Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
05-08-2023 21:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8189c1c7f01185fd55c619bf4ae7fbc49126d649423c4421ad1085248484c218.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
8189c1c7f01185fd55c619bf4ae7fbc49126d649423c4421ad1085248484c218.exe
-
Size
326KB
-
MD5
12c2f5c06632c07d3bfd902f32ad5479
-
SHA1
27d85b01116806eba3554b9e3f1b891add2ca5bb
-
SHA256
8189c1c7f01185fd55c619bf4ae7fbc49126d649423c4421ad1085248484c218
-
SHA512
68d707437bf44f8bce43c735a18a0d32cd8f0d55712ba81fcc5287b09149926664b65b9b86ed62be2bdf121ae50825a3bf0f54c329cdc33139aff6b4614d4c60
-
SSDEEP
3072:tOS5UTiugV/l9Zj5T0S+oKgmnNtpkkltj3eIVa4Ml9T:MnmZdl9zAgmnFk6tze2ve
Score
10/10
Malware Config
Extracted
Family
smokeloader
Botnet
pub1
Extracted
Family
smokeloader
Version
2020
C2
http://host-file-host6.com/
http://host-host-file8.com/
rc4.i32
rc4.i32
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4808 set thread context of 2688 4808 8189c1c7f01185fd55c619bf4ae7fbc49126d649423c4421ad1085248484c218.exe 82 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2688 8189c1c7f01185fd55c619bf4ae7fbc49126d649423c4421ad1085248484c218.exe 2688 8189c1c7f01185fd55c619bf4ae7fbc49126d649423c4421ad1085248484c218.exe 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3136 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2688 8189c1c7f01185fd55c619bf4ae7fbc49126d649423c4421ad1085248484c218.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4808 wrote to memory of 2688 4808 8189c1c7f01185fd55c619bf4ae7fbc49126d649423c4421ad1085248484c218.exe 82 PID 4808 wrote to memory of 2688 4808 8189c1c7f01185fd55c619bf4ae7fbc49126d649423c4421ad1085248484c218.exe 82 PID 4808 wrote to memory of 2688 4808 8189c1c7f01185fd55c619bf4ae7fbc49126d649423c4421ad1085248484c218.exe 82 PID 4808 wrote to memory of 2688 4808 8189c1c7f01185fd55c619bf4ae7fbc49126d649423c4421ad1085248484c218.exe 82 PID 4808 wrote to memory of 2688 4808 8189c1c7f01185fd55c619bf4ae7fbc49126d649423c4421ad1085248484c218.exe 82 PID 4808 wrote to memory of 2688 4808 8189c1c7f01185fd55c619bf4ae7fbc49126d649423c4421ad1085248484c218.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\8189c1c7f01185fd55c619bf4ae7fbc49126d649423c4421ad1085248484c218.exe"C:\Users\Admin\AppData\Local\Temp\8189c1c7f01185fd55c619bf4ae7fbc49126d649423c4421ad1085248484c218.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\8189c1c7f01185fd55c619bf4ae7fbc49126d649423c4421ad1085248484c218.exe"C:\Users\Admin\AppData\Local\Temp\8189c1c7f01185fd55c619bf4ae7fbc49126d649423c4421ad1085248484c218.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2688
-