002C01000-memory.dmp

          Filesize

          23.6MB

        • memory/664-75-0x0000000000400000-0x0000000001462000-memory.dmp

          Filesize

          16.4MB

        • memory/664-77-0x0000000001470000-0x0000000002C01000-memory.dmp

          Filesize

          23.6MB

        • memory/664-80-0x0000000000400000-0x0000000001462000-memory.dmp

          Filesize

          16.4MB

        • memory/664-72-0x0000000001470000-0x0000000002C01000-memory.dmp

          Filesize

          23.6MB

        • memory/664-69-0x00000000773F0000-0x0000000077599000-memory.dmp

          Filesize

          1.7MB

        • memory/664-68-0x0000000001470000-0x0000000002C01000-memory.dmp

          Filesize

          23.6MB

        • memory/664-67-0x0000000000400000-0x0000000001462000-memory.dmp

          Filesize

          16.4MB

        • memory/1328-76-0x0000000003A30000-0x0000000003A46000-memory.dmp

          Filesize

          88KB

        • memory/1452-106-0x0000000000400000-0x0000000001462000-memory.dmp

          Filesize

          16.4MB

        • memory/1452-107-0x0000000001470000-0x0000000002C01000-memory.dmp

          Filesize

          23.6MB

        • memory/1452-115-0x0000000001470000-0x0000000002C01000-memory.dmp

          Filesize

          23.6MB

        • memory/1452-113-0x0000000001470000-0x0000000002C01000-memory.dmp

          Filesize

          23.6MB

        • memory/1452-112-0x0000000001470000-0x0000000002C01000-memory.dmp

          Filesize

          23.6MB

        • memory/1452-109-0x0000000000400000-0x0000000001462000-memory.dmp

          Filesize

          16.4MB

        • memory/1452-108-0x00000000773F0000-0x0000000077599000-memory.dmp

          Filesize

          1.7MB

        • memory/1548-102-0x0000000003870000-0x0000000005001000-memory.dmp

          Filesize

          23.6MB

        • memory/1548-104-0x0000000010000000-0x0000000010006000-memory.dmp

          Filesize

          24KB

        • memory/1548-103-0x00000000773F0000-0x0000000077599000-memory.dmp

          Filesize

          1.7MB

        • memory/1980-66-0x0000000010000000-0x0000000010006000-memory.dmp

          Filesize

          24KB

        • memory/1980-62-0x0000000003960000-0x00000000050F1000-memory.dmp

          Filesize

          23.6MB

        • memory/1980-65-0x00000000775E0000-0x00000000776B6000-memory.dmp

          Filesize

          856KB

        • memory/1980-63-0x0000000003960000-0x00000000050F1000-memory.dmp

          Filesize

          23.6MB

        • memory/1980-64-0x00000000773F0000-0x0000000077599000-memory.dmp

          Filesize

          1.7MB