Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows10-1703_x64 -
resource
win10-20230915-en -
resource tags
arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system -
submitted
16/09/2023, 08:24
Static task
static1
Behavioral task
behavioral1
Sample
b930bea93919502dfcb97914d628d62939268fdb6caa35de86b88c19f24e2343.exe
Resource
win10-20230915-en
General
-
Target
b930bea93919502dfcb97914d628d62939268fdb6caa35de86b88c19f24e2343.exe
-
Size
272KB
-
MD5
3577b0dcba983f6d767c402b3b1e01ca
-
SHA1
379efa53a1bbcbe37fdac99946b5c5bccd9ca8d1
-
SHA256
b930bea93919502dfcb97914d628d62939268fdb6caa35de86b88c19f24e2343
-
SHA512
8d68c3c79c6139e4a77810318b7a6a69d2ae040c8acfeddd568e6a415ff4ba3d8a640636af9fa3638fe6992a0b22f0c0886ab1e65ac447490bc7c5edfdce6f16
-
SSDEEP
3072:akFQCm7pvjuGW4wHInMG3So8/4BwXWDBRNS4eUivsf7HiYNn:zFypvSGW4wonjh8qwXkNWU8S7Hi+
Malware Config
Extracted
smokeloader
pub1
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
pid Process 3244 Process not Found -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4108 set thread context of 2412 4108 b930bea93919502dfcb97914d628d62939268fdb6caa35de86b88c19f24e2343.exe 70 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI b930bea93919502dfcb97914d628d62939268fdb6caa35de86b88c19f24e2343.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI b930bea93919502dfcb97914d628d62939268fdb6caa35de86b88c19f24e2343.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI b930bea93919502dfcb97914d628d62939268fdb6caa35de86b88c19f24e2343.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2412 b930bea93919502dfcb97914d628d62939268fdb6caa35de86b88c19f24e2343.exe 2412 b930bea93919502dfcb97914d628d62939268fdb6caa35de86b88c19f24e2343.exe 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found 3244 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3244 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2412 b930bea93919502dfcb97914d628d62939268fdb6caa35de86b88c19f24e2343.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeShutdownPrivilege 3244 Process not Found Token: SeCreatePagefilePrivilege 3244 Process not Found Token: SeShutdownPrivilege 3244 Process not Found Token: SeCreatePagefilePrivilege 3244 Process not Found Token: SeShutdownPrivilege 3244 Process not Found Token: SeCreatePagefilePrivilege 3244 Process not Found Token: SeShutdownPrivilege 3244 Process not Found Token: SeCreatePagefilePrivilege 3244 Process not Found Token: SeShutdownPrivilege 3244 Process not Found Token: SeCreatePagefilePrivilege 3244 Process not Found Token: SeShutdownPrivilege 3244 Process not Found Token: SeCreatePagefilePrivilege 3244 Process not Found -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4108 wrote to memory of 2412 4108 b930bea93919502dfcb97914d628d62939268fdb6caa35de86b88c19f24e2343.exe 70 PID 4108 wrote to memory of 2412 4108 b930bea93919502dfcb97914d628d62939268fdb6caa35de86b88c19f24e2343.exe 70 PID 4108 wrote to memory of 2412 4108 b930bea93919502dfcb97914d628d62939268fdb6caa35de86b88c19f24e2343.exe 70 PID 4108 wrote to memory of 2412 4108 b930bea93919502dfcb97914d628d62939268fdb6caa35de86b88c19f24e2343.exe 70 PID 4108 wrote to memory of 2412 4108 b930bea93919502dfcb97914d628d62939268fdb6caa35de86b88c19f24e2343.exe 70 PID 4108 wrote to memory of 2412 4108 b930bea93919502dfcb97914d628d62939268fdb6caa35de86b88c19f24e2343.exe 70 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b930bea93919502dfcb97914d628d62939268fdb6caa35de86b88c19f24e2343.exe"C:\Users\Admin\AppData\Local\Temp\b930bea93919502dfcb97914d628d62939268fdb6caa35de86b88c19f24e2343.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\b930bea93919502dfcb97914d628d62939268fdb6caa35de86b88c19f24e2343.exe"C:\Users\Admin\AppData\Local\Temp\b930bea93919502dfcb97914d628d62939268fdb6caa35de86b88c19f24e2343.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2412
-