Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
21/09/2023, 23:49
Static task
static1
Behavioral task
behavioral1
Sample
a3d27d8b35f72399f5c74c2d80a726a3d8fb1c91d834e02e55cfd2e854cf4645.exe
Resource
win10v2004-20230915-en
General
-
Target
a3d27d8b35f72399f5c74c2d80a726a3d8fb1c91d834e02e55cfd2e854cf4645.exe
-
Size
293KB
-
MD5
b4ff9f65fa41e51f15be0163b5efe03d
-
SHA1
b9d006e3e56be22e84e1702d7b2dd217fdf03e43
-
SHA256
a3d27d8b35f72399f5c74c2d80a726a3d8fb1c91d834e02e55cfd2e854cf4645
-
SHA512
26426cae6f015c3038c18e62b8ebbe8a58d4bec108cd050511992e217ccebad5df0be60cede696c2a4fd123a9a919a2ead8f8be46a62b0afad5d3d295807c402
-
SSDEEP
6144:HcEBSozxjfZnRluPDJe1tq3wAM9odg8Z:HcEAixrNRlcDEPCoL8
Malware Config
Extracted
smokeloader
pub1
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4956 set thread context of 1552 4956 a3d27d8b35f72399f5c74c2d80a726a3d8fb1c91d834e02e55cfd2e854cf4645.exe 85 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a3d27d8b35f72399f5c74c2d80a726a3d8fb1c91d834e02e55cfd2e854cf4645.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a3d27d8b35f72399f5c74c2d80a726a3d8fb1c91d834e02e55cfd2e854cf4645.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a3d27d8b35f72399f5c74c2d80a726a3d8fb1c91d834e02e55cfd2e854cf4645.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1552 a3d27d8b35f72399f5c74c2d80a726a3d8fb1c91d834e02e55cfd2e854cf4645.exe 1552 a3d27d8b35f72399f5c74c2d80a726a3d8fb1c91d834e02e55cfd2e854cf4645.exe 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3120 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1552 a3d27d8b35f72399f5c74c2d80a726a3d8fb1c91d834e02e55cfd2e854cf4645.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4956 wrote to memory of 1552 4956 a3d27d8b35f72399f5c74c2d80a726a3d8fb1c91d834e02e55cfd2e854cf4645.exe 85 PID 4956 wrote to memory of 1552 4956 a3d27d8b35f72399f5c74c2d80a726a3d8fb1c91d834e02e55cfd2e854cf4645.exe 85 PID 4956 wrote to memory of 1552 4956 a3d27d8b35f72399f5c74c2d80a726a3d8fb1c91d834e02e55cfd2e854cf4645.exe 85 PID 4956 wrote to memory of 1552 4956 a3d27d8b35f72399f5c74c2d80a726a3d8fb1c91d834e02e55cfd2e854cf4645.exe 85 PID 4956 wrote to memory of 1552 4956 a3d27d8b35f72399f5c74c2d80a726a3d8fb1c91d834e02e55cfd2e854cf4645.exe 85 PID 4956 wrote to memory of 1552 4956 a3d27d8b35f72399f5c74c2d80a726a3d8fb1c91d834e02e55cfd2e854cf4645.exe 85 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3d27d8b35f72399f5c74c2d80a726a3d8fb1c91d834e02e55cfd2e854cf4645.exe"C:\Users\Admin\AppData\Local\Temp\a3d27d8b35f72399f5c74c2d80a726a3d8fb1c91d834e02e55cfd2e854cf4645.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\a3d27d8b35f72399f5c74c2d80a726a3d8fb1c91d834e02e55cfd2e854cf4645.exe"C:\Users\Admin\AppData\Local\Temp\a3d27d8b35f72399f5c74c2d80a726a3d8fb1c91d834e02e55cfd2e854cf4645.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1552
-