Analysis
-
max time kernel
123s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
27/11/2023, 15:24
General
-
Target
b92f9a4d53ddaa32a6a42d348744cabd.exe
-
Size
289KB
-
MD5
b92f9a4d53ddaa32a6a42d348744cabd
-
SHA1
d70ee7a27b5c376552c1f62d70efefc68d6d5a50
-
SHA256
0e1c1f54576e5ea6f024852228ef877537849db15a46633d77e36d8439e9609a
-
SHA512
747ffb90b0744964ed3ebc459c9b965937e68ee52c554987e7af20b7769310594c92948f4e3db849ace24fff015b8663063e9ffcf7b604b11d036a3c67685d3e
-
SSDEEP
3072:B52jCnuzHwEtL4O/S1NUATrBcN11F0p0alESA38ItQ5mESUem9Qj+/:3wCnu7wEtLp/MUATgv8IC/H
Malware Config
Extracted
smokeloader
up4
Extracted
smokeloader
2020
http://host-file-file0.com/
http://file-file-file1.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
Deletes itself 1 IoCs
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 39 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 11 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 30 IoCs
-
Suspicious use of FindShellTrayWindow 16 IoCs
-
Suspicious use of SendNotifyMessage 11 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b92f9a4d53ddaa32a6a42d348744cabd.exe"C:\Users\Admin\AppData\Local\Temp\b92f9a4d53ddaa32a6a42d348744cabd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b92f9a4d53ddaa32a6a42d348744cabd.exe"C:\Users\Admin\AppData\Local\Temp\b92f9a4d53ddaa32a6a42d348744cabd.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
471B
MD5eaefbc8a7aff289b5c7916717bed1f92
SHA1e78cf69ea8805f083ddabbab29c675753ed81555
SHA25607b7338e63a59d68f7901bb2942a11fcb97eac798efb7008f0c37622a063b70a
SHA512e1f41b1b75e6a0651529a9046f7c9e1c8616ce62099a6515a0d60ae4c32781d483873d2fc62990f5bc7a1da8269c18455c65c2650dfaf0bbe7930d6dd478c28a
-
Filesize
412B
MD5459375181ae48139d88ffb1eb874d692
SHA1286e66c920ef5307c9c8fe01275eb3304086bb30
SHA2560bd342e561eff9ac069a9bd9e980131c3bc14440c60cc75c2c35f4742bd2e8f9
SHA512e648ef0699eca4130410c9f6e6ff6a7edced31c894b5235db110d825f3d5135d051e9e1adfb59f802a00be57c15adc88279dd97fad731afce5e5369ffa6cfca0
-
Filesize
96B
MD525b98f558f0ca5ad449151322b6034e1
SHA1ce562dcce60d8dab8767a0cfafc3b0ef5458c546
SHA256bb763557ec01c0968c2c4e8d9414c197e9b1961a697c0fd99b8da3c67133740d
SHA5122c4bb59caa1715ab49ec45a44a5873698894fd13fe7aa84391b328014e99112d29d55da708e6d10e274937971e759159af4f429fb94cee29ba3d2211a5211275
-
Filesize
189B
MD50751037ff817aab149589294ee29c477
SHA148906b6daf490b5bd22866722cea357107977786
SHA256511f0f9980833c74dd211a84e0c8bb7e5b0b270d534f442ddb3ce4ca0ea0da02
SHA5120f929c557bdc731f54656210d47a5c7ce3b024fca0c922c1d8e47cddbda9c14b9446b177138a0d31f6e996281f208b15e935a33639302d4d1d5494d8e973d0f0
-
Filesize
96B
MD525b98f558f0ca5ad449151322b6034e1
SHA1ce562dcce60d8dab8767a0cfafc3b0ef5458c546
SHA256bb763557ec01c0968c2c4e8d9414c197e9b1961a697c0fd99b8da3c67133740d
SHA5122c4bb59caa1715ab49ec45a44a5873698894fd13fe7aa84391b328014e99112d29d55da708e6d10e274937971e759159af4f429fb94cee29ba3d2211a5211275
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
1024KB
-
Filesize
36KB
-
Filesize
4KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
88KB
-
Filesize
4KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
4KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
4KB