Analysis
-
max time kernel
300s -
max time network
245s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
21/08/2023, 04:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
93730fef8a179f6de5590fec1692ec641df48ad487578c21a67c2e96f6c81078.exe
Resource
win7-20230712-en
windows7-x64
12 signatures
300 seconds
Behavioral task
behavioral2
Sample
93730fef8a179f6de5590fec1692ec641df48ad487578c21a67c2e96f6c81078.exe
Resource
win10-20230703-en
windows10-1703-x64
8 signatures
300 seconds
General
-
Target
93730fef8a179f6de5590fec1692ec641df48ad487578c21a67c2e96f6c81078.exe
-
Size
257KB
-
MD5
d25f3d17038e3475825503c8b953a89a
-
SHA1
bb83caa23ecb99a01f710b1bb235d2c8296d229e
-
SHA256
93730fef8a179f6de5590fec1692ec641df48ad487578c21a67c2e96f6c81078
-
SHA512
cde45d1c9bb3b403ad0ce0a6fdc5b8fc9c824ac09c166782549b8a923be6e9e7807a3cc51e20824e07d0cae088b2384dab455db5f24efb2f540fa0541b15321c
-
SSDEEP
3072:dgzjUmqTA08rI6EYV5iSpCTo80FDoghYNYHZ2ixsJgOlsFu23fMZSGsiZZ:qzMAm6E65iS4c80FDoTQ2TxsR+
Score
10/10
Malware Config
Extracted
Family
smokeloader
Botnet
pub1
Extracted
Family
smokeloader
Version
2020
C2
http://host-file-host6.com/
http://host-host-file8.com/
rc4.i32
rc4.i32
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
pid Process 3284 Process not Found -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4896 set thread context of 2008 4896 93730fef8a179f6de5590fec1692ec641df48ad487578c21a67c2e96f6c81078.exe 69 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2008 93730fef8a179f6de5590fec1692ec641df48ad487578c21a67c2e96f6c81078.exe 2008 93730fef8a179f6de5590fec1692ec641df48ad487578c21a67c2e96f6c81078.exe 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found 3284 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3284 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2008 93730fef8a179f6de5590fec1692ec641df48ad487578c21a67c2e96f6c81078.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 3284 Process not Found Token: SeCreatePagefilePrivilege 3284 Process not Found -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4896 wrote to memory of 2008 4896 93730fef8a179f6de5590fec1692ec641df48ad487578c21a67c2e96f6c81078.exe 69 PID 4896 wrote to memory of 2008 4896 93730fef8a179f6de5590fec1692ec641df48ad487578c21a67c2e96f6c81078.exe 69 PID 4896 wrote to memory of 2008 4896 93730fef8a179f6de5590fec1692ec641df48ad487578c21a67c2e96f6c81078.exe 69 PID 4896 wrote to memory of 2008 4896 93730fef8a179f6de5590fec1692ec641df48ad487578c21a67c2e96f6c81078.exe 69 PID 4896 wrote to memory of 2008 4896 93730fef8a179f6de5590fec1692ec641df48ad487578c21a67c2e96f6c81078.exe 69 PID 4896 wrote to memory of 2008 4896 93730fef8a179f6de5590fec1692ec641df48ad487578c21a67c2e96f6c81078.exe 69
Processes
-
C:\Users\Admin\AppData\Local\Temp\93730fef8a179f6de5590fec1692ec641df48ad487578c21a67c2e96f6c81078.exe"C:\Users\Admin\AppData\Local\Temp\93730fef8a179f6de5590fec1692ec641df48ad487578c21a67c2e96f6c81078.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\93730fef8a179f6de5590fec1692ec641df48ad487578c21a67c2e96f6c81078.exe"C:\Users\Admin\AppData\Local\Temp\93730fef8a179f6de5590fec1692ec641df48ad487578c21a67c2e96f6c81078.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2008
-