Analysis
-
max time kernel
150s -
max time network
130s -
platform
windows10-1703_x64 -
resource
win10-20230915-en -
resource tags
arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system -
submitted
22/09/2023, 10:25
Static task
static1
Behavioral task
behavioral1
Sample
9d35150a447696b7c6d5bcf71ff97de4738e5ec528819f537f47e565b9ba14a4.exe
Resource
win10-20230915-en
General
-
Target
9d35150a447696b7c6d5bcf71ff97de4738e5ec528819f537f47e565b9ba14a4.exe
-
Size
215KB
-
MD5
9b75c8d33264c955cddacd6e6f8ed53f
-
SHA1
e957af9fe51eff34d62b7c9190d695554f8bf398
-
SHA256
9d35150a447696b7c6d5bcf71ff97de4738e5ec528819f537f47e565b9ba14a4
-
SHA512
561d606863e9a73430c9fbd437d219a00b403f40f6c1bb7fc6905eec790b74496d31f6c51e9240a559f8549240be8e2919725874fd9c25568866fa8fcf623e24
-
SSDEEP
3072:6XyY+u/FEpBt5pxygeCP4Xy7iNvfPnO905Fv8YOzT:a7+CCp3XlNwXy7yPnOaUY
Malware Config
Extracted
smokeloader
pub1
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
pid Process 3240 Process not Found -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4360 set thread context of 2940 4360 9d35150a447696b7c6d5bcf71ff97de4738e5ec528819f537f47e565b9ba14a4.exe 70 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9d35150a447696b7c6d5bcf71ff97de4738e5ec528819f537f47e565b9ba14a4.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9d35150a447696b7c6d5bcf71ff97de4738e5ec528819f537f47e565b9ba14a4.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9d35150a447696b7c6d5bcf71ff97de4738e5ec528819f537f47e565b9ba14a4.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2940 9d35150a447696b7c6d5bcf71ff97de4738e5ec528819f537f47e565b9ba14a4.exe 2940 9d35150a447696b7c6d5bcf71ff97de4738e5ec528819f537f47e565b9ba14a4.exe 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found 3240 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3240 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2940 9d35150a447696b7c6d5bcf71ff97de4738e5ec528819f537f47e565b9ba14a4.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4360 wrote to memory of 2940 4360 9d35150a447696b7c6d5bcf71ff97de4738e5ec528819f537f47e565b9ba14a4.exe 70 PID 4360 wrote to memory of 2940 4360 9d35150a447696b7c6d5bcf71ff97de4738e5ec528819f537f47e565b9ba14a4.exe 70 PID 4360 wrote to memory of 2940 4360 9d35150a447696b7c6d5bcf71ff97de4738e5ec528819f537f47e565b9ba14a4.exe 70 PID 4360 wrote to memory of 2940 4360 9d35150a447696b7c6d5bcf71ff97de4738e5ec528819f537f47e565b9ba14a4.exe 70 PID 4360 wrote to memory of 2940 4360 9d35150a447696b7c6d5bcf71ff97de4738e5ec528819f537f47e565b9ba14a4.exe 70 PID 4360 wrote to memory of 2940 4360 9d35150a447696b7c6d5bcf71ff97de4738e5ec528819f537f47e565b9ba14a4.exe 70 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d35150a447696b7c6d5bcf71ff97de4738e5ec528819f537f47e565b9ba14a4.exe"C:\Users\Admin\AppData\Local\Temp\9d35150a447696b7c6d5bcf71ff97de4738e5ec528819f537f47e565b9ba14a4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\9d35150a447696b7c6d5bcf71ff97de4738e5ec528819f537f47e565b9ba14a4.exe"C:\Users\Admin\AppData\Local\Temp\9d35150a447696b7c6d5bcf71ff97de4738e5ec528819f537f47e565b9ba14a4.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2940
-