Analysis

  • max time kernel
    300s
  • max time network
    296s
  • platform
    windows10-1703_x64
  • resource
    win10-20230915-en
  • resource tags

    arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
  • submitted
    25/09/2023, 01:40

General

  • Target

    a21a9ad00bae1a7f3bc9ae3af10e39a8dcf0d250b54471275011f46fa114f6c7.exe

  • Size

    240KB

  • MD5

    600148d1ad2c7324ceb21a54d0d04b79

  • SHA1

    65f42d3291e39faf05712c2187cfb6f4b96bd0a8

  • SHA256

    a21a9ad00bae1a7f3bc9ae3af10e39a8dcf0d250b54471275011f46fa114f6c7

  • SHA512

    d60eddd946b46b24d760a6b625f2425dbb3f2e973cd3aafdddf3ce69ddde77127314a601751b079687036b94b95f133dc5ee27dc01cf22d7b2aa6061cfd9e7b1

  • SSDEEP

    6144:xM5frpxdonyq4zaG2u5AO8eK0hJYPP8quqp:x6rp0/9u5eelh80quqp

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://77.91.68.29/fks/

rc4.i32
rc4.i32

Signatures

  • Detected google phishing page
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 7 IoCs
  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\a21a9ad00bae1a7f3bc9ae3af10e39a8dcf0d250b54471275011f46fa114f6c7.exe
    "C:\Users\Admin\AppData\Local\Temp\a21a9ad00bae1a7f3bc9ae3af10e39a8dcf0d250b54471275011f46fa114f6c7.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2196
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
        PID:2676
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        2⤵
          PID:2532
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
          2⤵
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          PID:2936
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 260
          2⤵
          • Program crash
          PID:1500
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8B24.bat" "
        1⤵
        • Checks computer location settings
        PID:4720
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
        1⤵
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:856
      • C:\Windows\system32\browser_broker.exe
        C:\Windows\system32\browser_broker.exe -Embedding
        1⤵
        • Modifies Internet Explorer settings
        PID:3736
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Modifies registry class
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3172
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:4464
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Drops file in Windows directory
        • Modifies registry class
        PID:4288
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Drops file in Windows directory
        PID:3944
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Drops file in Windows directory
        • Modifies registry class
        PID:5032
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Drops file in Windows directory
        • Modifies registry class
        PID:1528
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:2056
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
          PID:4780
        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
          1⤵
          • Modifies registry class
          PID:2192

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9TVXN1W7\edgecompatviewlist[1].xml

                Filesize

                74KB

                MD5

                d4fc49dc14f63895d997fa4940f24378

                SHA1

                3efb1437a7c5e46034147cbbc8db017c69d02c31

                SHA256

                853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

                SHA512

                cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

              • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\FYLKFUT1\B8BxsscfVBr[1].ico

                Filesize

                1KB

                MD5

                e508eca3eafcc1fc2d7f19bafb29e06b

                SHA1

                a62fc3c2a027870d99aedc241e7d5babba9a891f

                SHA256

                e6d1d77403cd9f14fd2377d07e84350cfe768e3353e402bf42ebdc8593a58c9a

                SHA512

                49e3f31fd73e52ba274db9c7d306cc188e09c3ae683827f420fbb17534d197a503460e7ec2f1af46065f8d0b33f37400659bfa2ae165e502f97a8150e184a38c

              • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\M4FZDXMF\suggestions[1].en-US

                Filesize

                17KB

                MD5

                5a34cb996293fde2cb7a4ac89587393a

                SHA1

                3c96c993500690d1a77873cd62bc639b3a10653f

                SHA256

                c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

                SHA512

                e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

              • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\KQJ8O55J.cookie

                Filesize

                132B

                MD5

                9bdf38780b76e770ce846e33dc3d7f3d

                SHA1

                19b2e2fc14d6561a8b55414d17eaba6d4e4143eb

                SHA256

                a6210b214c0dd04ee0b24a51e3387fc7cd403d1350f3a639316f2117d92d1a44

                SHA512

                0568611799dc8bbcc7f43d1a65dc35910bb88f04e42b558ea577d23c944d48664ceaf0ab9bba95f43ed71fda7fae9d1c5a6010dc2f8bff058abc4d82fe73c5c8

              • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\U816A7KD.cookie

                Filesize

                132B

                MD5

                0a9a6f0f23467f63f00ae267a5582ba7

                SHA1

                2b1162c8d4ed490183bcb89dbe242e9530340586

                SHA256

                8cb3462fad546035de4d924d22a86c09dcb41590aef1b05cc7fa8d6646bb3b74

                SHA512

                fc3ad6ab3b229e5b184c07717526d4bee8701e35ac0fef0ad64a11e0364dab57b102a6daddc8827c48dddf084585870f35c08aea679a3f1aa4572b305c2d7b96

              • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

                Filesize

                1KB

                MD5

                b5eda74305a01c41450e0d12777199e1

                SHA1

                36162e9e8c3a69b237d317f7c300f11927a37c12

                SHA256

                6e5c17b2b4e22fa800baa0eaf0b76ce73005e463b915503e8bca92223b9cf594

                SHA512

                f96b2ea451f4ceef082e1289a7f1e160580f5a8d515eaf2b4df0d8d818c34355c17538806f873fba07118b5c937d8c3172721ee03e3d16126e07c0db5faf16f3

              • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

                Filesize

                724B

                MD5

                ac89a852c2aaa3d389b2d2dd312ad367

                SHA1

                8f421dd6493c61dbda6b839e2debb7b50a20c930

                SHA256

                0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45

                SHA512

                c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

              • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_87DCDABBB68171FA19C9A78DBA85E190

                Filesize

                471B

                MD5

                3b7403306365b481a905b872a4a8fe8d

                SHA1

                848d8b54a1b0fa0f473fe13bbabcb7872c0a6067

                SHA256

                f7ffcd2b2deb0aafb5ab3eca136e1bfa6560686bf31f6982afeb0535dfd70bd7

                SHA512

                bb40f31f256d4635c9ef00ef2eb7f6d959a262e55e8028d2d009073b74979900672073db15b2e3130b551dfe3b770863251940fa13c49375b8e18c5be24fb2a9

              • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

                Filesize

                410B

                MD5

                ed52083e267af2baceffa36182a8b40f

                SHA1

                e006715489e330bd1ec44dd8c151f96a94ce4d45

                SHA256

                e871511cb52d1b1c2b17e8cc6e65b334f8a5e144329e595f7045ce9deaff225c

                SHA512

                1a0785ab4167b6fef3ab8af18a49b1c40b109e88f8f52f766daf2bcbb5bbf2571d18d14a3bdef6e4678b4602718a951fb04548c7ad1c1ca1240b76c0e9c5f99e

              • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

                Filesize

                392B

                MD5

                4b98e5a78f4511efa4bff3f4085a705b

                SHA1

                251bf242ae4a22b543f547d6f21cfa8e6e8e6f97

                SHA256

                4aebef447fba1eff100c8333252250f2936a44f7b07907064fa0c3153c7ce668

                SHA512

                f5ef5786d89bce3ec59a18ba0c73b8bd080a69b687c35f3e952abec7b8727f36e22dabb5d2ce31919362fac40f70f850975ad936c27df8046a5f48d131b0328d

              • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_87DCDABBB68171FA19C9A78DBA85E190

                Filesize

                406B

                MD5

                42c421db0d280b621f0fab3400f52659

                SHA1

                a22f5fe2c113e80df4fc7d5cdfa4fdc301577f12

                SHA256

                56efd76762d0ad27e0e678fb43cc81d9dfccfef26ad151469275a325a933e07b

                SHA512

                aef2b91bdca2051148d756fe85987af4df1703897f0b60538b8909db8e016592defbc16f1d57bd06bdbe483d3fc5cba40f6cf68876c45636edbfbf1794ee43ab

              • C:\Users\Admin\AppData\Local\Temp\8B24.bat

                Filesize

                79B

                MD5

                403991c4d18ac84521ba17f264fa79f2

                SHA1

                850cc068de0963854b0fe8f485d951072474fd45

                SHA256

                ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f

                SHA512

                a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576

              • memory/856-31-0x0000018C30A00000-0x0000018C30A10000-memory.dmp

                Filesize

                64KB

              • memory/856-359-0x0000018C374C0000-0x0000018C374C1000-memory.dmp

                Filesize

                4KB

              • memory/856-360-0x0000018C374D0000-0x0000018C374D1000-memory.dmp

                Filesize

                4KB

              • memory/856-50-0x0000018C30B00000-0x0000018C30B02000-memory.dmp

                Filesize

                8KB

              • memory/856-15-0x0000018C30420000-0x0000018C30430000-memory.dmp

                Filesize

                64KB

              • memory/1528-469-0x0000020414EF0000-0x0000020414EF2000-memory.dmp

                Filesize

                8KB

              • memory/1528-467-0x0000020414ED0000-0x0000020414ED2000-memory.dmp

                Filesize

                8KB

              • memory/1528-464-0x0000020414BD0000-0x0000020414BD2000-memory.dmp

                Filesize

                8KB

              • memory/1528-479-0x00000204153F0000-0x00000204153F2000-memory.dmp

                Filesize

                8KB

              • memory/2936-0-0x0000000000400000-0x0000000000409000-memory.dmp

                Filesize

                36KB

              • memory/2936-6-0x0000000000400000-0x0000000000409000-memory.dmp

                Filesize

                36KB

              • memory/2936-3-0x0000000000400000-0x0000000000409000-memory.dmp

                Filesize

                36KB

              • memory/3196-4-0x0000000001250000-0x0000000001266000-memory.dmp

                Filesize

                88KB

              • memory/4288-212-0x000001C6B3390000-0x000001C6B3490000-memory.dmp

                Filesize

                1024KB

              • memory/4288-424-0x000001C6A2500000-0x000001C6A2600000-memory.dmp

                Filesize

                1024KB

              • memory/4288-390-0x000001C6B4B00000-0x000001C6B4C00000-memory.dmp

                Filesize

                1024KB

              • memory/4288-384-0x000001C6A2D00000-0x000001C6A2E00000-memory.dmp

                Filesize

                1024KB

              • memory/4288-382-0x000001C6B54D0000-0x000001C6B54D2000-memory.dmp

                Filesize

                8KB

              • memory/4288-372-0x000001C6B5ED0000-0x000001C6B5ED2000-memory.dmp

                Filesize

                8KB

              • memory/4288-370-0x000001C6B5EC0000-0x000001C6B5EC2000-memory.dmp

                Filesize

                8KB

              • memory/4288-368-0x000001C6B5EB0000-0x000001C6B5EB2000-memory.dmp

                Filesize

                8KB

              • memory/4288-366-0x000001C6B5710000-0x000001C6B5712000-memory.dmp

                Filesize

                8KB

              • memory/4288-361-0x000001C6B56F0000-0x000001C6B56F2000-memory.dmp

                Filesize

                8KB

              • memory/4288-356-0x000001C6B56A0000-0x000001C6B56A2000-memory.dmp

                Filesize

                8KB

              • memory/4288-351-0x000001C6B5750000-0x000001C6B5752000-memory.dmp

                Filesize

                8KB

              • memory/4288-348-0x000001C6B5730000-0x000001C6B5732000-memory.dmp

                Filesize

                8KB

              • memory/4288-209-0x000001C6B4100000-0x000001C6B4120000-memory.dmp

                Filesize

                128KB

              • memory/4288-192-0x000001C6B3000000-0x000001C6B3100000-memory.dmp

                Filesize

                1024KB