Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20231130-en -
resource tags
arch:x64arch:x86image:win7-20231130-enlocale:en-usos:windows7-x64system -
submitted
04-12-2023 01:37
Static task
static1
Behavioral task
behavioral1
Sample
9705b269886bfc7a262c12486f5e6802.exe
Resource
win7-20231130-en
Behavioral task
behavioral2
Sample
9705b269886bfc7a262c12486f5e6802.exe
Resource
win10v2004-20231127-en
General
-
Target
9705b269886bfc7a262c12486f5e6802.exe
-
Size
181KB
-
MD5
9705b269886bfc7a262c12486f5e6802
-
SHA1
a9cb5931ddcc0cf8e5b886270bffdd14472e5248
-
SHA256
ed51744a40d59eb9079f26bbb57ddc76bf4b9d60ee1d575adf731b2571559ceb
-
SHA512
5b23708a0f57a4e05533593f9fa9a85bc5f5201c98d6c6684151f33c764710f1988f7029af79e2c7bf45a1513495567e48f0d18b9efd534d84fdab9d1603cde6
-
SSDEEP
3072:OBfsGpcW25Gp+VIVnZqJQ1m9yGV0iT1gOcKFxq25KnB+WWxm78w2AAAvSFfG:SsGckEKnZU2GVBgWKB+hgv2A+G
Malware Config
Extracted
smokeloader
6699
Extracted
smokeloader
2022
http://atillapro.com/
https://atillapro.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1356 -
Executes dropped EXE 2 IoCs
Processes:
iifvbbfiifvbbfpid process 2788 iifvbbf 2772 iifvbbf -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
9705b269886bfc7a262c12486f5e6802.exeiifvbbfdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Windows\CurrentVersion\Run\UnitySetup = "C:\\Users\\Public\\UnityStub.exe" 9705b269886bfc7a262c12486f5e6802.exe Set value (str) \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Windows\CurrentVersion\Run\UnitySetup = "C:\\Users\\Public\\UnityStub.exe" iifvbbf -
Suspicious use of SetThreadContext 2 IoCs
Processes:
9705b269886bfc7a262c12486f5e6802.exeiifvbbfdescription pid process target process PID 2340 set thread context of 2784 2340 9705b269886bfc7a262c12486f5e6802.exe 9705b269886bfc7a262c12486f5e6802.exe PID 2788 set thread context of 2772 2788 iifvbbf iifvbbf -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
9705b269886bfc7a262c12486f5e6802.exeiifvbbfdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9705b269886bfc7a262c12486f5e6802.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9705b269886bfc7a262c12486f5e6802.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9705b269886bfc7a262c12486f5e6802.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI iifvbbf Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI iifvbbf Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI iifvbbf -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
9705b269886bfc7a262c12486f5e6802.exepid process 2784 9705b269886bfc7a262c12486f5e6802.exe 2784 9705b269886bfc7a262c12486f5e6802.exe 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1356 -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
9705b269886bfc7a262c12486f5e6802.exe9705b269886bfc7a262c12486f5e6802.exeiifvbbfiifvbbfpid process 2340 9705b269886bfc7a262c12486f5e6802.exe 2340 9705b269886bfc7a262c12486f5e6802.exe 2340 9705b269886bfc7a262c12486f5e6802.exe 2784 9705b269886bfc7a262c12486f5e6802.exe 2788 iifvbbf 2772 iifvbbf -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
9705b269886bfc7a262c12486f5e6802.exetaskeng.exeiifvbbfdescription pid process target process PID 2340 wrote to memory of 1952 2340 9705b269886bfc7a262c12486f5e6802.exe 9705b269886bfc7a262c12486f5e6802.exe PID 2340 wrote to memory of 1952 2340 9705b269886bfc7a262c12486f5e6802.exe 9705b269886bfc7a262c12486f5e6802.exe PID 2340 wrote to memory of 1952 2340 9705b269886bfc7a262c12486f5e6802.exe 9705b269886bfc7a262c12486f5e6802.exe PID 2340 wrote to memory of 1952 2340 9705b269886bfc7a262c12486f5e6802.exe 9705b269886bfc7a262c12486f5e6802.exe PID 2340 wrote to memory of 2792 2340 9705b269886bfc7a262c12486f5e6802.exe 9705b269886bfc7a262c12486f5e6802.exe PID 2340 wrote to memory of 2792 2340 9705b269886bfc7a262c12486f5e6802.exe 9705b269886bfc7a262c12486f5e6802.exe PID 2340 wrote to memory of 2792 2340 9705b269886bfc7a262c12486f5e6802.exe 9705b269886bfc7a262c12486f5e6802.exe PID 2340 wrote to memory of 2792 2340 9705b269886bfc7a262c12486f5e6802.exe 9705b269886bfc7a262c12486f5e6802.exe PID 2340 wrote to memory of 2784 2340 9705b269886bfc7a262c12486f5e6802.exe 9705b269886bfc7a262c12486f5e6802.exe PID 2340 wrote to memory of 2784 2340 9705b269886bfc7a262c12486f5e6802.exe 9705b269886bfc7a262c12486f5e6802.exe PID 2340 wrote to memory of 2784 2340 9705b269886bfc7a262c12486f5e6802.exe 9705b269886bfc7a262c12486f5e6802.exe PID 2340 wrote to memory of 2784 2340 9705b269886bfc7a262c12486f5e6802.exe 9705b269886bfc7a262c12486f5e6802.exe PID 2340 wrote to memory of 2784 2340 9705b269886bfc7a262c12486f5e6802.exe 9705b269886bfc7a262c12486f5e6802.exe PID 3056 wrote to memory of 2788 3056 taskeng.exe iifvbbf PID 3056 wrote to memory of 2788 3056 taskeng.exe iifvbbf PID 3056 wrote to memory of 2788 3056 taskeng.exe iifvbbf PID 3056 wrote to memory of 2788 3056 taskeng.exe iifvbbf PID 2788 wrote to memory of 2772 2788 iifvbbf iifvbbf PID 2788 wrote to memory of 2772 2788 iifvbbf iifvbbf PID 2788 wrote to memory of 2772 2788 iifvbbf iifvbbf PID 2788 wrote to memory of 2772 2788 iifvbbf iifvbbf PID 2788 wrote to memory of 2772 2788 iifvbbf iifvbbf -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\9705b269886bfc7a262c12486f5e6802.exe"C:\Users\Admin\AppData\Local\Temp\9705b269886bfc7a262c12486f5e6802.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9705b269886bfc7a262c12486f5e6802.exe"C:\Users\Admin\AppData\Local\Temp\9705b269886bfc7a262c12486f5e6802.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\9705b269886bfc7a262c12486f5e6802.exe"C:\Users\Admin\AppData\Local\Temp\9705b269886bfc7a262c12486f5e6802.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\9705b269886bfc7a262c12486f5e6802.exe"C:\Users\Admin\AppData\Local\Temp\9705b269886bfc7a262c12486f5e6802.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\taskeng.exetaskeng.exe {9944E07A-E200-403B-BD45-DDCF5A746CB6} S-1-5-21-2058106572-1146578376-825901627-1000:LPKQNNGV\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\iifvbbfC:\Users\Admin\AppData\Roaming\iifvbbf2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\iifvbbf"C:\Users\Admin\AppData\Roaming\iifvbbf"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\iifvbbfFilesize
181KB
MD59705b269886bfc7a262c12486f5e6802
SHA1a9cb5931ddcc0cf8e5b886270bffdd14472e5248
SHA256ed51744a40d59eb9079f26bbb57ddc76bf4b9d60ee1d575adf731b2571559ceb
SHA5125b23708a0f57a4e05533593f9fa9a85bc5f5201c98d6c6684151f33c764710f1988f7029af79e2c7bf45a1513495567e48f0d18b9efd534d84fdab9d1603cde6
-
C:\Users\Admin\AppData\Roaming\iifvbbfFilesize
181KB
MD59705b269886bfc7a262c12486f5e6802
SHA1a9cb5931ddcc0cf8e5b886270bffdd14472e5248
SHA256ed51744a40d59eb9079f26bbb57ddc76bf4b9d60ee1d575adf731b2571559ceb
SHA5125b23708a0f57a4e05533593f9fa9a85bc5f5201c98d6c6684151f33c764710f1988f7029af79e2c7bf45a1513495567e48f0d18b9efd534d84fdab9d1603cde6
-
C:\Users\Admin\AppData\Roaming\iifvbbfFilesize
181KB
MD59705b269886bfc7a262c12486f5e6802
SHA1a9cb5931ddcc0cf8e5b886270bffdd14472e5248
SHA256ed51744a40d59eb9079f26bbb57ddc76bf4b9d60ee1d575adf731b2571559ceb
SHA5125b23708a0f57a4e05533593f9fa9a85bc5f5201c98d6c6684151f33c764710f1988f7029af79e2c7bf45a1513495567e48f0d18b9efd534d84fdab9d1603cde6
-
C:\Users\Public\UnityStub.exeFilesize
181KB
MD59705b269886bfc7a262c12486f5e6802
SHA1a9cb5931ddcc0cf8e5b886270bffdd14472e5248
SHA256ed51744a40d59eb9079f26bbb57ddc76bf4b9d60ee1d575adf731b2571559ceb
SHA5125b23708a0f57a4e05533593f9fa9a85bc5f5201c98d6c6684151f33c764710f1988f7029af79e2c7bf45a1513495567e48f0d18b9efd534d84fdab9d1603cde6
-
C:\Users\Public\UnityStub.exeFilesize
181KB
MD59705b269886bfc7a262c12486f5e6802
SHA1a9cb5931ddcc0cf8e5b886270bffdd14472e5248
SHA256ed51744a40d59eb9079f26bbb57ddc76bf4b9d60ee1d575adf731b2571559ceb
SHA5125b23708a0f57a4e05533593f9fa9a85bc5f5201c98d6c6684151f33c764710f1988f7029af79e2c7bf45a1513495567e48f0d18b9efd534d84fdab9d1603cde6
-
memory/1356-6-0x0000000002540000-0x0000000002556000-memory.dmpFilesize
88KB
-
memory/1356-21-0x0000000002560000-0x0000000002576000-memory.dmpFilesize
88KB
-
memory/2340-1-0x0000000000130000-0x0000000000133000-memory.dmpFilesize
12KB
-
memory/2340-2-0x0000000000810000-0x000000000096C000-memory.dmpFilesize
1.4MB
-
memory/2772-22-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2784-7-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2784-5-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2784-4-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2788-17-0x0000000000790000-0x00000000008EC000-memory.dmpFilesize
1.4MB