Analysis
- max time kernel
150s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20231025-en - resource tags
arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system - submitted
26/10/2023, 14:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c0ae72ffc9662e9e3423b1d1a030b001.exe
Resource
win7-20231020-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
c0ae72ffc9662e9e3423b1d1a030b001.exe
Resource
win10v2004-20231025-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target c0ae72ffc9662e9e3423b1d1a030b001.exe
- Size 906KB
- Sample231026-reet1acc7t
- SHA256 0011d97090a713f1eb4e4c4b565470dfb58bed32ee20cf3d38df3a76580dd6f5
- MD5 c0ae72ffc9662e9e3423b1d1a030b001
- SHA1 f384c1c7f7e8aabb1aac0a4382f0bc3aab03fcda
- SHA512 b6305a865714ba08939ba7de5d6002da05cbdea10e7a0cf6f5a2c31871e75ccb40968d788affe2f3c01d35062b4c40b6a3ea72d4130dda2d36820ea201c87a5f
- SSDEEP 12288:QjjzdYmmNwOIbDh6z/iuuu9gHgr6w4AtVCVlgzIMGKumjgUVpLvC:ijzdpmNwOIbDh6TJ6K/CVl0N
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2022
C2
-
http://77.91.68.29/fks/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2212 set thread context of 3764 2212 c0ae72ffc9662e9e3423b1d1a030b001.exe 85 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3764 AppLaunch.exe 3764 AppLaunch.exe 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3316 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3764 AppLaunch.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3316 Process not Found 3316 Process not Found 3316 Process not Found - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 3316 Process not Found 3316 Process not Found 3316 Process not Found - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2212 wrote to memory of 656 2212 c0ae72ffc9662e9e3423b1d1a030b001.exe 83 PID 2212 wrote to memory of 656 2212 c0ae72ffc9662e9e3423b1d1a030b001.exe 83 PID 2212 wrote to memory of 656 2212 c0ae72ffc9662e9e3423b1d1a030b001.exe 83 PID 2212 wrote to memory of 964 2212 c0ae72ffc9662e9e3423b1d1a030b001.exe 84 PID 2212 wrote to memory of 964 2212 c0ae72ffc9662e9e3423b1d1a030b001.exe 84 PID 2212 wrote to memory of 964 2212 c0ae72ffc9662e9e3423b1d1a030b001.exe 84 PID 2212 wrote to memory of 3764 2212 c0ae72ffc9662e9e3423b1d1a030b001.exe 85 PID 2212 wrote to memory of 3764 2212 c0ae72ffc9662e9e3423b1d1a030b001.exe 85 PID 2212 wrote to memory of 3764 2212 c0ae72ffc9662e9e3423b1d1a030b001.exe 85 PID 2212 wrote to memory of 3764 2212 c0ae72ffc9662e9e3423b1d1a030b001.exe 85 PID 2212 wrote to memory of 3764 2212 c0ae72ffc9662e9e3423b1d1a030b001.exe 85 PID 2212 wrote to memory of 3764 2212 c0ae72ffc9662e9e3423b1d1a030b001.exe 85 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0ae72ffc9662e9e3423b1d1a030b001.exe"C:\Users\Admin\AppData\Local\Temp\c0ae72ffc9662e9e3423b1d1a030b001.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:656
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:964
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3764
-