Analysis
-
max time kernel
300s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
25/09/2023, 01:37
Static task
static1
Behavioral task
behavioral1
Sample
4098aa6438facda5fdc7dd24d893f4b71db89eec6561cb6e08a3b9db2b8902fe.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
4098aa6438facda5fdc7dd24d893f4b71db89eec6561cb6e08a3b9db2b8902fe.exe
Resource
win10-20230915-en
General
-
Target
4098aa6438facda5fdc7dd24d893f4b71db89eec6561cb6e08a3b9db2b8902fe.exe
-
Size
270KB
-
MD5
60fd337ba59312469cbd074fee9d1b19
-
SHA1
01200c7c9c2c3709991a4caebd5bbc045941056b
-
SHA256
4098aa6438facda5fdc7dd24d893f4b71db89eec6561cb6e08a3b9db2b8902fe
-
SHA512
2769a7f5e900e82c0627b50613a0eba5105718d28392fdbc758be048a44c19aebc5f97d02baa284e21a6055eca3642dc1b1be0b36b6c79866c1e104ab512282c
-
SSDEEP
6144:cRVhrJ+j+5j68KsT6h/OCy5U9uAOLAm4Mqyqw6:cRLN+j+5+RsqGGuime/w6
Malware Config
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 1 IoCs
pid Process 2568 ujrcvas -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2344 set thread context of 2276 2344 4098aa6438facda5fdc7dd24d893f4b71db89eec6561cb6e08a3b9db2b8902fe.exe 28 -
Program crash 1 IoCs
pid pid_target Process procid_target 1416 2344 WerFault.exe 27 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2276 AppLaunch.exe 2276 AppLaunch.exe 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1264 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2276 AppLaunch.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2344 wrote to memory of 2276 2344 4098aa6438facda5fdc7dd24d893f4b71db89eec6561cb6e08a3b9db2b8902fe.exe 28 PID 2344 wrote to memory of 2276 2344 4098aa6438facda5fdc7dd24d893f4b71db89eec6561cb6e08a3b9db2b8902fe.exe 28 PID 2344 wrote to memory of 2276 2344 4098aa6438facda5fdc7dd24d893f4b71db89eec6561cb6e08a3b9db2b8902fe.exe 28 PID 2344 wrote to memory of 2276 2344 4098aa6438facda5fdc7dd24d893f4b71db89eec6561cb6e08a3b9db2b8902fe.exe 28 PID 2344 wrote to memory of 2276 2344 4098aa6438facda5fdc7dd24d893f4b71db89eec6561cb6e08a3b9db2b8902fe.exe 28 PID 2344 wrote to memory of 2276 2344 4098aa6438facda5fdc7dd24d893f4b71db89eec6561cb6e08a3b9db2b8902fe.exe 28 PID 2344 wrote to memory of 2276 2344 4098aa6438facda5fdc7dd24d893f4b71db89eec6561cb6e08a3b9db2b8902fe.exe 28 PID 2344 wrote to memory of 2276 2344 4098aa6438facda5fdc7dd24d893f4b71db89eec6561cb6e08a3b9db2b8902fe.exe 28 PID 2344 wrote to memory of 2276 2344 4098aa6438facda5fdc7dd24d893f4b71db89eec6561cb6e08a3b9db2b8902fe.exe 28 PID 2344 wrote to memory of 2276 2344 4098aa6438facda5fdc7dd24d893f4b71db89eec6561cb6e08a3b9db2b8902fe.exe 28 PID 2344 wrote to memory of 1416 2344 4098aa6438facda5fdc7dd24d893f4b71db89eec6561cb6e08a3b9db2b8902fe.exe 29 PID 2344 wrote to memory of 1416 2344 4098aa6438facda5fdc7dd24d893f4b71db89eec6561cb6e08a3b9db2b8902fe.exe 29 PID 2344 wrote to memory of 1416 2344 4098aa6438facda5fdc7dd24d893f4b71db89eec6561cb6e08a3b9db2b8902fe.exe 29 PID 2344 wrote to memory of 1416 2344 4098aa6438facda5fdc7dd24d893f4b71db89eec6561cb6e08a3b9db2b8902fe.exe 29 PID 2648 wrote to memory of 2568 2648 taskeng.exe 33 PID 2648 wrote to memory of 2568 2648 taskeng.exe 33 PID 2648 wrote to memory of 2568 2648 taskeng.exe 33 PID 2648 wrote to memory of 2568 2648 taskeng.exe 33 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4098aa6438facda5fdc7dd24d893f4b71db89eec6561cb6e08a3b9db2b8902fe.exe"C:\Users\Admin\AppData\Local\Temp\4098aa6438facda5fdc7dd24d893f4b71db89eec6561cb6e08a3b9db2b8902fe.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2276
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 522⤵
- Program crash
PID:1416
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {67726DAC-E46B-4FD7-AB4C-B746D67BF35C} S-1-5-21-3513876443-2771975297-1923446376-1000:GPFFWLPI\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Roaming\ujrcvasC:\Users\Admin\AppData\Roaming\ujrcvas2⤵
- Executes dropped EXE
PID:2568
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD57825cad99621dd288da81d8d8ae13cf5
SHA1f3e1ab0c8e4f22e718cdeb6fa5faa87b0e61e73c
SHA256529088553fe9cb3e497ef704ce9bc7bc07630f6ddfad44afb92acfe639789ec5
SHA5122e81251a2c140a96f681fa95d82eee531b391e2654daa90da08d1dd00f13cba949136d465a2dc37507d40b4a708b6fc695baa716f19737591b1a89bd2a4b60b4
-
Filesize
96KB
MD57825cad99621dd288da81d8d8ae13cf5
SHA1f3e1ab0c8e4f22e718cdeb6fa5faa87b0e61e73c
SHA256529088553fe9cb3e497ef704ce9bc7bc07630f6ddfad44afb92acfe639789ec5
SHA5122e81251a2c140a96f681fa95d82eee531b391e2654daa90da08d1dd00f13cba949136d465a2dc37507d40b4a708b6fc695baa716f19737591b1a89bd2a4b60b4