Analysis
-
max time kernel
152s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
22/09/2023, 20:47
Static task
static1
Behavioral task
behavioral1
Sample
c76fe7e5cfe5a94cc437f360f815b6f7c7eef063c528503e27e1d27a101f282a.exe
Resource
win10v2004-20230915-en
General
-
Target
c76fe7e5cfe5a94cc437f360f815b6f7c7eef063c528503e27e1d27a101f282a.exe
-
Size
188KB
-
MD5
ea676996230ba69c73e6dda4a710d36c
-
SHA1
f2bdd794d402fe4a0f23161c3d661a6f122311f3
-
SHA256
c76fe7e5cfe5a94cc437f360f815b6f7c7eef063c528503e27e1d27a101f282a
-
SHA512
8a459903117ee60b128429d3b73818981a0c6f676e6870e6672d1b81f66949128f11419c9564d3f0796fde8e138a04cfaa99221d4b670db3f610e8aef11b0852
-
SSDEEP
3072:3H1HnMnZetjjaa0dfxvziBeDey+K7zhhFakRK5VAyL:X1HnMnZE0dfxvziBeDe7K71hFRRG
Malware Config
Extracted
smokeloader
pub1
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 2 IoCs
pid Process 1764 iewucdv 1412 iewucdv -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 232 set thread context of 2956 232 c76fe7e5cfe5a94cc437f360f815b6f7c7eef063c528503e27e1d27a101f282a.exe 88 PID 1764 set thread context of 1412 1764 iewucdv 99 -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c76fe7e5cfe5a94cc437f360f815b6f7c7eef063c528503e27e1d27a101f282a.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c76fe7e5cfe5a94cc437f360f815b6f7c7eef063c528503e27e1d27a101f282a.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c76fe7e5cfe5a94cc437f360f815b6f7c7eef063c528503e27e1d27a101f282a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI iewucdv Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI iewucdv Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI iewucdv -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2956 c76fe7e5cfe5a94cc437f360f815b6f7c7eef063c528503e27e1d27a101f282a.exe 2956 c76fe7e5cfe5a94cc437f360f815b6f7c7eef063c528503e27e1d27a101f282a.exe 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3188 Process not Found -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2956 c76fe7e5cfe5a94cc437f360f815b6f7c7eef063c528503e27e1d27a101f282a.exe 1412 iewucdv -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 3188 Process not Found Token: SeCreatePagefilePrivilege 3188 Process not Found -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 232 wrote to memory of 2956 232 c76fe7e5cfe5a94cc437f360f815b6f7c7eef063c528503e27e1d27a101f282a.exe 88 PID 232 wrote to memory of 2956 232 c76fe7e5cfe5a94cc437f360f815b6f7c7eef063c528503e27e1d27a101f282a.exe 88 PID 232 wrote to memory of 2956 232 c76fe7e5cfe5a94cc437f360f815b6f7c7eef063c528503e27e1d27a101f282a.exe 88 PID 232 wrote to memory of 2956 232 c76fe7e5cfe5a94cc437f360f815b6f7c7eef063c528503e27e1d27a101f282a.exe 88 PID 232 wrote to memory of 2956 232 c76fe7e5cfe5a94cc437f360f815b6f7c7eef063c528503e27e1d27a101f282a.exe 88 PID 232 wrote to memory of 2956 232 c76fe7e5cfe5a94cc437f360f815b6f7c7eef063c528503e27e1d27a101f282a.exe 88 PID 1764 wrote to memory of 1412 1764 iewucdv 99 PID 1764 wrote to memory of 1412 1764 iewucdv 99 PID 1764 wrote to memory of 1412 1764 iewucdv 99 PID 1764 wrote to memory of 1412 1764 iewucdv 99 PID 1764 wrote to memory of 1412 1764 iewucdv 99 PID 1764 wrote to memory of 1412 1764 iewucdv 99 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c76fe7e5cfe5a94cc437f360f815b6f7c7eef063c528503e27e1d27a101f282a.exe"C:\Users\Admin\AppData\Local\Temp\c76fe7e5cfe5a94cc437f360f815b6f7c7eef063c528503e27e1d27a101f282a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Users\Admin\AppData\Local\Temp\c76fe7e5cfe5a94cc437f360f815b6f7c7eef063c528503e27e1d27a101f282a.exe"C:\Users\Admin\AppData\Local\Temp\c76fe7e5cfe5a94cc437f360f815b6f7c7eef063c528503e27e1d27a101f282a.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2956
-
-
C:\Users\Admin\AppData\Roaming\iewucdvC:\Users\Admin\AppData\Roaming\iewucdv1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Roaming\iewucdvC:\Users\Admin\AppData\Roaming\iewucdv2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1412
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
188KB
MD5ea676996230ba69c73e6dda4a710d36c
SHA1f2bdd794d402fe4a0f23161c3d661a6f122311f3
SHA256c76fe7e5cfe5a94cc437f360f815b6f7c7eef063c528503e27e1d27a101f282a
SHA5128a459903117ee60b128429d3b73818981a0c6f676e6870e6672d1b81f66949128f11419c9564d3f0796fde8e138a04cfaa99221d4b670db3f610e8aef11b0852
-
Filesize
188KB
MD5ea676996230ba69c73e6dda4a710d36c
SHA1f2bdd794d402fe4a0f23161c3d661a6f122311f3
SHA256c76fe7e5cfe5a94cc437f360f815b6f7c7eef063c528503e27e1d27a101f282a
SHA5128a459903117ee60b128429d3b73818981a0c6f676e6870e6672d1b81f66949128f11419c9564d3f0796fde8e138a04cfaa99221d4b670db3f610e8aef11b0852
-
Filesize
188KB
MD5ea676996230ba69c73e6dda4a710d36c
SHA1f2bdd794d402fe4a0f23161c3d661a6f122311f3
SHA256c76fe7e5cfe5a94cc437f360f815b6f7c7eef063c528503e27e1d27a101f282a
SHA5128a459903117ee60b128429d3b73818981a0c6f676e6870e6672d1b81f66949128f11419c9564d3f0796fde8e138a04cfaa99221d4b670db3f610e8aef11b0852