Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2023 10:09
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20231023-en
General
-
Target
file.exe
-
Size
289KB
-
MD5
7b2694fbd18027cab40a8abc91771870
-
SHA1
e8b39277a0c4bc60828ca09c98e94b5dfe805c73
-
SHA256
aae3c6355f071ad180886c69ba02ed8eeb21c4a7731dfd06f8da3f02aa3c89d0
-
SHA512
5048d7162056c8b195f3d945d0b8d513d714578fe41b44fb649f4ec9963f0fb25d9941984e85d4b48fda4ff0727c40e3563829cb0469663d8c2cc4380cb9a150
-
SSDEEP
3072:aB66tgSde3MJHwDrDegBACPzWeFmH5m/2U9sCQj+b:69tJGp7BA3eFmIL9p
Malware Config
Extracted
smokeloader
2022
http://onualituyrs.org/
http://sumagulituyo.org/
http://snukerukeutit.org/
http://lightseinsteniki.org/
http://liuliuoumumy.org/
http://stualialuyastrelia.net/
http://kumbuyartyty.net/
http://criogetikfenbut.org/
http://tonimiuyaytre.org/
http://tyiuiunuewqy.org/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
file.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
file.exepid process 2492 file.exe 2492 file.exe 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 3276 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
file.exepid process 2492 file.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 3276 Token: SeCreatePagefilePrivilege 3276 Token: SeShutdownPrivilege 3276 Token: SeCreatePagefilePrivilege 3276
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2492-9-0x00000000001C0000-0x00000000001CB000-memory.dmpFilesize
44KB
-
memory/2492-2-0x00000000001C0000-0x00000000001CB000-memory.dmpFilesize
44KB
-
memory/2492-3-0x0000000000400000-0x0000000002AC0000-memory.dmpFilesize
38.8MB
-
memory/2492-1-0x0000000002CF0000-0x0000000002DF0000-memory.dmpFilesize
1024KB
-
memory/2492-4-0x0000000000400000-0x0000000002AC0000-memory.dmpFilesize
38.8MB
-
memory/3276-24-0x0000000002AD0000-0x0000000002AE0000-memory.dmpFilesize
64KB
-
memory/3276-25-0x0000000002AD0000-0x0000000002AE0000-memory.dmpFilesize
64KB
-
memory/3276-11-0x0000000002AD0000-0x0000000002AE0000-memory.dmpFilesize
64KB
-
memory/3276-12-0x0000000002320000-0x0000000002330000-memory.dmpFilesize
64KB
-
memory/3276-13-0x0000000002AD0000-0x0000000002AE0000-memory.dmpFilesize
64KB
-
memory/3276-14-0x0000000002AD0000-0x0000000002AE0000-memory.dmpFilesize
64KB
-
memory/3276-15-0x0000000002AD0000-0x0000000002AE0000-memory.dmpFilesize
64KB
-
memory/3276-17-0x0000000002AD0000-0x0000000002AE0000-memory.dmpFilesize
64KB
-
memory/3276-16-0x0000000002AD0000-0x0000000002AE0000-memory.dmpFilesize
64KB
-
memory/3276-19-0x0000000002AD0000-0x0000000002AE0000-memory.dmpFilesize
64KB
-
memory/3276-20-0x0000000002AD0000-0x0000000002AE0000-memory.dmpFilesize
64KB
-
memory/3276-22-0x0000000002AD0000-0x0000000002AE0000-memory.dmpFilesize
64KB
-
memory/3276-21-0x0000000002AD0000-0x0000000002AE0000-memory.dmpFilesize
64KB
-
memory/3276-5-0x00000000022F0000-0x0000000002306000-memory.dmpFilesize
88KB
-
memory/3276-23-0x0000000002320000-0x0000000002330000-memory.dmpFilesize
64KB
-
memory/3276-10-0x0000000002AD0000-0x0000000002AE0000-memory.dmpFilesize
64KB
-
memory/3276-27-0x0000000002AD0000-0x0000000002AE0000-memory.dmpFilesize
64KB
-
memory/3276-26-0x0000000002320000-0x0000000002330000-memory.dmpFilesize
64KB
-
memory/3276-30-0x0000000002AD0000-0x0000000002AE0000-memory.dmpFilesize
64KB
-
memory/3276-29-0x0000000002AD0000-0x0000000002AE0000-memory.dmpFilesize
64KB
-
memory/3276-32-0x0000000002AD0000-0x0000000002AE0000-memory.dmpFilesize
64KB
-
memory/3276-35-0x0000000002AD0000-0x0000000002AE0000-memory.dmpFilesize
64KB
-
memory/3276-34-0x0000000002AD0000-0x0000000002AE0000-memory.dmpFilesize
64KB
-
memory/3276-36-0x0000000002AD0000-0x0000000002AE0000-memory.dmpFilesize
64KB
-
memory/3276-37-0x0000000002AD0000-0x0000000002AE0000-memory.dmpFilesize
64KB
-
memory/3276-39-0x0000000002AD0000-0x0000000002AE0000-memory.dmpFilesize
64KB
-
memory/3276-40-0x0000000002AD0000-0x0000000002AE0000-memory.dmpFilesize
64KB
-
memory/3276-41-0x0000000002AD0000-0x0000000002AE0000-memory.dmpFilesize
64KB
-
memory/3276-43-0x0000000002AD0000-0x0000000002AE0000-memory.dmpFilesize
64KB
-
memory/3276-42-0x0000000002AD0000-0x0000000002AE0000-memory.dmpFilesize
64KB
-
memory/3276-44-0x0000000002AD0000-0x0000000002AE0000-memory.dmpFilesize
64KB