Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2023 18:13
Static task
static1
Behavioral task
behavioral1
Sample
91cc08eaa2d516fe6b48ecf473dac67146c347e939a09646e1e141008e82003b.exe
Resource
win10v2004-20231023-en
General
-
Target
91cc08eaa2d516fe6b48ecf473dac67146c347e939a09646e1e141008e82003b.exe
-
Size
652KB
-
MD5
f4e05067b330b3af02bcbe478c14dc70
-
SHA1
dac73148c5ee4176574c51e7429f482a21c0dde6
-
SHA256
91cc08eaa2d516fe6b48ecf473dac67146c347e939a09646e1e141008e82003b
-
SHA512
4ee5ff2a6f0150d39968122d2e25cd68839f3f8c085df3a0b11ea2d16a5be583160c38b3d5236b904b50a9657c4f23922eb171ef7819a846c8326bb899228a2d
-
SSDEEP
12288:EMray90Q5kgF6ABsLF4lZV1xX4dZdXprV8qT7zSrawUGcE3b6QfYBctEQ48:+yb5ku6m6YDvX4dZxJV3v2awUO3b6gt
Malware Config
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2348-19-0x0000000000400000-0x0000000000434000-memory.dmp mystic_family behavioral1/memory/2348-20-0x0000000000400000-0x0000000000434000-memory.dmp mystic_family behavioral1/memory/2348-21-0x0000000000400000-0x0000000000434000-memory.dmp mystic_family behavioral1/memory/2348-25-0x0000000000400000-0x0000000000434000-memory.dmp mystic_family -
Processes:
AppLaunch.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 4 IoCs
Processes:
XP3ZS95.exe1Ct04Vl5.exe2Uo6408.exe3LC43Hg.exepid process 2744 XP3ZS95.exe 2828 1Ct04Vl5.exe 3100 2Uo6408.exe 1968 3LC43Hg.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
91cc08eaa2d516fe6b48ecf473dac67146c347e939a09646e1e141008e82003b.exeXP3ZS95.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 91cc08eaa2d516fe6b48ecf473dac67146c347e939a09646e1e141008e82003b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" XP3ZS95.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
1Ct04Vl5.exe2Uo6408.exedescription pid process target process PID 2828 set thread context of 3180 2828 1Ct04Vl5.exe AppLaunch.exe PID 3100 set thread context of 2348 3100 2Uo6408.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1196 2348 WerFault.exe AppLaunch.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
3LC43Hg.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3LC43Hg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3LC43Hg.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3LC43Hg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
3LC43Hg.exeAppLaunch.exepid process 1968 3LC43Hg.exe 1968 3LC43Hg.exe 3180 AppLaunch.exe 3180 AppLaunch.exe 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 3416 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3416 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
3LC43Hg.exepid process 1968 3LC43Hg.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 3180 AppLaunch.exe Token: SeShutdownPrivilege 3416 Token: SeCreatePagefilePrivilege 3416 -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
pid process 3416 -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
91cc08eaa2d516fe6b48ecf473dac67146c347e939a09646e1e141008e82003b.exeXP3ZS95.exe1Ct04Vl5.exe2Uo6408.exedescription pid process target process PID 2824 wrote to memory of 2744 2824 91cc08eaa2d516fe6b48ecf473dac67146c347e939a09646e1e141008e82003b.exe XP3ZS95.exe PID 2824 wrote to memory of 2744 2824 91cc08eaa2d516fe6b48ecf473dac67146c347e939a09646e1e141008e82003b.exe XP3ZS95.exe PID 2824 wrote to memory of 2744 2824 91cc08eaa2d516fe6b48ecf473dac67146c347e939a09646e1e141008e82003b.exe XP3ZS95.exe PID 2744 wrote to memory of 2828 2744 XP3ZS95.exe 1Ct04Vl5.exe PID 2744 wrote to memory of 2828 2744 XP3ZS95.exe 1Ct04Vl5.exe PID 2744 wrote to memory of 2828 2744 XP3ZS95.exe 1Ct04Vl5.exe PID 2828 wrote to memory of 3180 2828 1Ct04Vl5.exe AppLaunch.exe PID 2828 wrote to memory of 3180 2828 1Ct04Vl5.exe AppLaunch.exe PID 2828 wrote to memory of 3180 2828 1Ct04Vl5.exe AppLaunch.exe PID 2828 wrote to memory of 3180 2828 1Ct04Vl5.exe AppLaunch.exe PID 2828 wrote to memory of 3180 2828 1Ct04Vl5.exe AppLaunch.exe PID 2828 wrote to memory of 3180 2828 1Ct04Vl5.exe AppLaunch.exe PID 2828 wrote to memory of 3180 2828 1Ct04Vl5.exe AppLaunch.exe PID 2828 wrote to memory of 3180 2828 1Ct04Vl5.exe AppLaunch.exe PID 2744 wrote to memory of 3100 2744 XP3ZS95.exe 2Uo6408.exe PID 2744 wrote to memory of 3100 2744 XP3ZS95.exe 2Uo6408.exe PID 2744 wrote to memory of 3100 2744 XP3ZS95.exe 2Uo6408.exe PID 3100 wrote to memory of 2348 3100 2Uo6408.exe AppLaunch.exe PID 3100 wrote to memory of 2348 3100 2Uo6408.exe AppLaunch.exe PID 3100 wrote to memory of 2348 3100 2Uo6408.exe AppLaunch.exe PID 3100 wrote to memory of 2348 3100 2Uo6408.exe AppLaunch.exe PID 3100 wrote to memory of 2348 3100 2Uo6408.exe AppLaunch.exe PID 3100 wrote to memory of 2348 3100 2Uo6408.exe AppLaunch.exe PID 3100 wrote to memory of 2348 3100 2Uo6408.exe AppLaunch.exe PID 3100 wrote to memory of 2348 3100 2Uo6408.exe AppLaunch.exe PID 3100 wrote to memory of 2348 3100 2Uo6408.exe AppLaunch.exe PID 3100 wrote to memory of 2348 3100 2Uo6408.exe AppLaunch.exe PID 2824 wrote to memory of 1968 2824 91cc08eaa2d516fe6b48ecf473dac67146c347e939a09646e1e141008e82003b.exe 3LC43Hg.exe PID 2824 wrote to memory of 1968 2824 91cc08eaa2d516fe6b48ecf473dac67146c347e939a09646e1e141008e82003b.exe 3LC43Hg.exe PID 2824 wrote to memory of 1968 2824 91cc08eaa2d516fe6b48ecf473dac67146c347e939a09646e1e141008e82003b.exe 3LC43Hg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\91cc08eaa2d516fe6b48ecf473dac67146c347e939a09646e1e141008e82003b.exe"C:\Users\Admin\AppData\Local\Temp\91cc08eaa2d516fe6b48ecf473dac67146c347e939a09646e1e141008e82003b.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\XP3ZS95.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\XP3ZS95.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Ct04Vl5.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Ct04Vl5.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Uo6408.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Uo6408.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 5405⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3LC43Hg.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3LC43Hg.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2348 -ip 23481⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3LC43Hg.exeFilesize
31KB
MD516634b87b4b7ce5c0f7890a3e346872a
SHA183b847720559d7df3ea5012a02b3fdd7e237453c
SHA2560d6b117dd39fa10e7222511eb6b8cd523697afd628578dcdec9afe07a7981102
SHA512de83082d9df19f62f39bc622ce9aa4dde4434f2cb587689e6a98162b4b71e170bbebad31c29b075f4ca77963c500e91e1f0b59519a5a99408f60701afcc041f7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3LC43Hg.exeFilesize
31KB
MD516634b87b4b7ce5c0f7890a3e346872a
SHA183b847720559d7df3ea5012a02b3fdd7e237453c
SHA2560d6b117dd39fa10e7222511eb6b8cd523697afd628578dcdec9afe07a7981102
SHA512de83082d9df19f62f39bc622ce9aa4dde4434f2cb587689e6a98162b4b71e170bbebad31c29b075f4ca77963c500e91e1f0b59519a5a99408f60701afcc041f7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\XP3ZS95.exeFilesize
528KB
MD590f8d6aa2d0ac143af8b2325da31d0f1
SHA1dded159f748c5b6981b65d9cc17eb38821018a71
SHA256559ef6d007b8d5f9e158db0a3cc1874510f3dcbfc70d9616684a1fb0eb874410
SHA512a1efb35396faa1dced8e63d6a93ad1b9764921662bc1005e523fb465735818972c68ad7caa0dfb30d481190f57acd8f880cc197df72eaddd6c9c7ac5ca401816
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\XP3ZS95.exeFilesize
528KB
MD590f8d6aa2d0ac143af8b2325da31d0f1
SHA1dded159f748c5b6981b65d9cc17eb38821018a71
SHA256559ef6d007b8d5f9e158db0a3cc1874510f3dcbfc70d9616684a1fb0eb874410
SHA512a1efb35396faa1dced8e63d6a93ad1b9764921662bc1005e523fb465735818972c68ad7caa0dfb30d481190f57acd8f880cc197df72eaddd6c9c7ac5ca401816
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Ct04Vl5.exeFilesize
869KB
MD516845166d35dce3b8448951e5bae39a1
SHA14ecec929c2ffee9da37f8d286043fba01f7b012b
SHA256357f0652da4463cca48b419ada2fb7f1455f9661636bb2aa0413537e5efaf06f
SHA512eb3cf083503932f2b66daa7030f6bfb1e2ac37b3f5aa37f6ffbcbbc2fe5e184162cd94d6fec66542920845842e4d787b6038a0bfb0c71c9852fd513a24d0cbde
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Ct04Vl5.exeFilesize
869KB
MD516845166d35dce3b8448951e5bae39a1
SHA14ecec929c2ffee9da37f8d286043fba01f7b012b
SHA256357f0652da4463cca48b419ada2fb7f1455f9661636bb2aa0413537e5efaf06f
SHA512eb3cf083503932f2b66daa7030f6bfb1e2ac37b3f5aa37f6ffbcbbc2fe5e184162cd94d6fec66542920845842e4d787b6038a0bfb0c71c9852fd513a24d0cbde
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Uo6408.exeFilesize
1.0MB
MD5178f95576ac414f0543a919a98ac21da
SHA12abc8ab9b61c9e3615dfbaa9059e15f7c57eb27b
SHA256a761e031c130c1308e0d02fe5eb0eeaff66e92e1a70a693a968f53bbb197ffd8
SHA512f7ef1fb8f14bf799806d1eb8fe2835c20230c2234a64ed9ce22c8e5a1751bc74d4a27aece973c6becbefc04b82a3e3a8b5c42521235e0781dddd6fdac344baaa
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Uo6408.exeFilesize
1.0MB
MD5178f95576ac414f0543a919a98ac21da
SHA12abc8ab9b61c9e3615dfbaa9059e15f7c57eb27b
SHA256a761e031c130c1308e0d02fe5eb0eeaff66e92e1a70a693a968f53bbb197ffd8
SHA512f7ef1fb8f14bf799806d1eb8fe2835c20230c2234a64ed9ce22c8e5a1751bc74d4a27aece973c6becbefc04b82a3e3a8b5c42521235e0781dddd6fdac344baaa
-
memory/1968-27-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1968-29-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2348-19-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/2348-21-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/2348-20-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/2348-25-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/3180-18-0x0000000073F30000-0x00000000746E0000-memory.dmpFilesize
7.7MB
-
memory/3180-14-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/3180-33-0x0000000073F30000-0x00000000746E0000-memory.dmpFilesize
7.7MB
-
memory/3416-28-0x0000000002630000-0x0000000002646000-memory.dmpFilesize
88KB