Analysis

  • max time kernel
    151s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/07/2023, 21:58

General

  • Target

    tmp.exe

  • Size

    703KB

  • MD5

    a8a27695f1bc25512354f2c6b5e9d037

  • SHA1

    d39c5146f3560a6d55657eaa384a8794e25c97ad

  • SHA256

    4365ff3c93ee1faa413ab7cf6838884c449053479d3039e995a6cdfe590125e4

  • SHA512

    58e1eb8588514730e5727c684839f35e45390c429e52514d8394d607a332cc8b3be7a733f3dbc856c696d55607d1073289c8dca2d0bc30d1c46de640c262a913

  • SSDEEP

    12288:/fyw2ahjxbe1SORR84Rl7hChlA4aEISAe43v:/6NanbivDChdrnXm

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://cletonmy.com/

http://alpatrik.com/

rc4.i32
rc4.i32

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Checks QEMU agent file 2 TTPs 3 IoCs

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 6 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Checks QEMU agent file
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:4748
    • C:\Users\Admin\AppData\Local\Temp\tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
      2⤵
      • Checks QEMU agent file
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:5112
  • C:\Users\Admin\AppData\Roaming\fguhvri
    C:\Users\Admin\AppData\Roaming\fguhvri
    1⤵
    • Checks QEMU agent file
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1272
    • C:\Users\Admin\AppData\Roaming\fguhvri
      C:\Users\Admin\AppData\Roaming\fguhvri
      2⤵
      • Loads dropped DLL
      PID:4736

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\nsqAF5B.tmp\System.dll

          Filesize

          11KB

          MD5

          375e8a08471dc6f85f3828488b1147b3

          SHA1

          1941484ac710fc301a7d31d6f1345e32a21546af

          SHA256

          4c86b238e64ecfaabe322a70fd78db229a663ccc209920f3385596a6e3205f78

          SHA512

          5ba29db13723ddf27b265a4548606274b850d076ae1f050c64044f8ccd020585ad766c85c3e20003a22f356875f76fb3679c89547b0962580d8e5a42b082b9a8

        • C:\Users\Admin\AppData\Local\Temp\nsy4A4F.tmp\System.dll

          Filesize

          11KB

          MD5

          375e8a08471dc6f85f3828488b1147b3

          SHA1

          1941484ac710fc301a7d31d6f1345e32a21546af

          SHA256

          4c86b238e64ecfaabe322a70fd78db229a663ccc209920f3385596a6e3205f78

          SHA512

          5ba29db13723ddf27b265a4548606274b850d076ae1f050c64044f8ccd020585ad766c85c3e20003a22f356875f76fb3679c89547b0962580d8e5a42b082b9a8

        • C:\Users\Admin\AppData\Local\Temp\nsy4A4F.tmp\System.dll

          Filesize

          11KB

          MD5

          375e8a08471dc6f85f3828488b1147b3

          SHA1

          1941484ac710fc301a7d31d6f1345e32a21546af

          SHA256

          4c86b238e64ecfaabe322a70fd78db229a663ccc209920f3385596a6e3205f78

          SHA512

          5ba29db13723ddf27b265a4548606274b850d076ae1f050c64044f8ccd020585ad766c85c3e20003a22f356875f76fb3679c89547b0962580d8e5a42b082b9a8

        • C:\Users\Admin\AppData\Roaming\fguhvri

          Filesize

          703KB

          MD5

          a8a27695f1bc25512354f2c6b5e9d037

          SHA1

          d39c5146f3560a6d55657eaa384a8794e25c97ad

          SHA256

          4365ff3c93ee1faa413ab7cf6838884c449053479d3039e995a6cdfe590125e4

          SHA512

          58e1eb8588514730e5727c684839f35e45390c429e52514d8394d607a332cc8b3be7a733f3dbc856c696d55607d1073289c8dca2d0bc30d1c46de640c262a913

        • C:\Users\Admin\AppData\Roaming\fguhvri

          Filesize

          703KB

          MD5

          a8a27695f1bc25512354f2c6b5e9d037

          SHA1

          d39c5146f3560a6d55657eaa384a8794e25c97ad

          SHA256

          4365ff3c93ee1faa413ab7cf6838884c449053479d3039e995a6cdfe590125e4

          SHA512

          58e1eb8588514730e5727c684839f35e45390c429e52514d8394d607a332cc8b3be7a733f3dbc856c696d55607d1073289c8dca2d0bc30d1c46de640c262a913

        • C:\Users\Admin\AppData\Roaming\fguhvri

          Filesize

          703KB

          MD5

          a8a27695f1bc25512354f2c6b5e9d037

          SHA1

          d39c5146f3560a6d55657eaa384a8794e25c97ad

          SHA256

          4365ff3c93ee1faa413ab7cf6838884c449053479d3039e995a6cdfe590125e4

          SHA512

          58e1eb8588514730e5727c684839f35e45390c429e52514d8394d607a332cc8b3be7a733f3dbc856c696d55607d1073289c8dca2d0bc30d1c46de640c262a913

        • memory/1272-180-0x0000000077411000-0x0000000077531000-memory.dmp

          Filesize

          1.1MB

        • memory/1272-179-0x0000000004910000-0x00000000060A1000-memory.dmp

          Filesize

          23.6MB

        • memory/1272-178-0x0000000004910000-0x00000000060A1000-memory.dmp

          Filesize

          23.6MB

        • memory/1272-181-0x0000000010000000-0x0000000010006000-memory.dmp

          Filesize

          24KB

        • memory/3180-154-0x0000000002890000-0x00000000028A6000-memory.dmp

          Filesize

          88KB

        • memory/4736-184-0x0000000001660000-0x0000000002DF1000-memory.dmp

          Filesize

          23.6MB

        • memory/4748-145-0x0000000010000000-0x0000000010006000-memory.dmp

          Filesize

          24KB

        • memory/4748-144-0x0000000077411000-0x0000000077531000-memory.dmp

          Filesize

          1.1MB

        • memory/4748-143-0x0000000077411000-0x0000000077531000-memory.dmp

          Filesize

          1.1MB

        • memory/4748-142-0x0000000004A80000-0x0000000006211000-memory.dmp

          Filesize

          23.6MB

        • memory/4748-141-0x0000000004A80000-0x0000000006211000-memory.dmp

          Filesize

          23.6MB

        • memory/5112-148-0x0000000001660000-0x0000000002DF1000-memory.dmp

          Filesize

          23.6MB

        • memory/5112-160-0x0000000077411000-0x0000000077531000-memory.dmp

          Filesize

          1.1MB

        • memory/5112-158-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/5112-155-0x0000000001660000-0x0000000002DF1000-memory.dmp

          Filesize

          23.6MB

        • memory/5112-153-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/5112-152-0x0000000001660000-0x0000000002DF1000-memory.dmp

          Filesize

          23.6MB

        • memory/5112-151-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/5112-150-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB

        • memory/5112-149-0x0000000077498000-0x0000000077499000-memory.dmp

          Filesize

          4KB

        • memory/5112-147-0x0000000001660000-0x0000000002DF1000-memory.dmp

          Filesize

          23.6MB

        • memory/5112-146-0x0000000000400000-0x0000000001654000-memory.dmp

          Filesize

          18.3MB