Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231127-en - resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system - submitted
13/12/2023, 19:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dd4979e886bd46b6a5c618eb78b4525f36d3fa6ea9c6abb14e42ffa177a46ced.exe
Resource
win7-20231023-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
dd4979e886bd46b6a5c618eb78b4525f36d3fa6ea9c6abb14e42ffa177a46ced.exe
Resource
win10v2004-20231127-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target dd4979e886bd46b6a5c618eb78b4525f36d3fa6ea9c6abb14e42ffa177a46ced.exe
- Size 909KB
- Sample231213-x4pcmaaah9
- SHA256 dd4979e886bd46b6a5c618eb78b4525f36d3fa6ea9c6abb14e42ffa177a46ced
- MD5 dfd8798cfe88efc66b69d0be9671d323
- SHA1 681208a9da99e1af723e9d55f0222443c0e3a69c
- SHA512 d922e3b66b0c36984480b6a034956da0cbb5d72581517d632bbe6dad2be5742af93de792cdbe5aa61926faae37c5cb1ea97c6e847c42a12687ba008dfd94fb27
- SSDEEP 12288:oH1HR7Fa2dALbyZa5uHZfT6SQxDmh1nDm2yW+IcukidPGn:IE2dALbyZa5uHJ05mh1Vp
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2022
C2
-
http://77.91.68.29/fks/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 968 set thread context of 2840 968 dd4979e886bd46b6a5c618eb78b4525f36d3fa6ea9c6abb14e42ffa177a46ced.exe 86 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2840 AppLaunch.exe 2840 AppLaunch.exe 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found 3196 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2840 AppLaunch.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3196 Process not Found - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 968 wrote to memory of 2840 968 dd4979e886bd46b6a5c618eb78b4525f36d3fa6ea9c6abb14e42ffa177a46ced.exe 86 PID 968 wrote to memory of 2840 968 dd4979e886bd46b6a5c618eb78b4525f36d3fa6ea9c6abb14e42ffa177a46ced.exe 86 PID 968 wrote to memory of 2840 968 dd4979e886bd46b6a5c618eb78b4525f36d3fa6ea9c6abb14e42ffa177a46ced.exe 86 PID 968 wrote to memory of 2840 968 dd4979e886bd46b6a5c618eb78b4525f36d3fa6ea9c6abb14e42ffa177a46ced.exe 86 PID 968 wrote to memory of 2840 968 dd4979e886bd46b6a5c618eb78b4525f36d3fa6ea9c6abb14e42ffa177a46ced.exe 86 PID 968 wrote to memory of 2840 968 dd4979e886bd46b6a5c618eb78b4525f36d3fa6ea9c6abb14e42ffa177a46ced.exe 86 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd4979e886bd46b6a5c618eb78b4525f36d3fa6ea9c6abb14e42ffa177a46ced.exe"C:\Users\Admin\AppData\Local\Temp\dd4979e886bd46b6a5c618eb78b4525f36d3fa6ea9c6abb14e42ffa177a46ced.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2840
-