Analysis Overview
SHA256
31e54f46b20976c9779d4fde6282ec9fc581b50646a802a517e827c5e7a6aebb
Threat Level: Known bad
The file bf6863460cf38b67423d10b9f51c4751.bin was found to be: Known bad.
Malicious Activity Summary
SmokeLoader
Deletes itself
Unsigned PE
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Uses Task Scheduler COM API
Checks SCSI registry key(s)
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-09-22 06:54
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-09-22 06:54
Reported
2023-09-22 06:56
Platform
win7-20230831-en
Max time kernel
150s
Max time network
123s
Command Line
Signatures
SmokeLoader
Deletes itself
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\bf6863460cf38b67423d10b9f51c4751.exe | N/A |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\bf6863460cf38b67423d10b9f51c4751.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\bf6863460cf38b67423d10b9f51c4751.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\bf6863460cf38b67423d10b9f51c4751.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\bf6863460cf38b67423d10b9f51c4751.exe | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\bf6863460cf38b67423d10b9f51c4751.exe | N/A |
Uses Task Scheduler COM API
Processes
C:\Users\Admin\AppData\Local\Temp\bf6863460cf38b67423d10b9f51c4751.exe
"C:\Users\Admin\AppData\Local\Temp\bf6863460cf38b67423d10b9f51c4751.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | gudintas.at | udp |
| MX | 189.232.123.108:80 | gudintas.at | tcp |
| MX | 189.232.123.108:80 | gudintas.at | tcp |
| MX | 189.232.123.108:80 | gudintas.at | tcp |
| MX | 189.232.123.108:80 | gudintas.at | tcp |
| MX | 189.232.123.108:80 | gudintas.at | tcp |
| MX | 189.232.123.108:80 | gudintas.at | tcp |
| MX | 189.232.123.108:80 | gudintas.at | tcp |
| MX | 189.232.123.108:80 | gudintas.at | tcp |
| MX | 189.232.123.108:80 | gudintas.at | tcp |
| MX | 189.232.123.108:80 | gudintas.at | tcp |
| MX | 189.232.123.108:80 | gudintas.at | tcp |
| MX | 189.232.123.108:80 | gudintas.at | tcp |
| MX | 189.232.123.108:80 | gudintas.at | tcp |
| MX | 189.232.123.108:80 | gudintas.at | tcp |
| MX | 189.232.123.108:80 | gudintas.at | tcp |
| MX | 189.232.123.108:80 | gudintas.at | tcp |
| MX | 189.232.123.108:80 | gudintas.at | tcp |
| MX | 189.232.123.108:80 | gudintas.at | tcp |
Files
memory/2376-0-0x0000000000220000-0x0000000000235000-memory.dmp
memory/2376-1-0x0000000000240000-0x0000000000249000-memory.dmp
memory/2376-2-0x0000000000400000-0x00000000005A6000-memory.dmp
memory/2376-4-0x0000000000400000-0x00000000005A6000-memory.dmp
memory/1224-3-0x0000000002A00000-0x0000000002A16000-memory.dmp
memory/2376-8-0x0000000000220000-0x0000000000235000-memory.dmp
memory/2376-7-0x0000000000240000-0x0000000000249000-memory.dmp
memory/1224-12-0x000007FEF5720000-0x000007FEF5863000-memory.dmp
memory/1224-13-0x000007FE86BE0000-0x000007FE86BEA000-memory.dmp
memory/1224-14-0x000007FEF5720000-0x000007FEF5863000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2023-09-22 06:54
Reported
2023-09-22 06:56
Platform
win10v2004-20230915-en
Max time kernel
150s
Max time network
153s
Command Line
Signatures
SmokeLoader
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\bf6863460cf38b67423d10b9f51c4751.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\bf6863460cf38b67423d10b9f51c4751.exe | N/A |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\bf6863460cf38b67423d10b9f51c4751.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\bf6863460cf38b67423d10b9f51c4751.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\bf6863460cf38b67423d10b9f51c4751.exe | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\bf6863460cf38b67423d10b9f51c4751.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
Uses Task Scheduler COM API
Processes
C:\Users\Admin\AppData\Local\Temp\bf6863460cf38b67423d10b9f51c4751.exe
"C:\Users\Admin\AppData\Local\Temp\bf6863460cf38b67423d10b9f51c4751.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 68.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | gudintas.at | udp |
| PA | 181.197.76.240:80 | gudintas.at | tcp |
| PA | 181.197.76.240:80 | gudintas.at | tcp |
| US | 8.8.8.8:53 | 240.76.197.181.in-addr.arpa | udp |
| PA | 181.197.76.240:80 | gudintas.at | tcp |
| PA | 181.197.76.240:80 | gudintas.at | tcp |
| PA | 181.197.76.240:80 | gudintas.at | tcp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.81.21.72.in-addr.arpa | udp |
| PA | 181.197.76.240:80 | gudintas.at | tcp |
| PA | 181.197.76.240:80 | gudintas.at | tcp |
| PA | 181.197.76.240:80 | gudintas.at | tcp |
| PA | 181.197.76.240:80 | gudintas.at | tcp |
| PA | 181.197.76.240:80 | gudintas.at | tcp |
| PA | 181.197.76.240:80 | gudintas.at | tcp |
| PA | 181.197.76.240:80 | gudintas.at | tcp |
| PA | 181.197.76.240:80 | gudintas.at | tcp |
| PA | 181.197.76.240:80 | gudintas.at | tcp |
| PA | 181.197.76.240:80 | gudintas.at | tcp |
| PA | 181.197.76.240:80 | gudintas.at | tcp |
| PA | 181.197.76.240:80 | gudintas.at | tcp |
| PA | 181.197.76.240:80 | gudintas.at | tcp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.229.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 8.3.197.209.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 10.173.189.20.in-addr.arpa | udp |
Files
memory/4728-0-0x00000000022F0000-0x0000000002305000-memory.dmp
memory/4728-1-0x0000000002310000-0x0000000002319000-memory.dmp
memory/4728-2-0x0000000000400000-0x00000000005A6000-memory.dmp
memory/4728-4-0x0000000000400000-0x00000000005A6000-memory.dmp
memory/3180-3-0x0000000002E90000-0x0000000002EA6000-memory.dmp
memory/4728-7-0x00000000022F0000-0x0000000002305000-memory.dmp
memory/4728-8-0x0000000002310000-0x0000000002319000-memory.dmp
memory/3180-12-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-13-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-14-0x0000000008430000-0x0000000008440000-memory.dmp
memory/3180-15-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-16-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-17-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-18-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-19-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-21-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-23-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-24-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-25-0x00000000089F0000-0x0000000008A00000-memory.dmp
memory/3180-26-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-27-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-29-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-28-0x00000000089F0000-0x0000000008A00000-memory.dmp
memory/3180-32-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-31-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-33-0x0000000008430000-0x0000000008440000-memory.dmp
memory/3180-35-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-37-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-38-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-41-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-42-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-43-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-40-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-44-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-46-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-45-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-47-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-48-0x00000000089F0000-0x0000000008A00000-memory.dmp
memory/3180-49-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-50-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-52-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-51-0x0000000002D30000-0x0000000002D40000-memory.dmp
memory/3180-53-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-54-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-55-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-56-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-58-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-60-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-61-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-62-0x0000000002D40000-0x0000000002D50000-memory.dmp
memory/3180-63-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-64-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-65-0x0000000002D40000-0x0000000002D50000-memory.dmp
memory/3180-66-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-68-0x0000000002D30000-0x0000000002D40000-memory.dmp
memory/3180-67-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-72-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-71-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-70-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-74-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-75-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-77-0x0000000002D40000-0x0000000002D50000-memory.dmp
memory/3180-76-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-80-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-79-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-78-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-81-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-83-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-84-0x0000000008420000-0x0000000008430000-memory.dmp
memory/3180-85-0x0000000002D40000-0x0000000002D50000-memory.dmp