Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows10-1703_x64 -
resource
win10-20230915-en -
resource tags
arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system -
submitted
07-10-2023 12:39
Static task
static1
Behavioral task
behavioral1
Sample
f1b5fd21d4d4bf57e836005ecaf9e70688361303a736dd7554f611196eb62097.exe
Resource
win10-20230915-en
General
-
Target
f1b5fd21d4d4bf57e836005ecaf9e70688361303a736dd7554f611196eb62097.exe
-
Size
284KB
-
MD5
00cfd198e57faa7fb18b5c0832dc0c23
-
SHA1
5314715954fe6d46b906ba492e763aaadb645b88
-
SHA256
f1b5fd21d4d4bf57e836005ecaf9e70688361303a736dd7554f611196eb62097
-
SHA512
dad62a23ccfb32178d6c48b88adedc95606bd1dadaa5401621015a6e576dd8f2d977f21cd60c8f6d7fa8840f5911b603bde6601ab20f54c1bc8d2ddfaf542130
-
SSDEEP
3072:KVekOWF9Mx03rkJOkSTMcnaGBtl5DaEv7oKngUrU7Qtgh4a:wUWHMx0oJkTaGBkI7oukCgh
Malware Config
Extracted
smokeloader
up3
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 2484 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f1b5fd21d4d4bf57e836005ecaf9e70688361303a736dd7554f611196eb62097.exedescription pid process target process PID 4848 set thread context of 4016 4848 f1b5fd21d4d4bf57e836005ecaf9e70688361303a736dd7554f611196eb62097.exe f1b5fd21d4d4bf57e836005ecaf9e70688361303a736dd7554f611196eb62097.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
f1b5fd21d4d4bf57e836005ecaf9e70688361303a736dd7554f611196eb62097.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f1b5fd21d4d4bf57e836005ecaf9e70688361303a736dd7554f611196eb62097.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f1b5fd21d4d4bf57e836005ecaf9e70688361303a736dd7554f611196eb62097.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f1b5fd21d4d4bf57e836005ecaf9e70688361303a736dd7554f611196eb62097.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
f1b5fd21d4d4bf57e836005ecaf9e70688361303a736dd7554f611196eb62097.exepid process 4016 f1b5fd21d4d4bf57e836005ecaf9e70688361303a736dd7554f611196eb62097.exe 4016 f1b5fd21d4d4bf57e836005ecaf9e70688361303a736dd7554f611196eb62097.exe 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2484 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
f1b5fd21d4d4bf57e836005ecaf9e70688361303a736dd7554f611196eb62097.exepid process 4016 f1b5fd21d4d4bf57e836005ecaf9e70688361303a736dd7554f611196eb62097.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
f1b5fd21d4d4bf57e836005ecaf9e70688361303a736dd7554f611196eb62097.exedescription pid process target process PID 4848 wrote to memory of 4016 4848 f1b5fd21d4d4bf57e836005ecaf9e70688361303a736dd7554f611196eb62097.exe f1b5fd21d4d4bf57e836005ecaf9e70688361303a736dd7554f611196eb62097.exe PID 4848 wrote to memory of 4016 4848 f1b5fd21d4d4bf57e836005ecaf9e70688361303a736dd7554f611196eb62097.exe f1b5fd21d4d4bf57e836005ecaf9e70688361303a736dd7554f611196eb62097.exe PID 4848 wrote to memory of 4016 4848 f1b5fd21d4d4bf57e836005ecaf9e70688361303a736dd7554f611196eb62097.exe f1b5fd21d4d4bf57e836005ecaf9e70688361303a736dd7554f611196eb62097.exe PID 4848 wrote to memory of 4016 4848 f1b5fd21d4d4bf57e836005ecaf9e70688361303a736dd7554f611196eb62097.exe f1b5fd21d4d4bf57e836005ecaf9e70688361303a736dd7554f611196eb62097.exe PID 4848 wrote to memory of 4016 4848 f1b5fd21d4d4bf57e836005ecaf9e70688361303a736dd7554f611196eb62097.exe f1b5fd21d4d4bf57e836005ecaf9e70688361303a736dd7554f611196eb62097.exe PID 4848 wrote to memory of 4016 4848 f1b5fd21d4d4bf57e836005ecaf9e70688361303a736dd7554f611196eb62097.exe f1b5fd21d4d4bf57e836005ecaf9e70688361303a736dd7554f611196eb62097.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1b5fd21d4d4bf57e836005ecaf9e70688361303a736dd7554f611196eb62097.exe"C:\Users\Admin\AppData\Local\Temp\f1b5fd21d4d4bf57e836005ecaf9e70688361303a736dd7554f611196eb62097.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\f1b5fd21d4d4bf57e836005ecaf9e70688361303a736dd7554f611196eb62097.exe"C:\Users\Admin\AppData\Local\Temp\f1b5fd21d4d4bf57e836005ecaf9e70688361303a736dd7554f611196eb62097.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4016