Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
20-07-2023 10:26
General
-
Target
0x0007000000015c2d-101.exe
-
Size
32KB
-
MD5
2d91d81ac965bfeb635da7ad8cfe7c65
-
SHA1
44f1d984702dde8f182f6491d71c8912160a8c63
-
SHA256
7fbf96cc89463da90fa962ea3ff11cebd0d742176e669631019787fe9c9e1430
-
SHA512
899f9ba01b937f3dbc5ed38bd4f43a7f91f167841f23ddac6dfc3d8c4ccfae25c169c0bb77aa555b25bdc37f062cda122791211e664846cbc2ce75bb19c55d4b
-
SSDEEP
384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW
Malware Config
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0x0007000000015c2d-101.exe"C:\Users\Admin\AppData\Local\Temp\0x0007000000015c2d-101.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\BB0E.exeC:\Users\Admin\AppData\Local\Temp\BB0E.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" -S .\eJZ6SYMl.6 -u2⤵
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5e0cf69a1bc822e9cf24df2f1daee2ca3
SHA128dc068f9d1dea86f67a6b6f815129f3ef9128f6
SHA256c710785c891834d0b5ad5804efa04c326508bd40d6697d60a56e6cb620977792
SHA512e12762e5a50b5332638f2e68e0d873f2ab65aec89ed37ecda034fa8af2d5ce717badb5a6c8d404e91955bbddd7747d8f4e416383cbcb07bd2cc6a5bf80582ede
-
Filesize
1.6MB
MD5e0cf69a1bc822e9cf24df2f1daee2ca3
SHA128dc068f9d1dea86f67a6b6f815129f3ef9128f6
SHA256c710785c891834d0b5ad5804efa04c326508bd40d6697d60a56e6cb620977792
SHA512e12762e5a50b5332638f2e68e0d873f2ab65aec89ed37ecda034fa8af2d5ce717badb5a6c8d404e91955bbddd7747d8f4e416383cbcb07bd2cc6a5bf80582ede
-
Filesize
1.2MB
MD52651caece5999959da1ccffd43784e23
SHA108954d58a7161c69395ff25362a32c4b0736265c
SHA256ae5a095329e5c9ad8e2c30536e3978b393a871abbda9e5d66f20c82afd9a6378
SHA5125250a6c2d2ee8efaa3b97200623a403f65ffbb9d969efb124c0cd8aa37bb5c242f0fe0c91eba54299baafd60e3d188b5b55a956d1df4e80e047cd35a526db331
-
Filesize
1.2MB
MD52651caece5999959da1ccffd43784e23
SHA108954d58a7161c69395ff25362a32c4b0736265c
SHA256ae5a095329e5c9ad8e2c30536e3978b393a871abbda9e5d66f20c82afd9a6378
SHA5125250a6c2d2ee8efaa3b97200623a403f65ffbb9d969efb124c0cd8aa37bb5c242f0fe0c91eba54299baafd60e3d188b5b55a956d1df4e80e047cd35a526db331
-
Filesize
1.2MB
MD52651caece5999959da1ccffd43784e23
SHA108954d58a7161c69395ff25362a32c4b0736265c
SHA256ae5a095329e5c9ad8e2c30536e3978b393a871abbda9e5d66f20c82afd9a6378
SHA5125250a6c2d2ee8efaa3b97200623a403f65ffbb9d969efb124c0cd8aa37bb5c242f0fe0c91eba54299baafd60e3d188b5b55a956d1df4e80e047cd35a526db331
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
88KB
-
Filesize
1.2MB
-
Filesize
24KB
-
Filesize
1.2MB
-
Filesize
1.0MB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
932KB