Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows10-1703_x64 -
resource
win10-20230915-en -
resource tags
arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system -
submitted
22/09/2023, 12:59
Static task
static1
Behavioral task
behavioral1
Sample
55627a75c4cdc87a913050d1051c57c9d3ceb0aad3e6453a46ad17c9beaa5ef6.exe
Resource
win10-20230915-en
General
-
Target
55627a75c4cdc87a913050d1051c57c9d3ceb0aad3e6453a46ad17c9beaa5ef6.exe
-
Size
212KB
-
MD5
c2aeb963ab864bb2e5790346c6db79c6
-
SHA1
989535bffba9966444865ab5294106b7e2e168da
-
SHA256
55627a75c4cdc87a913050d1051c57c9d3ceb0aad3e6453a46ad17c9beaa5ef6
-
SHA512
cc34e04e64a8325007ad55ec620d85959863e8584bab6511d52f7c99f5e548804d22a4c13aab5cf8da4b6524e4e755a6419277abe28ae38f653d372183876a64
-
SSDEEP
3072:7XJWWgsnSimE4WAOTMahDGh0d8ig8s1J951KOm4wz:TEWjS8OOTMahDGh0d8ig8UFKy
Malware Config
Extracted
smokeloader
pub1
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
pid Process 3268 Process not Found -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1644 set thread context of 4720 1644 55627a75c4cdc87a913050d1051c57c9d3ceb0aad3e6453a46ad17c9beaa5ef6.exe 70 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 55627a75c4cdc87a913050d1051c57c9d3ceb0aad3e6453a46ad17c9beaa5ef6.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 55627a75c4cdc87a913050d1051c57c9d3ceb0aad3e6453a46ad17c9beaa5ef6.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 55627a75c4cdc87a913050d1051c57c9d3ceb0aad3e6453a46ad17c9beaa5ef6.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4720 55627a75c4cdc87a913050d1051c57c9d3ceb0aad3e6453a46ad17c9beaa5ef6.exe 4720 55627a75c4cdc87a913050d1051c57c9d3ceb0aad3e6453a46ad17c9beaa5ef6.exe 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found 3268 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3268 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4720 55627a75c4cdc87a913050d1051c57c9d3ceb0aad3e6453a46ad17c9beaa5ef6.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1644 wrote to memory of 4720 1644 55627a75c4cdc87a913050d1051c57c9d3ceb0aad3e6453a46ad17c9beaa5ef6.exe 70 PID 1644 wrote to memory of 4720 1644 55627a75c4cdc87a913050d1051c57c9d3ceb0aad3e6453a46ad17c9beaa5ef6.exe 70 PID 1644 wrote to memory of 4720 1644 55627a75c4cdc87a913050d1051c57c9d3ceb0aad3e6453a46ad17c9beaa5ef6.exe 70 PID 1644 wrote to memory of 4720 1644 55627a75c4cdc87a913050d1051c57c9d3ceb0aad3e6453a46ad17c9beaa5ef6.exe 70 PID 1644 wrote to memory of 4720 1644 55627a75c4cdc87a913050d1051c57c9d3ceb0aad3e6453a46ad17c9beaa5ef6.exe 70 PID 1644 wrote to memory of 4720 1644 55627a75c4cdc87a913050d1051c57c9d3ceb0aad3e6453a46ad17c9beaa5ef6.exe 70 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\55627a75c4cdc87a913050d1051c57c9d3ceb0aad3e6453a46ad17c9beaa5ef6.exe"C:\Users\Admin\AppData\Local\Temp\55627a75c4cdc87a913050d1051c57c9d3ceb0aad3e6453a46ad17c9beaa5ef6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\55627a75c4cdc87a913050d1051c57c9d3ceb0aad3e6453a46ad17c9beaa5ef6.exe"C:\Users\Admin\AppData\Local\Temp\55627a75c4cdc87a913050d1051c57c9d3ceb0aad3e6453a46ad17c9beaa5ef6.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4720
-