Analysis

  • max time kernel
    150s
  • max time network
    133s
  • platform
    windows10-1703_x64
  • resource
    win10-20230915-en
  • resource tags

    arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
  • submitted
    16/09/2023, 08:40

General

  • Target

    2be6a54749de59590faea64558a1d390d29e450bcb75606d7a203ae8d5f78543.exe

  • Size

    277KB

  • MD5

    a0e989bfc13652a11790d78817625113

  • SHA1

    fcc68565d33c7756c36132d7b7fb7ebe57b230d9

  • SHA256

    2be6a54749de59590faea64558a1d390d29e450bcb75606d7a203ae8d5f78543

  • SHA512

    3c347f640e5896a93e959758ae2be0a0300cc256660e3758e0958486a606c31fd138a01ef506099687b4ce03297b8eacd8e44e95f367e935604f0cf87f01b43b

  • SSDEEP

    3072:ZQcF0kPNK1h5A2OshCkI5lkn684umGjLDySF9WlpXKRGW:ZlFPNKH/1CVjkn68AGj3l3WlJ

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2be6a54749de59590faea64558a1d390d29e450bcb75606d7a203ae8d5f78543.exe
    "C:\Users\Admin\AppData\Local\Temp\2be6a54749de59590faea64558a1d390d29e450bcb75606d7a203ae8d5f78543.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3048
    • C:\Users\Admin\AppData\Local\Temp\2be6a54749de59590faea64558a1d390d29e450bcb75606d7a203ae8d5f78543.exe
      "C:\Users\Admin\AppData\Local\Temp\2be6a54749de59590faea64558a1d390d29e450bcb75606d7a203ae8d5f78543.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:964

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/964-3-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

        • memory/964-4-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

        • memory/964-5-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

        • memory/964-7-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

        • memory/3048-1-0x0000000000970000-0x0000000000A70000-memory.dmp

          Filesize

          1024KB

        • memory/3048-2-0x0000000000960000-0x0000000000969000-memory.dmp

          Filesize

          36KB

        • memory/3232-6-0x0000000000B60000-0x0000000000B76000-memory.dmp

          Filesize

          88KB

        • memory/3232-16-0x0000000000B50000-0x0000000000B60000-memory.dmp

          Filesize

          64KB

        • memory/3232-17-0x0000000000B50000-0x0000000000B60000-memory.dmp

          Filesize

          64KB

        • memory/3232-19-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-21-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-22-0x0000000002510000-0x0000000002520000-memory.dmp

          Filesize

          64KB

        • memory/3232-24-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-25-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-27-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-28-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-29-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-31-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-30-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-33-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-34-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-36-0x00000000028C0000-0x00000000028D0000-memory.dmp

          Filesize

          64KB

        • memory/3232-38-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-40-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-41-0x00000000028C0000-0x00000000028D0000-memory.dmp

          Filesize

          64KB

        • memory/3232-43-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-45-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-49-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-47-0x0000000002510000-0x0000000002520000-memory.dmp

          Filesize

          64KB

        • memory/3232-46-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-51-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-52-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-54-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-55-0x00000000028C0000-0x00000000028D0000-memory.dmp

          Filesize

          64KB

        • memory/3232-57-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-59-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-58-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-61-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-60-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-63-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-64-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-65-0x0000000000B50000-0x0000000000B60000-memory.dmp

          Filesize

          64KB

        • memory/3232-66-0x0000000000B50000-0x0000000000B60000-memory.dmp

          Filesize

          64KB

        • memory/3232-67-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-69-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-70-0x00000000028C0000-0x00000000028D0000-memory.dmp

          Filesize

          64KB

        • memory/3232-72-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-73-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-74-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-76-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-75-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-78-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-81-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-80-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-83-0x00000000028C0000-0x00000000028D0000-memory.dmp

          Filesize

          64KB

        • memory/3232-85-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-87-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-88-0x00000000028C0000-0x00000000028D0000-memory.dmp

          Filesize

          64KB

        • memory/3232-90-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-92-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-94-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-98-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-97-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-95-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-100-0x00000000028C0000-0x00000000028D0000-memory.dmp

          Filesize

          64KB

        • memory/3232-104-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-105-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-103-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-102-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-106-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-108-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB

        • memory/3232-109-0x0000000002500000-0x0000000002510000-memory.dmp

          Filesize

          64KB