Analysis

  • max time kernel
    151s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/09/2023, 07:44

General

  • Target

    5d676cca0c493faae994040ca98ad4966ac64a90f2e92e5fdada8ed454b3ba11.exe

  • Size

    203KB

  • MD5

    e95640f18c5fcf2737977e3805d72008

  • SHA1

    1b4c5f8c48908daaa92e01bd35ecc143b9d4f5a7

  • SHA256

    5d676cca0c493faae994040ca98ad4966ac64a90f2e92e5fdada8ed454b3ba11

  • SHA512

    678082d61e4191386e7cc5f5405c0428af5d50ab021d055c8a1ca1325242f8f5ddfee87fc5f263787dfebe0248f37e57c97ee837cdd9f2cb85010ccf0389e3cc

  • SSDEEP

    3072:aXJ/Qkp454XQLxSy3p97M0ROAUSrkZpY1zc51ZGBCzaC:6NQG4GA/f7dwCOOCZqI

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of SetThreadContext 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\5d676cca0c493faae994040ca98ad4966ac64a90f2e92e5fdada8ed454b3ba11.exe
    "C:\Users\Admin\AppData\Local\Temp\5d676cca0c493faae994040ca98ad4966ac64a90f2e92e5fdada8ed454b3ba11.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4428
    • C:\Users\Admin\AppData\Local\Temp\5d676cca0c493faae994040ca98ad4966ac64a90f2e92e5fdada8ed454b3ba11.exe
      "C:\Users\Admin\AppData\Local\Temp\5d676cca0c493faae994040ca98ad4966ac64a90f2e92e5fdada8ed454b3ba11.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:3184

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/3172-5-0x0000000003450000-0x0000000003466000-memory.dmp

          Filesize

          88KB

        • memory/3184-2-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

        • memory/3184-3-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

        • memory/3184-6-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

        • memory/4428-0-0x00000000022F0000-0x0000000002305000-memory.dmp

          Filesize

          84KB

        • memory/4428-1-0x0000000002310000-0x0000000002319000-memory.dmp

          Filesize

          36KB

        • memory/4428-4-0x00000000022F0000-0x0000000002305000-memory.dmp

          Filesize

          84KB