Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/12/2023, 18:01

General

  • Target

    6CB2CCD975A8A10FB54C0A407C2F8BE6.exe

  • Size

    270KB

  • MD5

    6cb2ccd975a8a10fb54c0a407c2f8be6

  • SHA1

    ff24085242fe52b5b59d5dd08a9698fcfea11aca

  • SHA256

    142aacbf783038ea4b2a7f2d9433b1309b413330e702b8a90e300eea1bbed4c8

  • SHA512

    e581dd1d87027bb97f71d2fadf352243390e154c931dcaa963a6b988426d6a8a39389239c88dfe0216520e3ad500f7564269899fde1e029361d378de475ca0e5

  • SSDEEP

    3072:S7cAUflrRS52tq7MjWGLSGEmNcJwJgpiDTmV0f5toMF4zrrVydGhvU2d:Wc5FqSq7AWG2scoTmVS4fpyd

Malware Config

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\6CB2CCD975A8A10FB54C0A407C2F8BE6.exe
    "C:\Users\Admin\AppData\Local\Temp\6CB2CCD975A8A10FB54C0A407C2F8BE6.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2284
    • C:\Users\Admin\AppData\Local\Temp\6CB2CCD975A8A10FB54C0A407C2F8BE6.exe
      "C:\Users\Admin\AppData\Local\Temp\6CB2CCD975A8A10FB54C0A407C2F8BE6.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:1404
  • C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
    1⤵
      PID:1476
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k UnistackSvcGroup
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4108

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

            Filesize

            16KB

            MD5

            2054bc73b7290fc5ec47f67255d2b09f

            SHA1

            258b6bf3792d65b58a2ee92820f0e450e8bfbef6

            SHA256

            41c015ad6b7ed18e73a5ae2eef492029b8d0cc73fd669ac4b4e4132000438373

            SHA512

            6629609dd8ee244f30d711c43dfd338b1cb1c3cf9f411332ffaf5e3dbc40db72f1d69404dd9090ca8154c99f734f37dc01c63faa4bddf0815c526c585f37a2b6

          • memory/1404-3-0x0000000000400000-0x0000000000409000-memory.dmp

            Filesize

            36KB

          • memory/1404-4-0x0000000000400000-0x0000000000409000-memory.dmp

            Filesize

            36KB

          • memory/1404-7-0x0000000000400000-0x0000000000409000-memory.dmp

            Filesize

            36KB

          • memory/2284-1-0x0000000000CF0000-0x0000000000DF0000-memory.dmp

            Filesize

            1024KB

          • memory/2284-2-0x00000000027A0000-0x00000000027A9000-memory.dmp

            Filesize

            36KB

          • memory/3144-5-0x0000000002DB0000-0x0000000002DC6000-memory.dmp

            Filesize

            88KB

          • memory/4108-50-0x000001E34BB90000-0x000001E34BB91000-memory.dmp

            Filesize

            4KB

          • memory/4108-54-0x000001E34BB90000-0x000001E34BB91000-memory.dmp

            Filesize

            4KB

          • memory/4108-45-0x000001E34BB90000-0x000001E34BB91000-memory.dmp

            Filesize

            4KB

          • memory/4108-46-0x000001E34BB90000-0x000001E34BB91000-memory.dmp

            Filesize

            4KB

          • memory/4108-47-0x000001E34BB90000-0x000001E34BB91000-memory.dmp

            Filesize

            4KB

          • memory/4108-48-0x000001E34BB90000-0x000001E34BB91000-memory.dmp

            Filesize

            4KB

          • memory/4108-49-0x000001E34BB90000-0x000001E34BB91000-memory.dmp

            Filesize

            4KB

          • memory/4108-28-0x000001E343580000-0x000001E343590000-memory.dmp

            Filesize

            64KB

          • memory/4108-51-0x000001E34BB90000-0x000001E34BB91000-memory.dmp

            Filesize

            4KB

          • memory/4108-52-0x000001E34BB90000-0x000001E34BB91000-memory.dmp

            Filesize

            4KB

          • memory/4108-53-0x000001E34BB90000-0x000001E34BB91000-memory.dmp

            Filesize

            4KB

          • memory/4108-44-0x000001E34BB70000-0x000001E34BB71000-memory.dmp

            Filesize

            4KB

          • memory/4108-56-0x000001E34B7B0000-0x000001E34B7B1000-memory.dmp

            Filesize

            4KB

          • memory/4108-55-0x000001E34B7C0000-0x000001E34B7C1000-memory.dmp

            Filesize

            4KB

          • memory/4108-58-0x000001E34B7C0000-0x000001E34B7C1000-memory.dmp

            Filesize

            4KB

          • memory/4108-61-0x000001E34B7B0000-0x000001E34B7B1000-memory.dmp

            Filesize

            4KB

          • memory/4108-64-0x000001E34B6F0000-0x000001E34B6F1000-memory.dmp

            Filesize

            4KB

          • memory/4108-12-0x000001E343480000-0x000001E343490000-memory.dmp

            Filesize

            64KB

          • memory/4108-76-0x000001E34B8F0000-0x000001E34B8F1000-memory.dmp

            Filesize

            4KB

          • memory/4108-78-0x000001E34B900000-0x000001E34B901000-memory.dmp

            Filesize

            4KB

          • memory/4108-79-0x000001E34B900000-0x000001E34B901000-memory.dmp

            Filesize

            4KB

          • memory/4108-80-0x000001E34BA10000-0x000001E34BA11000-memory.dmp

            Filesize

            4KB