Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20231127-en - resource tags
- submitted
08/12/2023, 18:38
General
- Target file.exe
- Size 230KB
- Sample231208-w92pgabgel
- SHA256 f7f44a469cdf8049c9da6fb5b1e2fdbb4e3d1cf2f09ef0eba5889dea7ef80a97
Malware Config
Extracted
-
smokeloader
-
pub4
Extracted
-
smokeloader
-
2022
-
http://humydrole.com/tmp/index.php
-
http://trunk-co.ru/tmp/index.php
-
http://weareelight.com/tmp/index.php
-
http://pirateking.online/tmp/index.php
-
http://piratia.pw/tmp/index.php
-
http://go-piratia.ru/tmp/index.php
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Deletes itself 1 IoCs
- Executes dropped EXE 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\uuiagsjC:\Users\Admin\AppData\Roaming\uuiagsj1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
store.jfm
uuiagsj
uuiagsj
memory/832-52-0x0000021DC6A70000-0x0000021DC6A71000-memory.dmp
memory/832-55-0x0000021DC6690000-0x0000021DC6691000-memory.dmp
memory/832-11-0x0000021DBE360000-0x0000021DBE370000-memory.dmp
memory/832-27-0x0000021DBE460000-0x0000021DBE470000-memory.dmp
memory/832-43-0x0000021DC6A50000-0x0000021DC6A51000-memory.dmp
memory/832-44-0x0000021DC6A70000-0x0000021DC6A71000-memory.dmp
memory/832-45-0x0000021DC6A70000-0x0000021DC6A71000-memory.dmp
memory/832-46-0x0000021DC6A70000-0x0000021DC6A71000-memory.dmp
memory/832-47-0x0000021DC6A70000-0x0000021DC6A71000-memory.dmp
memory/832-48-0x0000021DC6A70000-0x0000021DC6A71000-memory.dmp
memory/832-49-0x0000021DC6A70000-0x0000021DC6A71000-memory.dmp
memory/832-50-0x0000021DC6A70000-0x0000021DC6A71000-memory.dmp
memory/832-51-0x0000021DC6A70000-0x0000021DC6A71000-memory.dmp
memory/832-79-0x0000021DC68F0000-0x0000021DC68F1000-memory.dmp
memory/832-78-0x0000021DC67E0000-0x0000021DC67E1000-memory.dmp
memory/832-53-0x0000021DC6A70000-0x0000021DC6A71000-memory.dmp
memory/832-60-0x0000021DC6690000-0x0000021DC6691000-memory.dmp
memory/832-57-0x0000021DC66A0000-0x0000021DC66A1000-memory.dmp
memory/832-54-0x0000021DC66A0000-0x0000021DC66A1000-memory.dmp
memory/832-63-0x0000021DC65D0000-0x0000021DC65D1000-memory.dmp
memory/832-77-0x0000021DC67E0000-0x0000021DC67E1000-memory.dmp
memory/832-75-0x0000021DC67D0000-0x0000021DC67D1000-memory.dmp
memory/2216-83-0x00000000009D0000-0x0000000000AD0000-memory.dmp
memory/2216-84-0x0000000000400000-0x000000000085C000-memory.dmp
memory/2216-88-0x0000000000400000-0x000000000085C000-memory.dmp
memory/3380-4-0x0000000002370000-0x0000000002386000-memory.dmp
memory/3380-85-0x0000000007F50000-0x0000000007F66000-memory.dmp
memory/4620-5-0x0000000000400000-0x000000000085C000-memory.dmp
memory/4620-2-0x00000000009E0000-0x00000000009EB000-memory.dmp
memory/4620-3-0x0000000000400000-0x000000000085C000-memory.dmp
memory/4620-1-0x0000000000880000-0x0000000000980000-memory.dmp