Analysis
-
max time kernel
300s -
max time network
272s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
22/09/2023, 04:42
Static task
static1
Behavioral task
behavioral1
Sample
toolspub1.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
toolspub1.exe
Resource
win10v2004-20230915-en
General
-
Target
toolspub1.exe
-
Size
293KB
-
MD5
682773905fd75641ab9bb5d68500d987
-
SHA1
aefe2a8a408c0f316d1783c1cbe8522cd4095f3c
-
SHA256
e0aa93c3f01841d67f1d1f4caa49705313e441aa6c74ad027c890a2174681154
-
SHA512
d42bfbb998f984d30de034d380ea584e25c85316c2e315e5653db74058ffa6a24fde86bdafce02c740a1851e16d055bfb034b5fd9258b552cbea1758532fe3d2
-
SSDEEP
3072:w68XTpDS5GjDBixbk4pB0EG/JbD1wm2vZ9IULFum+/mh1nkrNidg87dB:R4TpSQsxdpB07xD152rIiOY1nkkg8Z
Malware Config
Extracted
smokeloader
pub1
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1216 set thread context of 2784 1216 toolspub1.exe 85 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub1.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2784 toolspub1.exe 2784 toolspub1.exe 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3228 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2784 toolspub1.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 3228 Process not Found Token: SeCreatePagefilePrivilege 3228 Process not Found -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1216 wrote to memory of 2784 1216 toolspub1.exe 85 PID 1216 wrote to memory of 2784 1216 toolspub1.exe 85 PID 1216 wrote to memory of 2784 1216 toolspub1.exe 85 PID 1216 wrote to memory of 2784 1216 toolspub1.exe 85 PID 1216 wrote to memory of 2784 1216 toolspub1.exe 85 PID 1216 wrote to memory of 2784 1216 toolspub1.exe 85 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\toolspub1.exe"C:\Users\Admin\AppData\Local\Temp\toolspub1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\toolspub1.exe"C:\Users\Admin\AppData\Local\Temp\toolspub1.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2784
-