Analysis
- max time kernel
50s - max time network
62s - platform
windows10-2004_x64 - resource
win10v2004-20231020-en - resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system - submitted
08/11/2023, 00:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.TrojanX-gen.8935.9906.exe
Resource
win7-20231020-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win32.TrojanX-gen.8935.9906.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target SecuriteInfo.com.Win32.TrojanX-gen.8935.9906.exe
- Size 280KB
- Sample231108-azlplscd47
- SHA256 baa08ba27f8ef8c024eba8647a05d3bc85f194e917630ba532913156677502c8
- MD5 4cbff9ae356488bcc99c9f37f2ffab73
- SHA1 82318ce856912678b0486637b8bad4f03c88adc9
- SHA512 1ee44f3336cb31dbd86bbd74b046b4f0bf18f76971719d4634d7575751b930feb426fd868c3045edad79726e503ec6024bd35597a1ff4ffcb0cf793c6dd285c9
- SSDEEP 3072:/BjWBgdZOrf1+J/ZP0OkoePkYA13he9bghPnnxJ1EZwZEAUhli:6gdI9+Jhvkd83Vnn3mZSn
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Botnet
-
up4
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://host-file-file0.com/
-
http://file-file-file1.com/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Deletes itself 1 IoCs
pid Process 3320 Process not Found - Executes dropped EXE 1 IoCs
pid Process 2692 udvvthg - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2072 set thread context of 4280 2072 SecuriteInfo.com.Win32.TrojanX-gen.8935.9906.exe 91 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI SecuriteInfo.com.Win32.TrojanX-gen.8935.9906.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI SecuriteInfo.com.Win32.TrojanX-gen.8935.9906.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI SecuriteInfo.com.Win32.TrojanX-gen.8935.9906.exe - Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3811856890-180006922-3689258494-1000\{CDFBC070-84CB-41A0-9C30-1AC1CB31E43A} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4280 SecuriteInfo.com.Win32.TrojanX-gen.8935.9906.exe 4280 SecuriteInfo.com.Win32.TrojanX-gen.8935.9906.exe 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found 3320 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4280 SecuriteInfo.com.Win32.TrojanX-gen.8935.9906.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeShutdownPrivilege 3320 Process not Found Token: SeCreatePagefilePrivilege 3320 Process not Found Token: SeShutdownPrivilege 4868 explorer.exe Token: SeCreatePagefilePrivilege 4868 explorer.exe Token: SeShutdownPrivilege 4868 explorer.exe Token: SeCreatePagefilePrivilege 4868 explorer.exe Token: SeShutdownPrivilege 4868 explorer.exe Token: SeCreatePagefilePrivilege 4868 explorer.exe Token: SeShutdownPrivilege 4868 explorer.exe Token: SeCreatePagefilePrivilege 4868 explorer.exe Token: SeShutdownPrivilege 4868 explorer.exe Token: SeCreatePagefilePrivilege 4868 explorer.exe - Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe - Suspicious use of SendNotifyMessage 9 IoCs
pid Process 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe 4868 explorer.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2072 wrote to memory of 4280 2072 SecuriteInfo.com.Win32.TrojanX-gen.8935.9906.exe 91 PID 2072 wrote to memory of 4280 2072 SecuriteInfo.com.Win32.TrojanX-gen.8935.9906.exe 91 PID 2072 wrote to memory of 4280 2072 SecuriteInfo.com.Win32.TrojanX-gen.8935.9906.exe 91 PID 2072 wrote to memory of 4280 2072 SecuriteInfo.com.Win32.TrojanX-gen.8935.9906.exe 91 PID 2072 wrote to memory of 4280 2072 SecuriteInfo.com.Win32.TrojanX-gen.8935.9906.exe 91 PID 2072 wrote to memory of 4280 2072 SecuriteInfo.com.Win32.TrojanX-gen.8935.9906.exe 91 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.8935.9906.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.8935.9906.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.8935.9906.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.8935.9906.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4280
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4868
-
C:\Users\Admin\AppData\Roaming\udvvthgC:\Users\Admin\AppData\Roaming\udvvthg1⤵
- Executes dropped EXE
PID:2692
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1428
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4208
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
- Size 471B
- SHA256 1a1830716ed3c9efa87191e819f3e3f6775740a608a5e5a62c9833119c934db1
- MD5 1229feb9159ffcbb03f63dc35db39773
- SHA1 52de1325285bbd20fed303cbf56b113f3531497f
- SHA512 a895410dd807a222dc1a0649e4d1ec6fbc010ba8cc0ec6a6e16f32cfc0e19b564b1430f2da6f5e605bdbb697394aa013c6469c2143da8f4308a0d60ac7daa231
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
- Size 412B
- SHA256 997b53fcfec0b002ba78638d04495b0a5d81c4eaf8ca25d18be8e8742287abfd
- MD5 769c4bef12986612e01540cbc2f32894
- SHA1 8635013ca4dd68458214ba5da787fb40106908d7
- SHA512 8f88aacb1db65a99398192ca0ca727cbc5b102930083464d03e997f0acdb9973af36206d8caf034640115208aa32d6bd4fd5b2f0ee8573303c83e1f8b97d3746
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\udvvthg
- Size 280KB
- SHA256 baa08ba27f8ef8c024eba8647a05d3bc85f194e917630ba532913156677502c8
- MD5 4cbff9ae356488bcc99c9f37f2ffab73
- SHA1 82318ce856912678b0486637b8bad4f03c88adc9
- SHA512 1ee44f3336cb31dbd86bbd74b046b4f0bf18f76971719d4634d7575751b930feb426fd868c3045edad79726e503ec6024bd35597a1ff4ffcb0cf793c6dd285c9
- SSDEEP 3072:/BjWBgdZOrf1+J/ZP0OkoePkYA13he9bghPnnxJ1EZwZEAUhli:6gdI9+Jhvkd83Vnn3mZSn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\udvvthg
- Size 280KB
- SHA256 baa08ba27f8ef8c024eba8647a05d3bc85f194e917630ba532913156677502c8
- MD5 4cbff9ae356488bcc99c9f37f2ffab73
- SHA1 82318ce856912678b0486637b8bad4f03c88adc9
- SHA512 1ee44f3336cb31dbd86bbd74b046b4f0bf18f76971719d4634d7575751b930feb426fd868c3045edad79726e503ec6024bd35597a1ff4ffcb0cf793c6dd285c9
- SSDEEP 3072:/BjWBgdZOrf1+J/ZP0OkoePkYA13he9bghPnnxJ1EZwZEAUhli:6gdI9+Jhvkd83Vnn3mZSn
- MD5 SHA1 SHA512 SSDEEP