Analysis
-
max time kernel
15s -
max time network
40s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2023, 03:11
Static task
static1
Behavioral task
behavioral1
Sample
7aee89a0da3c7a003661adefe9cb15bb3de6b1eae68f9b78901e83e92efbc1e1.exe
Resource
win7-20230831-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
7aee89a0da3c7a003661adefe9cb15bb3de6b1eae68f9b78901e83e92efbc1e1.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
7aee89a0da3c7a003661adefe9cb15bb3de6b1eae68f9b78901e83e92efbc1e1.exe
-
Size
965KB
-
MD5
b44f4c86856d872159aa4826535bcadc
-
SHA1
e5477661e9ad4879ec5999a609c1ebaa99e70b7a
-
SHA256
7aee89a0da3c7a003661adefe9cb15bb3de6b1eae68f9b78901e83e92efbc1e1
-
SHA512
e9a82f3188974c6c8047652ff258133e1861f9a1736200111f9d07756f8ea0d3083e9b96aaf7cee34d803d06e744d58013b2edd3e28c0706d4fa4569fdd6b26a
-
SSDEEP
12288:T6K4S7N6Fpsx18xz/lhUzWAMYU4dX6eGeQ/y3QZizaoByu99kuwE7nI:TCpsx18xz/lhUy3eX7GJ/PZi0ur7nI
Score
10/10
Malware Config
Extracted
Family
smokeloader
Version
2022
C2
http://77.91.68.29/fks/
rc4.i32
rc4.i32
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4444 set thread context of 3236 4444 7aee89a0da3c7a003661adefe9cb15bb3de6b1eae68f9b78901e83e92efbc1e1.exe 88 -
Program crash 1 IoCs
pid pid_target Process procid_target 2900 4444 WerFault.exe 86 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe -
Modifies registry class 24 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295" Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0" Process not Found Key created \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Process not Found Key created \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Rev = "0" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1" Process not Found Key created \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}" Process not Found Key created \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0" Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 Process not Found Key created \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 Process not Found Key created \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259} Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16" Process not Found Key created \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell Process not Found -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3236 AppLaunch.exe 3236 AppLaunch.exe 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found 3188 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3188 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3236 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 26 IoCs
description pid Process Token: SeShutdownPrivilege 3188 Process not Found Token: SeCreatePagefilePrivilege 3188 Process not Found Token: SeShutdownPrivilege 3188 Process not Found Token: SeCreatePagefilePrivilege 3188 Process not Found Token: SeShutdownPrivilege 3188 Process not Found Token: SeCreatePagefilePrivilege 3188 Process not Found Token: SeShutdownPrivilege 3188 Process not Found Token: SeCreatePagefilePrivilege 3188 Process not Found Token: SeShutdownPrivilege 3188 Process not Found Token: SeCreatePagefilePrivilege 3188 Process not Found Token: SeShutdownPrivilege 3188 Process not Found Token: SeCreatePagefilePrivilege 3188 Process not Found Token: SeShutdownPrivilege 3188 Process not Found Token: SeCreatePagefilePrivilege 3188 Process not Found Token: SeShutdownPrivilege 3188 Process not Found Token: SeCreatePagefilePrivilege 3188 Process not Found Token: SeShutdownPrivilege 3188 Process not Found Token: SeCreatePagefilePrivilege 3188 Process not Found Token: SeShutdownPrivilege 3188 Process not Found Token: SeCreatePagefilePrivilege 3188 Process not Found Token: SeShutdownPrivilege 3188 Process not Found Token: SeCreatePagefilePrivilege 3188 Process not Found Token: SeShutdownPrivilege 3188 Process not Found Token: SeCreatePagefilePrivilege 3188 Process not Found Token: SeShutdownPrivilege 3188 Process not Found Token: SeCreatePagefilePrivilege 3188 Process not Found -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4444 wrote to memory of 3236 4444 7aee89a0da3c7a003661adefe9cb15bb3de6b1eae68f9b78901e83e92efbc1e1.exe 88 PID 4444 wrote to memory of 3236 4444 7aee89a0da3c7a003661adefe9cb15bb3de6b1eae68f9b78901e83e92efbc1e1.exe 88 PID 4444 wrote to memory of 3236 4444 7aee89a0da3c7a003661adefe9cb15bb3de6b1eae68f9b78901e83e92efbc1e1.exe 88 PID 4444 wrote to memory of 3236 4444 7aee89a0da3c7a003661adefe9cb15bb3de6b1eae68f9b78901e83e92efbc1e1.exe 88 PID 4444 wrote to memory of 3236 4444 7aee89a0da3c7a003661adefe9cb15bb3de6b1eae68f9b78901e83e92efbc1e1.exe 88 PID 4444 wrote to memory of 3236 4444 7aee89a0da3c7a003661adefe9cb15bb3de6b1eae68f9b78901e83e92efbc1e1.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\7aee89a0da3c7a003661adefe9cb15bb3de6b1eae68f9b78901e83e92efbc1e1.exe"C:\Users\Admin\AppData\Local\Temp\7aee89a0da3c7a003661adefe9cb15bb3de6b1eae68f9b78901e83e92efbc1e1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3236
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 2482⤵
- Program crash
PID:2900
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4444 -ip 44441⤵PID:2928
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4384