Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
11/11/2023, 10:48
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.9b0d858bbb5099297f17cd5c7b6c9414143fb4b99afeee581107a50493161bd5.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.9b0d858bbb5099297f17cd5c7b6c9414143fb4b99afeee581107a50493161bd5.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.9b0d858bbb5099297f17cd5c7b6c9414143fb4b99afeee581107a50493161bd5.exe
-
Size
248KB
-
MD5
5e2eb10af1a04afa53efb1ac20e8c45e
-
SHA1
3c5e89328c9d134e7690e2a6029f8e1bb1809b6e
-
SHA256
9b0d858bbb5099297f17cd5c7b6c9414143fb4b99afeee581107a50493161bd5
-
SHA512
b3480af0c151531278b0ccf6e5b841bd3fcc2adb56d2962719dde90c0c347a55964800fdcf8d7f4b65663b465c37878f565fb1d3edc21dd2c32e4d8d27b4c769
-
SSDEEP
3072:pSdDJp7LU+5Fo2NXINf3xSgfP8pFPWO95C/wgpz4+B+yQOvI:gdr0se2NaSgfUpFPh5C/DU
Malware Config
Extracted
smokeloader
pub4
Extracted
smokeloader
2022
http://dpav.cc/tmp/
http://lrproduct.ru/tmp/
http://kggcp.com/tmp/
http://talesofpirates.net/tmp/
http://pirateking.online/tmp/
http://piratia.pw/tmp/
http://go-piratia.ru/tmp/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
pid Process 3288 Process not Found -
Executes dropped EXE 1 IoCs
pid Process 3572 jecifec -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jecifec Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jecifec Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jecifec Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI NEAS.9b0d858bbb5099297f17cd5c7b6c9414143fb4b99afeee581107a50493161bd5.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI NEAS.9b0d858bbb5099297f17cd5c7b6c9414143fb4b99afeee581107a50493161bd5.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI NEAS.9b0d858bbb5099297f17cd5c7b6c9414143fb4b99afeee581107a50493161bd5.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2456 NEAS.9b0d858bbb5099297f17cd5c7b6c9414143fb4b99afeee581107a50493161bd5.exe 2456 NEAS.9b0d858bbb5099297f17cd5c7b6c9414143fb4b99afeee581107a50493161bd5.exe 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found 3288 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3288 Process not Found -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2456 NEAS.9b0d858bbb5099297f17cd5c7b6c9414143fb4b99afeee581107a50493161bd5.exe 3572 jecifec -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3288 Process not Found -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.9b0d858bbb5099297f17cd5c7b6c9414143fb4b99afeee581107a50493161bd5.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.9b0d858bbb5099297f17cd5c7b6c9414143fb4b99afeee581107a50493161bd5.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2456
-
C:\Users\Admin\AppData\Roaming\jecifecC:\Users\Admin\AppData\Roaming\jecifec1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3572
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
248KB
MD55e2eb10af1a04afa53efb1ac20e8c45e
SHA13c5e89328c9d134e7690e2a6029f8e1bb1809b6e
SHA2569b0d858bbb5099297f17cd5c7b6c9414143fb4b99afeee581107a50493161bd5
SHA512b3480af0c151531278b0ccf6e5b841bd3fcc2adb56d2962719dde90c0c347a55964800fdcf8d7f4b65663b465c37878f565fb1d3edc21dd2c32e4d8d27b4c769
-
Filesize
248KB
MD55e2eb10af1a04afa53efb1ac20e8c45e
SHA13c5e89328c9d134e7690e2a6029f8e1bb1809b6e
SHA2569b0d858bbb5099297f17cd5c7b6c9414143fb4b99afeee581107a50493161bd5
SHA512b3480af0c151531278b0ccf6e5b841bd3fcc2adb56d2962719dde90c0c347a55964800fdcf8d7f4b65663b465c37878f565fb1d3edc21dd2c32e4d8d27b4c769