Analysis
-
max time kernel
150s -
max time network
130s -
platform
windows10-1703_x64 -
resource
win10-20230915-en -
resource tags
arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system -
submitted
21/09/2023, 18:06
Static task
static1
Behavioral task
behavioral1
Sample
0aa0146c720c3018a04e4cbeb1a2da2f5609dc8de9ecd8657c94faea5ef06fe2.exe
Resource
win10-20230915-en
General
-
Target
0aa0146c720c3018a04e4cbeb1a2da2f5609dc8de9ecd8657c94faea5ef06fe2.exe
-
Size
293KB
-
MD5
24f75de0b3732abb0cbec8db81b453f8
-
SHA1
ceb92e17967e18352d67b47ca6b4c1c5b9d80218
-
SHA256
0aa0146c720c3018a04e4cbeb1a2da2f5609dc8de9ecd8657c94faea5ef06fe2
-
SHA512
7524c41886f4a81b5d4ac513ca7dba935614442bc5398b11fda17436c682fd570af04895801ba6decae28d0bf3c07aac0ed17040ccc683731216c7b86a346e48
-
SSDEEP
3072:zpMX3pzSo/iplyxkZB7i1aPgqHmqOB1pM/1wm9Sd5qL6uBVULZL1Dgg85ve:FI3ZSLCxQpPgDsaSaqWOVULZSg8F
Malware Config
Extracted
smokeloader
pub1
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
pid Process 3232 Process not Found -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4944 set thread context of 2820 4944 0aa0146c720c3018a04e4cbeb1a2da2f5609dc8de9ecd8657c94faea5ef06fe2.exe 70 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0aa0146c720c3018a04e4cbeb1a2da2f5609dc8de9ecd8657c94faea5ef06fe2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0aa0146c720c3018a04e4cbeb1a2da2f5609dc8de9ecd8657c94faea5ef06fe2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0aa0146c720c3018a04e4cbeb1a2da2f5609dc8de9ecd8657c94faea5ef06fe2.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2820 0aa0146c720c3018a04e4cbeb1a2da2f5609dc8de9ecd8657c94faea5ef06fe2.exe 2820 0aa0146c720c3018a04e4cbeb1a2da2f5609dc8de9ecd8657c94faea5ef06fe2.exe 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found 3232 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3232 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2820 0aa0146c720c3018a04e4cbeb1a2da2f5609dc8de9ecd8657c94faea5ef06fe2.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4944 wrote to memory of 2820 4944 0aa0146c720c3018a04e4cbeb1a2da2f5609dc8de9ecd8657c94faea5ef06fe2.exe 70 PID 4944 wrote to memory of 2820 4944 0aa0146c720c3018a04e4cbeb1a2da2f5609dc8de9ecd8657c94faea5ef06fe2.exe 70 PID 4944 wrote to memory of 2820 4944 0aa0146c720c3018a04e4cbeb1a2da2f5609dc8de9ecd8657c94faea5ef06fe2.exe 70 PID 4944 wrote to memory of 2820 4944 0aa0146c720c3018a04e4cbeb1a2da2f5609dc8de9ecd8657c94faea5ef06fe2.exe 70 PID 4944 wrote to memory of 2820 4944 0aa0146c720c3018a04e4cbeb1a2da2f5609dc8de9ecd8657c94faea5ef06fe2.exe 70 PID 4944 wrote to memory of 2820 4944 0aa0146c720c3018a04e4cbeb1a2da2f5609dc8de9ecd8657c94faea5ef06fe2.exe 70 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0aa0146c720c3018a04e4cbeb1a2da2f5609dc8de9ecd8657c94faea5ef06fe2.exe"C:\Users\Admin\AppData\Local\Temp\0aa0146c720c3018a04e4cbeb1a2da2f5609dc8de9ecd8657c94faea5ef06fe2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\0aa0146c720c3018a04e4cbeb1a2da2f5609dc8de9ecd8657c94faea5ef06fe2.exe"C:\Users\Admin\AppData\Local\Temp\0aa0146c720c3018a04e4cbeb1a2da2f5609dc8de9ecd8657c94faea5ef06fe2.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2820
-