Overview

overview

10

Static

static

1

a8a27695f1...37.exe

windows7-x64

10

a8a27695f1...37.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-07-2023 02:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a8a27695f1bc25512354f2c6b5e9d037.exe

  • Size

    703KB

  • MD5

    a8a27695f1bc25512354f2c6b5e9d037

  • SHA1

    d39c5146f3560a6d55657eaa384a8794e25c97ad

  • SHA256

    4365ff3c93ee1faa413ab7cf6838884c449053479d3039e995a6cdfe590125e4

  • SHA512

    58e1eb8588514730e5727c684839f35e45390c429e52514d8394d607a332cc8b3be7a733f3dbc856c696d55607d1073289c8dca2d0bc30d1c46de640c262a913

  • SSDEEP

    12288:/fyw2ahjxbe1SORR84Rl7hChlA4aEISAe43v:/6NanbivDChdrnXm

Score
10/10
guloadersmokeloaderbackdoordiscoverydownloadertrojan

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://cletonmy.com/

http://alpatrik.com/
rc4.i32
rc4.i32

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Checks QEMU agent file 2 TTPs 2 IoCs

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\a8a27695f1bc25512354f2c6b5e9d037.exe
    "C:\Users\Admin\AppData\Local\Temp\a8a27695f1bc25512354f2c6b5e9d037.exe"
    1⤵
    • Checks QEMU agent file
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2068
    • C:\Users\Admin\AppData\Local\Temp\a8a27695f1bc25512354f2c6b5e9d037.exe
      "C:\Users\Admin\AppData\Local\Temp\a8a27695f1bc25512354f2c6b5e9d037.exe"
      2⤵
      • Checks QEMU agent file
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:564

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsfD3AC.tmp\System.dll
    Filesize

    11KB

    MD5

    375e8a08471dc6f85f3828488b1147b3

    SHA1

    1941484ac710fc301a7d31d6f1345e32a21546af

    SHA256

    4c86b238e64ecfaabe322a70fd78db229a663ccc209920f3385596a6e3205f78

    SHA512

    5ba29db13723ddf27b265a4548606274b850d076ae1f050c64044f8ccd020585ad766c85c3e20003a22f356875f76fb3679c89547b0962580d8e5a42b082b9a8

    Download Submit

  • memory/564-152-0x0000000000400000-0x0000000001654000-memory.dmp

    Filesize

    18.3MB

    Download

  • memory/564-147-0x0000000001660000-0x0000000002DF1000-memory.dmp

    Filesize

    23.6MB

    Download

  • memory/564-159-0x0000000077011000-0x0000000077131000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/564-157-0x0000000000400000-0x0000000001654000-memory.dmp

    Filesize

    18.3MB

    Download

  • memory/564-149-0x0000000077098000-0x0000000077099000-memory.dmp

    Filesize

    4KB

    Download

  • memory/564-146-0x0000000000400000-0x0000000001654000-memory.dmp

    Filesize

    18.3MB

    Download

  • memory/564-154-0x0000000001660000-0x0000000002DF1000-memory.dmp

    Filesize

    23.6MB

    Download

  • memory/564-148-0x0000000001660000-0x0000000002DF1000-memory.dmp

    Filesize

    23.6MB

    Download

  • memory/564-151-0x0000000001660000-0x0000000002DF1000-memory.dmp

    Filesize

    23.6MB

    Download

  • memory/564-150-0x0000000000400000-0x0000000001654000-memory.dmp

    Filesize

    18.3MB

    Download

  • memory/2068-145-0x0000000010000000-0x0000000010006000-memory.dmp

    Filesize

    24KB

    Download

  • memory/2068-141-0x0000000004A50000-0x00000000061E1000-memory.dmp

    Filesize

    23.6MB

    Download

  • memory/2068-142-0x0000000004A50000-0x00000000061E1000-memory.dmp

    Filesize

    23.6MB

    Download

  • memory/2068-144-0x0000000077011000-0x0000000077131000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2068-143-0x0000000077011000-0x0000000077131000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/3164-153-0x0000000003630000-0x0000000003646000-memory.dmp

    Filesize

    88KB

    Download