Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
18-07-2023 13:33
General
-
Target
0x000a000000015dad-102.exe
-
Size
31KB
-
MD5
2f15badba6517410d55efa1738f8af01
-
SHA1
93259c2a88beb2efd789d2e175bb80550e73d3ad
-
SHA256
f0411dadb92a7778d5e59d3226cef80bdab49e4796b524bbe13340826d30eb7c
-
SHA512
e7e3a984e08c2c5a3ed4ee99f4f176219ae72ce38963a58d7a4505cbd82db2309742e2f61514755dbc621815ce2b8055c4f06a3a9f38eaa2cf0e86b755e8986e
-
SSDEEP
384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW
Malware Config
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0x000a000000015dad-102.exe"C:\Users\Admin\AppData\Local\Temp\0x000a000000015dad-102.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\C87D.exeC:\Users\Admin\AppData\Local\Temp\C87D.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" D0AJh326.Z -u /S2⤵
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD57c4a46869ed0e4588a6fd23e89c86047
SHA17e9051c778daf60b41490ae3a0742ed4925c0d99
SHA256c867a6d13e2233abf668ac0e45f6af7ba42f2d117dd366305472583f7fdc28d8
SHA512273141e428ca54b49d395a23be763235b8c0e8b281f7aa46e3ac3c20ebe7f02114313e96c8571da072932d2aefac7f75c4d7b4d8c79395c68a25dc741ee859b6
-
Filesize
1.6MB
MD57c4a46869ed0e4588a6fd23e89c86047
SHA17e9051c778daf60b41490ae3a0742ed4925c0d99
SHA256c867a6d13e2233abf668ac0e45f6af7ba42f2d117dd366305472583f7fdc28d8
SHA512273141e428ca54b49d395a23be763235b8c0e8b281f7aa46e3ac3c20ebe7f02114313e96c8571da072932d2aefac7f75c4d7b4d8c79395c68a25dc741ee859b6
-
Filesize
1.2MB
MD53f2cd23169b63303dcfbd484c0c5cdd6
SHA1af577ae55bc251d342bd6d23f601b04c53b8688c
SHA25693a97d033e2e58aad3b30fca437937bc555b484254cbdccf03c98fe047ff5373
SHA5123c54e3024cd4141287bfcf51e3c08daa8c094df9d620b0f6c8bd890adcc79d6c66a87435b4e90782f73fb3c93ff5bf20163feb4af4dea691433e9d86ca8b478f
-
Filesize
1.2MB
MD53f2cd23169b63303dcfbd484c0c5cdd6
SHA1af577ae55bc251d342bd6d23f601b04c53b8688c
SHA25693a97d033e2e58aad3b30fca437937bc555b484254cbdccf03c98fe047ff5373
SHA5123c54e3024cd4141287bfcf51e3c08daa8c094df9d620b0f6c8bd890adcc79d6c66a87435b4e90782f73fb3c93ff5bf20163feb4af4dea691433e9d86ca8b478f
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
24KB
-
Filesize
1.1MB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
88KB
-
Filesize
36KB
-
Filesize
36KB