Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
21-07-2023 01:00
General
-
Target
99c0cf1dd3e620333c751d7b28d85d76c239c7fafcdaa71aeda4dc9b76c77145.exe
-
Size
30KB
-
MD5
01097d203000288cc8ef629b9b830dd2
-
SHA1
c6eec303a933ce067f5d8ac49c6efb21f61142e6
-
SHA256
99c0cf1dd3e620333c751d7b28d85d76c239c7fafcdaa71aeda4dc9b76c77145
-
SHA512
8fc00b2bd23606edeee5fd48b51f62245e491698c88461889c2fd79b60ab3e9bdb540beb4c34716d88d83806868619f5af6455742fe585959dbf26541e808afb
-
SSDEEP
384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW
Malware Config
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 22 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\99c0cf1dd3e620333c751d7b28d85d76c239c7fafcdaa71aeda4dc9b76c77145.exe"C:\Users\Admin\AppData\Local\Temp\99c0cf1dd3e620333c751d7b28d85d76c239c7fafcdaa71aeda4dc9b76c77145.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\25DD.exeC:\Users\Admin\AppData\Local\Temp\25DD.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\control.exe"C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\AZUAWK.CPL",2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\AZUAWK.CPL",3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\AZUAWK.CPL",4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\AZUAWK.CPL",5⤵
- Loads dropped DLL
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD5985f48adeb0b295a4975f767303e2a09
SHA189709c33a4fb3683b4932bbd93f0857bfdd746e3
SHA2561bbe3ed2b3cbc696f1ffdf45dd12b02f367ff165e5ffe12bb3efb82104817eea
SHA5125e105ab03e00ec9b91d7efc65fdc786cc6be2d10f8f7d9d4caa3742c4fae6c6085dc789f2ccb3320c59bc31bbabf2f06161e43a18490b07c5095566746729832
-
Filesize
1.5MB
MD5985f48adeb0b295a4975f767303e2a09
SHA189709c33a4fb3683b4932bbd93f0857bfdd746e3
SHA2561bbe3ed2b3cbc696f1ffdf45dd12b02f367ff165e5ffe12bb3efb82104817eea
SHA5125e105ab03e00ec9b91d7efc65fdc786cc6be2d10f8f7d9d4caa3742c4fae6c6085dc789f2ccb3320c59bc31bbabf2f06161e43a18490b07c5095566746729832
-
Filesize
1.2MB
MD56678ff541ad68a47a8bbbe217ab739f8
SHA13a43e3a903f217b3dae55837877bfa53f6db0019
SHA256f9e2d9fb4044a1025e27eaa3280db5cb042be491edbe29d3c86f543377f99d17
SHA512b9541aa2a54383ba55ce7cce13434d8a82c4d77eda39e8144f903af0ff74a2d8f712ca2abe437b4094b18ec19c3f8a337a15c2fc12c0d14181f35b986f4c4db6
-
Filesize
1.2MB
MD56678ff541ad68a47a8bbbe217ab739f8
SHA13a43e3a903f217b3dae55837877bfa53f6db0019
SHA256f9e2d9fb4044a1025e27eaa3280db5cb042be491edbe29d3c86f543377f99d17
SHA512b9541aa2a54383ba55ce7cce13434d8a82c4d77eda39e8144f903af0ff74a2d8f712ca2abe437b4094b18ec19c3f8a337a15c2fc12c0d14181f35b986f4c4db6
-
Filesize
1.2MB
MD56678ff541ad68a47a8bbbe217ab739f8
SHA13a43e3a903f217b3dae55837877bfa53f6db0019
SHA256f9e2d9fb4044a1025e27eaa3280db5cb042be491edbe29d3c86f543377f99d17
SHA512b9541aa2a54383ba55ce7cce13434d8a82c4d77eda39e8144f903af0ff74a2d8f712ca2abe437b4094b18ec19c3f8a337a15c2fc12c0d14181f35b986f4c4db6
-
Filesize
1.2MB
MD56678ff541ad68a47a8bbbe217ab739f8
SHA13a43e3a903f217b3dae55837877bfa53f6db0019
SHA256f9e2d9fb4044a1025e27eaa3280db5cb042be491edbe29d3c86f543377f99d17
SHA512b9541aa2a54383ba55ce7cce13434d8a82c4d77eda39e8144f903af0ff74a2d8f712ca2abe437b4094b18ec19c3f8a337a15c2fc12c0d14181f35b986f4c4db6
-
Filesize
1.2MB
MD56678ff541ad68a47a8bbbe217ab739f8
SHA13a43e3a903f217b3dae55837877bfa53f6db0019
SHA256f9e2d9fb4044a1025e27eaa3280db5cb042be491edbe29d3c86f543377f99d17
SHA512b9541aa2a54383ba55ce7cce13434d8a82c4d77eda39e8144f903af0ff74a2d8f712ca2abe437b4094b18ec19c3f8a337a15c2fc12c0d14181f35b986f4c4db6
-
Filesize
1.2MB
MD56678ff541ad68a47a8bbbe217ab739f8
SHA13a43e3a903f217b3dae55837877bfa53f6db0019
SHA256f9e2d9fb4044a1025e27eaa3280db5cb042be491edbe29d3c86f543377f99d17
SHA512b9541aa2a54383ba55ce7cce13434d8a82c4d77eda39e8144f903af0ff74a2d8f712ca2abe437b4094b18ec19c3f8a337a15c2fc12c0d14181f35b986f4c4db6
-
Filesize
892KB
-
Filesize
1.2MB
-
Filesize
24KB
-
Filesize
1.2MB
-
Filesize
992KB
-
Filesize
892KB
-
Filesize
892KB
-
Filesize
892KB
-
Filesize
24KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
992KB
-
Filesize
892KB
-
Filesize
892KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
88KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB