Analysis

  • max time kernel
    151s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-10-2023 19:01

General

  • Target

    f0937a56401c28d94e8608e80c9f48d74a688797e9e030b0324094874d8a1ad8.exe

  • Size

    253KB

  • MD5

    d53fd15867eac795277bb9660c5add7c

  • SHA1

    64cfc927faa7c37284aad8dd5a5730bad89b33ed

  • SHA256

    f0937a56401c28d94e8608e80c9f48d74a688797e9e030b0324094874d8a1ad8

  • SHA512

    04a61b2125f266882993c8809b6fd143a3e4e33695059b5b4419981e2840135a9d8ba7da64e8f52eef993a5cd227b4dced992f05f209a60a452a2b38d8ade695

  • SSDEEP

    1536:zJpUUCmM1MHq8lnDjgDSj+lPxZ9chmgJAxcoE+bfAmflaRg7BP0hFWbIdK7IbM3R:dp+mM1MKs949chmnu+bfja+eWabM2GN

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\f0937a56401c28d94e8608e80c9f48d74a688797e9e030b0324094874d8a1ad8.exe
    "C:\Users\Admin\AppData\Local\Temp\f0937a56401c28d94e8608e80c9f48d74a688797e9e030b0324094874d8a1ad8.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4340
    • C:\Users\Admin\AppData\Local\Temp\f0937a56401c28d94e8608e80c9f48d74a688797e9e030b0324094874d8a1ad8.exe
      "C:\Users\Admin\AppData\Local\Temp\f0937a56401c28d94e8608e80c9f48d74a688797e9e030b0324094874d8a1ad8.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:2532

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2532-3-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2532-4-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2532-6-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/3184-5-0x0000000007600000-0x0000000007616000-memory.dmp

    Filesize

    88KB

  • memory/3184-10-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-12-0x0000000003450000-0x0000000003460000-memory.dmp

    Filesize

    64KB

  • memory/3184-11-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-13-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-14-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-15-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-16-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-17-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-19-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-18-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-22-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-21-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-23-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-24-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-25-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-27-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-29-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-31-0x0000000003450000-0x0000000003460000-memory.dmp

    Filesize

    64KB

  • memory/3184-33-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-30-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-34-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-35-0x0000000003460000-0x0000000003470000-memory.dmp

    Filesize

    64KB

  • memory/3184-36-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-38-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-37-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-39-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-40-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-43-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-42-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-47-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-48-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-49-0x0000000003080000-0x0000000003090000-memory.dmp

    Filesize

    64KB

  • memory/3184-50-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-51-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-52-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-54-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-53-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-56-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-58-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-59-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-60-0x0000000003090000-0x00000000030A0000-memory.dmp

    Filesize

    64KB

  • memory/3184-61-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-62-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-63-0x0000000003090000-0x00000000030A0000-memory.dmp

    Filesize

    64KB

  • memory/3184-64-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-68-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-66-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-70-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-72-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-73-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-74-0x0000000003090000-0x00000000030A0000-memory.dmp

    Filesize

    64KB

  • memory/3184-75-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-77-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-76-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-79-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-78-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-81-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-82-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-83-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-84-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-85-0x00000000030A0000-0x00000000030B0000-memory.dmp

    Filesize

    64KB

  • memory/3184-86-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-87-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-88-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-90-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-89-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-92-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-94-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-95-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-96-0x00000000030A0000-0x00000000030B0000-memory.dmp

    Filesize

    64KB

  • memory/3184-97-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-98-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-99-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-101-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-103-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-100-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-105-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-107-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-108-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-106-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-110-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-109-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-113-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-112-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-111-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-114-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-116-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/3184-117-0x0000000003440000-0x0000000003450000-memory.dmp

    Filesize

    64KB

  • memory/4340-1-0x0000000000A10000-0x0000000000B10000-memory.dmp

    Filesize

    1024KB

  • memory/4340-2-0x00000000009B0000-0x00000000009B9000-memory.dmp

    Filesize

    36KB