Analysis
-
max time kernel
160s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11-10-2023 22:22
Static task
static1
Behavioral task
behavioral1
Sample
3a9de2062ed05cddc3db8b4258e285258d796950dee999a489c5ad1624ece1cc.exe
Resource
win7-20230831-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
3a9de2062ed05cddc3db8b4258e285258d796950dee999a489c5ad1624ece1cc.exe
Resource
win10v2004-20230915-en
amadeydcrathealerredlinesectopratsmokeloader@ytlogsbotbrehakukishpixelscloudbackdoordiscoverydropperevasioninfostealerpersistenceratspywarestealertrojan
windows10-2004-x64
36 signatures
150 seconds
General
-
Target
3a9de2062ed05cddc3db8b4258e285258d796950dee999a489c5ad1624ece1cc.exe
-
Size
270KB
-
MD5
aabcfd825f5489f9b26cf1f90a552625
-
SHA1
fdcba229b9ab1cf3f6f1109ba5aabe86703e8ed2
-
SHA256
3a9de2062ed05cddc3db8b4258e285258d796950dee999a489c5ad1624ece1cc
-
SHA512
2fee709d63466ea1e9b2faa5caca34523af366189e0d65709f195d4cf5821a05935bbfb8e61e152965799ad1002a4cd3a4f682b75190386e626c407d9f08ef5f
-
SSDEEP
6144:dRuhrJ+j+5j68KsT6h/OCy5U9uAOAA/lUBqw6:dR4N+j+5+RsqGGun6Yw6
Score
10/10
Malware Config
Extracted
Family
smokeloader
Version
2022
C2
http://77.91.68.29/fks/
rc4.i32
rc4.i32
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2972 set thread context of 2372 2972 3a9de2062ed05cddc3db8b4258e285258d796950dee999a489c5ad1624ece1cc.exe 30 -
Program crash 1 IoCs
pid pid_target Process procid_target 2796 2972 WerFault.exe 27 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2372 AppLaunch.exe 2372 AppLaunch.exe 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found 1248 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1248 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2372 AppLaunch.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2972 wrote to memory of 3060 2972 3a9de2062ed05cddc3db8b4258e285258d796950dee999a489c5ad1624ece1cc.exe 28 PID 2972 wrote to memory of 3060 2972 3a9de2062ed05cddc3db8b4258e285258d796950dee999a489c5ad1624ece1cc.exe 28 PID 2972 wrote to memory of 3060 2972 3a9de2062ed05cddc3db8b4258e285258d796950dee999a489c5ad1624ece1cc.exe 28 PID 2972 wrote to memory of 3060 2972 3a9de2062ed05cddc3db8b4258e285258d796950dee999a489c5ad1624ece1cc.exe 28 PID 2972 wrote to memory of 3060 2972 3a9de2062ed05cddc3db8b4258e285258d796950dee999a489c5ad1624ece1cc.exe 28 PID 2972 wrote to memory of 3060 2972 3a9de2062ed05cddc3db8b4258e285258d796950dee999a489c5ad1624ece1cc.exe 28 PID 2972 wrote to memory of 3060 2972 3a9de2062ed05cddc3db8b4258e285258d796950dee999a489c5ad1624ece1cc.exe 28 PID 2972 wrote to memory of 3056 2972 3a9de2062ed05cddc3db8b4258e285258d796950dee999a489c5ad1624ece1cc.exe 29 PID 2972 wrote to memory of 3056 2972 3a9de2062ed05cddc3db8b4258e285258d796950dee999a489c5ad1624ece1cc.exe 29 PID 2972 wrote to memory of 3056 2972 3a9de2062ed05cddc3db8b4258e285258d796950dee999a489c5ad1624ece1cc.exe 29 PID 2972 wrote to memory of 3056 2972 3a9de2062ed05cddc3db8b4258e285258d796950dee999a489c5ad1624ece1cc.exe 29 PID 2972 wrote to memory of 3056 2972 3a9de2062ed05cddc3db8b4258e285258d796950dee999a489c5ad1624ece1cc.exe 29 PID 2972 wrote to memory of 3056 2972 3a9de2062ed05cddc3db8b4258e285258d796950dee999a489c5ad1624ece1cc.exe 29 PID 2972 wrote to memory of 3056 2972 3a9de2062ed05cddc3db8b4258e285258d796950dee999a489c5ad1624ece1cc.exe 29 PID 2972 wrote to memory of 2372 2972 3a9de2062ed05cddc3db8b4258e285258d796950dee999a489c5ad1624ece1cc.exe 30 PID 2972 wrote to memory of 2372 2972 3a9de2062ed05cddc3db8b4258e285258d796950dee999a489c5ad1624ece1cc.exe 30 PID 2972 wrote to memory of 2372 2972 3a9de2062ed05cddc3db8b4258e285258d796950dee999a489c5ad1624ece1cc.exe 30 PID 2972 wrote to memory of 2372 2972 3a9de2062ed05cddc3db8b4258e285258d796950dee999a489c5ad1624ece1cc.exe 30 PID 2972 wrote to memory of 2372 2972 3a9de2062ed05cddc3db8b4258e285258d796950dee999a489c5ad1624ece1cc.exe 30 PID 2972 wrote to memory of 2372 2972 3a9de2062ed05cddc3db8b4258e285258d796950dee999a489c5ad1624ece1cc.exe 30 PID 2972 wrote to memory of 2372 2972 3a9de2062ed05cddc3db8b4258e285258d796950dee999a489c5ad1624ece1cc.exe 30 PID 2972 wrote to memory of 2372 2972 3a9de2062ed05cddc3db8b4258e285258d796950dee999a489c5ad1624ece1cc.exe 30 PID 2972 wrote to memory of 2372 2972 3a9de2062ed05cddc3db8b4258e285258d796950dee999a489c5ad1624ece1cc.exe 30 PID 2972 wrote to memory of 2372 2972 3a9de2062ed05cddc3db8b4258e285258d796950dee999a489c5ad1624ece1cc.exe 30 PID 2972 wrote to memory of 2796 2972 3a9de2062ed05cddc3db8b4258e285258d796950dee999a489c5ad1624ece1cc.exe 31 PID 2972 wrote to memory of 2796 2972 3a9de2062ed05cddc3db8b4258e285258d796950dee999a489c5ad1624ece1cc.exe 31 PID 2972 wrote to memory of 2796 2972 3a9de2062ed05cddc3db8b4258e285258d796950dee999a489c5ad1624ece1cc.exe 31 PID 2972 wrote to memory of 2796 2972 3a9de2062ed05cddc3db8b4258e285258d796950dee999a489c5ad1624ece1cc.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a9de2062ed05cddc3db8b4258e285258d796950dee999a489c5ad1624ece1cc.exe"C:\Users\Admin\AppData\Local\Temp\3a9de2062ed05cddc3db8b4258e285258d796950dee999a489c5ad1624ece1cc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:3060
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:3056
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2372
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 722⤵
- Program crash
PID:2796
-