Analysis
-
max time kernel
150s -
max time network
132s -
platform
windows10-1703_x64 -
resource
win10-20230915-en -
resource tags
arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system -
submitted
22/09/2023, 01:33
Static task
static1
Behavioral task
behavioral1
Sample
e0aa93c3f01841d67f1d1f4caa49705313e441aa6c74ad027c890a2174681154.exe
Resource
win10-20230915-en
General
-
Target
e0aa93c3f01841d67f1d1f4caa49705313e441aa6c74ad027c890a2174681154.exe
-
Size
293KB
-
MD5
682773905fd75641ab9bb5d68500d987
-
SHA1
aefe2a8a408c0f316d1783c1cbe8522cd4095f3c
-
SHA256
e0aa93c3f01841d67f1d1f4caa49705313e441aa6c74ad027c890a2174681154
-
SHA512
d42bfbb998f984d30de034d380ea584e25c85316c2e315e5653db74058ffa6a24fde86bdafce02c740a1851e16d055bfb034b5fd9258b552cbea1758532fe3d2
-
SSDEEP
3072:w68XTpDS5GjDBixbk4pB0EG/JbD1wm2vZ9IULFum+/mh1nkrNidg87dB:R4TpSQsxdpB07xD152rIiOY1nkkg8Z
Malware Config
Extracted
smokeloader
pub1
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
pid Process 1792 Process not Found -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4372 set thread context of 3604 4372 e0aa93c3f01841d67f1d1f4caa49705313e441aa6c74ad027c890a2174681154.exe 70 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e0aa93c3f01841d67f1d1f4caa49705313e441aa6c74ad027c890a2174681154.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e0aa93c3f01841d67f1d1f4caa49705313e441aa6c74ad027c890a2174681154.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e0aa93c3f01841d67f1d1f4caa49705313e441aa6c74ad027c890a2174681154.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3604 e0aa93c3f01841d67f1d1f4caa49705313e441aa6c74ad027c890a2174681154.exe 3604 e0aa93c3f01841d67f1d1f4caa49705313e441aa6c74ad027c890a2174681154.exe 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found 1792 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1792 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3604 e0aa93c3f01841d67f1d1f4caa49705313e441aa6c74ad027c890a2174681154.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4372 wrote to memory of 3604 4372 e0aa93c3f01841d67f1d1f4caa49705313e441aa6c74ad027c890a2174681154.exe 70 PID 4372 wrote to memory of 3604 4372 e0aa93c3f01841d67f1d1f4caa49705313e441aa6c74ad027c890a2174681154.exe 70 PID 4372 wrote to memory of 3604 4372 e0aa93c3f01841d67f1d1f4caa49705313e441aa6c74ad027c890a2174681154.exe 70 PID 4372 wrote to memory of 3604 4372 e0aa93c3f01841d67f1d1f4caa49705313e441aa6c74ad027c890a2174681154.exe 70 PID 4372 wrote to memory of 3604 4372 e0aa93c3f01841d67f1d1f4caa49705313e441aa6c74ad027c890a2174681154.exe 70 PID 4372 wrote to memory of 3604 4372 e0aa93c3f01841d67f1d1f4caa49705313e441aa6c74ad027c890a2174681154.exe 70 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0aa93c3f01841d67f1d1f4caa49705313e441aa6c74ad027c890a2174681154.exe"C:\Users\Admin\AppData\Local\Temp\e0aa93c3f01841d67f1d1f4caa49705313e441aa6c74ad027c890a2174681154.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\e0aa93c3f01841d67f1d1f4caa49705313e441aa6c74ad027c890a2174681154.exe"C:\Users\Admin\AppData\Local\Temp\e0aa93c3f01841d67f1d1f4caa49705313e441aa6c74ad027c890a2174681154.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3604
-