Analysis
- max time kernel
51s - max time network
77s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system - submitted
02/08/2023, 09:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1665ef03c15113763716644a5e89f5c0.exe
Resource
win7-20230712-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
1665ef03c15113763716644a5e89f5c0.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 1665ef03c15113763716644a5e89f5c0.exe
- Size 297KB
- Sample230802-k4gassfa4v
- SHA256 e1cd0fe76134275aaccb166d23a7eb8f18079ddc551fad4ee6c1b9b9abe2aa62
- MD5 1665ef03c15113763716644a5e89f5c0
- SHA1 18a165e5e6a3706adb85c34775cb2d7c1b66b7b7
- SHA512 0f3f226d8e07f157d2aed0fccb230f9bf169faa26f4436abfa77ae40c116d10d8d227e5e48fdf15e576575783f1965f0c4a0fa2b22f3ffa5aae1a8577ea36d43
- SSDEEP 3072:ORFR7Whx1PWdBUjf8CnsHgW/fprqHdn0KP0D4EICtuGRL8slAIBA:EFhy1PWdqJWLUecwtdRLTb
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Botnet
-
pub1
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://host-file-host6.com/
-
http://host-host-file8.com/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Executes dropped EXE 1 IoCs
pid Process 1828 dhacuhf - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2028 set thread context of 1500 2028 1665ef03c15113763716644a5e89f5c0.exe 85 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1500 1665ef03c15113763716644a5e89f5c0.exe 1500 1665ef03c15113763716644a5e89f5c0.exe 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1500 1665ef03c15113763716644a5e89f5c0.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2028 wrote to memory of 1500 2028 1665ef03c15113763716644a5e89f5c0.exe 85 PID 2028 wrote to memory of 1500 2028 1665ef03c15113763716644a5e89f5c0.exe 85 PID 2028 wrote to memory of 1500 2028 1665ef03c15113763716644a5e89f5c0.exe 85 PID 2028 wrote to memory of 1500 2028 1665ef03c15113763716644a5e89f5c0.exe 85 PID 2028 wrote to memory of 1500 2028 1665ef03c15113763716644a5e89f5c0.exe 85 PID 2028 wrote to memory of 1500 2028 1665ef03c15113763716644a5e89f5c0.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\1665ef03c15113763716644a5e89f5c0.exe"C:\Users\Admin\AppData\Local\Temp\1665ef03c15113763716644a5e89f5c0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\1665ef03c15113763716644a5e89f5c0.exe"C:\Users\Admin\AppData\Local\Temp\1665ef03c15113763716644a5e89f5c0.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1500
-
-
C:\Users\Admin\AppData\Roaming\dhacuhfC:\Users\Admin\AppData\Roaming\dhacuhf1⤵
- Executes dropped EXE
PID:1828
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\dhacuhf
- Size 297KB
- SHA256 e1cd0fe76134275aaccb166d23a7eb8f18079ddc551fad4ee6c1b9b9abe2aa62
- MD5 1665ef03c15113763716644a5e89f5c0
- SHA1 18a165e5e6a3706adb85c34775cb2d7c1b66b7b7
- SHA512 0f3f226d8e07f157d2aed0fccb230f9bf169faa26f4436abfa77ae40c116d10d8d227e5e48fdf15e576575783f1965f0c4a0fa2b22f3ffa5aae1a8577ea36d43
- SSDEEP 3072:ORFR7Whx1PWdBUjf8CnsHgW/fprqHdn0KP0D4EICtuGRL8slAIBA:EFhy1PWdqJWLUecwtdRLTb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\dhacuhf
- Size 297KB
- SHA256 e1cd0fe76134275aaccb166d23a7eb8f18079ddc551fad4ee6c1b9b9abe2aa62
- MD5 1665ef03c15113763716644a5e89f5c0
- SHA1 18a165e5e6a3706adb85c34775cb2d7c1b66b7b7
- SHA512 0f3f226d8e07f157d2aed0fccb230f9bf169faa26f4436abfa77ae40c116d10d8d227e5e48fdf15e576575783f1965f0c4a0fa2b22f3ffa5aae1a8577ea36d43
- SSDEEP 3072:ORFR7Whx1PWdBUjf8CnsHgW/fprqHdn0KP0D4EICtuGRL8slAIBA:EFhy1PWdqJWLUecwtdRLTb
- MD5 SHA1 SHA512 SSDEEP