Analysis
-
max time kernel
300s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
05-08-2023 04:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d8bdb32cb558ab6bfac8f7b3525475297e90779b55e437222ccd77ff15b8b8ce.exe
Resource
win7-20230712-en
windows7-x64
10 signatures
300 seconds
Behavioral task
behavioral2
Sample
d8bdb32cb558ab6bfac8f7b3525475297e90779b55e437222ccd77ff15b8b8ce.exe
Resource
win10-20230703-en
windows10-1703-x64
8 signatures
300 seconds
General
-
Target
d8bdb32cb558ab6bfac8f7b3525475297e90779b55e437222ccd77ff15b8b8ce.exe
-
Size
305KB
-
MD5
c84ded775d454fc674c6385a58a8112d
-
SHA1
ce5e15cbeb241bcb62780824df8889e8d0386d35
-
SHA256
d8bdb32cb558ab6bfac8f7b3525475297e90779b55e437222ccd77ff15b8b8ce
-
SHA512
70840e026b2f5add74dede5000b8c9eaca4e5092046c324329bac8c83819b5f4e29d7ecaea9fcac5e21f6d5178e89149cc4c16d3d3f058d7d68c98afa1222336
-
SSDEEP
3072:h1PbkQZ5uZhLib8HmWxo0kSDAZW5bFERbdTJkmGTj3YD5G:/bk5Msm+kScM5RmbdTemGv3Y
Score
10/10
Malware Config
Extracted
Family
smokeloader
Botnet
up3
Extracted
Family
smokeloader
Version
2020
C2
http://host-file-host6.com/
http://host-host-file8.com/
rc4.i32
rc4.i32
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
pid Process 1164 Process not Found -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2156 set thread context of 2472 2156 d8bdb32cb558ab6bfac8f7b3525475297e90779b55e437222ccd77ff15b8b8ce.exe 28 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2472 d8bdb32cb558ab6bfac8f7b3525475297e90779b55e437222ccd77ff15b8b8ce.exe 2472 d8bdb32cb558ab6bfac8f7b3525475297e90779b55e437222ccd77ff15b8b8ce.exe 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found 1164 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1164 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2472 d8bdb32cb558ab6bfac8f7b3525475297e90779b55e437222ccd77ff15b8b8ce.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 1164 Process not Found -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1164 Process not Found 1164 Process not Found -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1164 Process not Found 1164 Process not Found -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2156 wrote to memory of 2472 2156 d8bdb32cb558ab6bfac8f7b3525475297e90779b55e437222ccd77ff15b8b8ce.exe 28 PID 2156 wrote to memory of 2472 2156 d8bdb32cb558ab6bfac8f7b3525475297e90779b55e437222ccd77ff15b8b8ce.exe 28 PID 2156 wrote to memory of 2472 2156 d8bdb32cb558ab6bfac8f7b3525475297e90779b55e437222ccd77ff15b8b8ce.exe 28 PID 2156 wrote to memory of 2472 2156 d8bdb32cb558ab6bfac8f7b3525475297e90779b55e437222ccd77ff15b8b8ce.exe 28 PID 2156 wrote to memory of 2472 2156 d8bdb32cb558ab6bfac8f7b3525475297e90779b55e437222ccd77ff15b8b8ce.exe 28 PID 2156 wrote to memory of 2472 2156 d8bdb32cb558ab6bfac8f7b3525475297e90779b55e437222ccd77ff15b8b8ce.exe 28 PID 2156 wrote to memory of 2472 2156 d8bdb32cb558ab6bfac8f7b3525475297e90779b55e437222ccd77ff15b8b8ce.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8bdb32cb558ab6bfac8f7b3525475297e90779b55e437222ccd77ff15b8b8ce.exe"C:\Users\Admin\AppData\Local\Temp\d8bdb32cb558ab6bfac8f7b3525475297e90779b55e437222ccd77ff15b8b8ce.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\d8bdb32cb558ab6bfac8f7b3525475297e90779b55e437222ccd77ff15b8b8ce.exe"C:\Users\Admin\AppData\Local\Temp\d8bdb32cb558ab6bfac8f7b3525475297e90779b55e437222ccd77ff15b8b8ce.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2472
-