Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22-12-2023 14:14
Static task
static1
Behavioral task
behavioral1
Sample
bb77ec808a0d3dca791c2cc72d2020af.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
bb77ec808a0d3dca791c2cc72d2020af.exe
Resource
win10v2004-20231215-en
General
-
Target
bb77ec808a0d3dca791c2cc72d2020af.exe
-
Size
144KB
-
MD5
bb77ec808a0d3dca791c2cc72d2020af
-
SHA1
4aa1f3abee7a2973419e264de3e58c26e6643752
-
SHA256
705662ead94a35c0ed94a959c96de51bef2fbe996dda6569cd90cfc65194fda3
-
SHA512
d417382cf812513ea8c688fbf4cdfa27394d1bf1d203f2947a53e7c9e36bf694a8e5acd8fc362694e9fd229fdf6240c13d39323b5657dffc2030453c4c486990
-
SSDEEP
3072:oZoPg8mxPh2FHWbk/4qzVzzpr5bRjRMkx:oiwhGKg7z11M
Malware Config
Extracted
smokeloader
2020
http://varmisende.com/upload/
http://fernandomayol.com/upload/
http://nextlytm.com/upload/
http://people4jan.com/upload/
http://asfaltwerk.com/upload/
Signatures
-
Modifies firewall policy service 2 TTPs 4 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile explorer.exe -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Sets file execution options in registry 2 TTPs 4 IoCs
Processes:
explorer.exeE80E.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "zqea.exe" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qi1q9375yw1.exe E80E.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qi1q9375yw1.exe\DisableExceptionChainValidation E80E.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explorer.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe -
Deletes itself 1 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE -
Executes dropped EXE 1 IoCs
Processes:
E80E.exepid process 2688 E80E.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Java Updater = "C:\\ProgramData\\Java Updater\\qi1q9375yw1.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\Java Updater = "\"C:\\ProgramData\\Java Updater\\qi1q9375yw1.exe\"" explorer.exe -
Processes:
E80E.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA E80E.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
Processes:
E80E.exeexplorer.exepid process 2688 E80E.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
bb77ec808a0d3dca791c2cc72d2020af.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bb77ec808a0d3dca791c2cc72d2020af.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bb77ec808a0d3dca791c2cc72d2020af.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bb77ec808a0d3dca791c2cc72d2020af.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
E80E.exeexplorer.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 E80E.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString E80E.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer explorer.exe -
Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" explorer.exe -
Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" explorer.exe -
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
bb77ec808a0d3dca791c2cc72d2020af.exeExplorer.EXEpid process 1880 bb77ec808a0d3dca791c2cc72d2020af.exe 1880 bb77ec808a0d3dca791c2cc72d2020af.exe 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
bb77ec808a0d3dca791c2cc72d2020af.exeE80E.exeexplorer.exepid process 1880 bb77ec808a0d3dca791c2cc72d2020af.exe 2688 E80E.exe 2688 E80E.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe -
Suspicious use of AdjustPrivilegeToken 29 IoCs
Processes:
E80E.exeexplorer.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 2688 E80E.exe Token: SeRestorePrivilege 2688 E80E.exe Token: SeBackupPrivilege 2688 E80E.exe Token: SeLoadDriverPrivilege 2688 E80E.exe Token: SeCreatePagefilePrivilege 2688 E80E.exe Token: SeShutdownPrivilege 2688 E80E.exe Token: SeTakeOwnershipPrivilege 2688 E80E.exe Token: SeChangeNotifyPrivilege 2688 E80E.exe Token: SeCreateTokenPrivilege 2688 E80E.exe Token: SeMachineAccountPrivilege 2688 E80E.exe Token: SeSecurityPrivilege 2688 E80E.exe Token: SeAssignPrimaryTokenPrivilege 2688 E80E.exe Token: SeCreateGlobalPrivilege 2688 E80E.exe Token: 33 2688 E80E.exe Token: SeDebugPrivilege 2740 explorer.exe Token: SeRestorePrivilege 2740 explorer.exe Token: SeBackupPrivilege 2740 explorer.exe Token: SeLoadDriverPrivilege 2740 explorer.exe Token: SeCreatePagefilePrivilege 2740 explorer.exe Token: SeShutdownPrivilege 2740 explorer.exe Token: SeTakeOwnershipPrivilege 2740 explorer.exe Token: SeChangeNotifyPrivilege 2740 explorer.exe Token: SeCreateTokenPrivilege 2740 explorer.exe Token: SeMachineAccountPrivilege 2740 explorer.exe Token: SeSecurityPrivilege 2740 explorer.exe Token: SeAssignPrimaryTokenPrivilege 2740 explorer.exe Token: SeCreateGlobalPrivilege 2740 explorer.exe Token: 33 2740 explorer.exe Token: SeShutdownPrivilege 1264 Explorer.EXE -
Suspicious use of WriteProcessMemory 35 IoCs
Processes:
Explorer.EXEE80E.exeexplorer.exedescription pid process target process PID 1264 wrote to memory of 2688 1264 Explorer.EXE E80E.exe PID 1264 wrote to memory of 2688 1264 Explorer.EXE E80E.exe PID 1264 wrote to memory of 2688 1264 Explorer.EXE E80E.exe PID 1264 wrote to memory of 2688 1264 Explorer.EXE E80E.exe PID 2688 wrote to memory of 2740 2688 E80E.exe explorer.exe PID 2688 wrote to memory of 2740 2688 E80E.exe explorer.exe PID 2688 wrote to memory of 2740 2688 E80E.exe explorer.exe PID 2688 wrote to memory of 2740 2688 E80E.exe explorer.exe PID 2688 wrote to memory of 2740 2688 E80E.exe explorer.exe PID 2688 wrote to memory of 2740 2688 E80E.exe explorer.exe PID 2688 wrote to memory of 2740 2688 E80E.exe explorer.exe PID 2740 wrote to memory of 1228 2740 explorer.exe Dwm.exe PID 2740 wrote to memory of 1228 2740 explorer.exe Dwm.exe PID 2740 wrote to memory of 1228 2740 explorer.exe Dwm.exe PID 2740 wrote to memory of 1228 2740 explorer.exe Dwm.exe PID 2740 wrote to memory of 1228 2740 explorer.exe Dwm.exe PID 2740 wrote to memory of 1228 2740 explorer.exe Dwm.exe PID 2740 wrote to memory of 1264 2740 explorer.exe Explorer.EXE PID 2740 wrote to memory of 1264 2740 explorer.exe Explorer.EXE PID 2740 wrote to memory of 1264 2740 explorer.exe Explorer.EXE PID 2740 wrote to memory of 1264 2740 explorer.exe Explorer.EXE PID 2740 wrote to memory of 1264 2740 explorer.exe Explorer.EXE PID 2740 wrote to memory of 1264 2740 explorer.exe Explorer.EXE PID 2740 wrote to memory of 2884 2740 explorer.exe DllHost.exe PID 2740 wrote to memory of 2884 2740 explorer.exe DllHost.exe PID 2740 wrote to memory of 2884 2740 explorer.exe DllHost.exe PID 2740 wrote to memory of 2884 2740 explorer.exe DllHost.exe PID 2740 wrote to memory of 2884 2740 explorer.exe DllHost.exe PID 2740 wrote to memory of 2884 2740 explorer.exe DllHost.exe PID 2740 wrote to memory of 2940 2740 explorer.exe WerFault.exe PID 2740 wrote to memory of 2940 2740 explorer.exe WerFault.exe PID 2740 wrote to memory of 2940 2740 explorer.exe WerFault.exe PID 2740 wrote to memory of 2940 2740 explorer.exe WerFault.exe PID 2740 wrote to memory of 2940 2740 explorer.exe WerFault.exe PID 2740 wrote to memory of 2940 2740 explorer.exe WerFault.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bb77ec808a0d3dca791c2cc72d2020af.exe"C:\Users\Admin\AppData\Local\Temp\bb77ec808a0d3dca791c2cc72d2020af.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\E80E.exeC:\Users\Admin\AppData\Local\Temp\E80E.exe2⤵
- Sets file execution options in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Modifies firewall policy service
- Sets file execution options in registry
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2884 -s 3882⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\E80E.exeFilesize
360KB
MD5e5c190fbfeeaad6ccccd410e006aabf5
SHA14241efe078d15132644015724fa2e1682aa70012
SHA256a20dcba5fd3bf777bc953aa6a248883c1a2a9536d4dc2d1296fc3ce061080509
SHA5123fdf563cef22e7ec81658ab9597c173371f72a2d00dd9126a443b7766a12bcb08b26bf6caed6c14a5a92917c04cf79f323cc6899c07f5b29f4feb4e5f2fc579f
-
memory/1228-67-0x0000000077911000-0x0000000077912000-memory.dmpFilesize
4KB
-
memory/1264-4-0x00000000029B0000-0x00000000029C5000-memory.dmpFilesize
84KB
-
memory/1264-51-0x0000000077911000-0x0000000077912000-memory.dmpFilesize
4KB
-
memory/1264-66-0x00000000029D0000-0x00000000029D6000-memory.dmpFilesize
24KB
-
memory/1880-2-0x0000000000020000-0x0000000000029000-memory.dmpFilesize
36KB
-
memory/1880-1-0x00000000022D0000-0x00000000023D0000-memory.dmpFilesize
1024KB
-
memory/1880-3-0x0000000000400000-0x0000000002142000-memory.dmpFilesize
29.3MB
-
memory/1880-5-0x0000000000400000-0x0000000002142000-memory.dmpFilesize
29.3MB
-
memory/2688-21-0x0000000000450000-0x000000000045D000-memory.dmpFilesize
52KB
-
memory/2688-20-0x0000000000300000-0x0000000000301000-memory.dmpFilesize
4KB
-
memory/2688-23-0x0000000000290000-0x00000000002F6000-memory.dmpFilesize
408KB
-
memory/2688-22-0x0000000077AB0000-0x0000000077AB1000-memory.dmpFilesize
4KB
-
memory/2688-24-0x0000000000690000-0x0000000000691000-memory.dmpFilesize
4KB
-
memory/2688-26-0x00000000006C0000-0x00000000006CC000-memory.dmpFilesize
48KB
-
memory/2688-27-0x0000000000290000-0x00000000002F6000-memory.dmpFilesize
408KB
-
memory/2688-28-0x0000000000290000-0x00000000002F6000-memory.dmpFilesize
408KB
-
memory/2688-39-0x00000000006B0000-0x00000000006B1000-memory.dmpFilesize
4KB
-
memory/2688-40-0x0000000000290000-0x00000000002F6000-memory.dmpFilesize
408KB
-
memory/2688-19-0x0000000000290000-0x00000000002F6000-memory.dmpFilesize
408KB
-
memory/2688-18-0x0000000000010000-0x000000000006D000-memory.dmpFilesize
372KB
-
memory/2740-36-0x0000000077AA0000-0x0000000077C21000-memory.dmpFilesize
1.5MB
-
memory/2740-54-0x0000000077AA0000-0x0000000077C21000-memory.dmpFilesize
1.5MB
-
memory/2740-34-0x00000000000E0000-0x00000000000E6000-memory.dmpFilesize
24KB
-
memory/2740-35-0x0000000077AA0000-0x0000000077C21000-memory.dmpFilesize
1.5MB
-
memory/2740-38-0x0000000077AA0000-0x0000000077C21000-memory.dmpFilesize
1.5MB
-
memory/2740-32-0x0000000000220000-0x00000000002E4000-memory.dmpFilesize
784KB
-
memory/2740-42-0x0000000077AA0000-0x0000000077C21000-memory.dmpFilesize
1.5MB
-
memory/2740-44-0x0000000000730000-0x000000000073C000-memory.dmpFilesize
48KB
-
memory/2740-41-0x0000000000220000-0x00000000002E4000-memory.dmpFilesize
784KB
-
memory/2740-45-0x0000000000220000-0x00000000002E4000-memory.dmpFilesize
784KB
-
memory/2740-46-0x0000000077AA0000-0x0000000077C21000-memory.dmpFilesize
1.5MB
-
memory/2740-47-0x0000000077AA0000-0x0000000077C21000-memory.dmpFilesize
1.5MB
-
memory/2740-48-0x0000000077AA0000-0x0000000077C21000-memory.dmpFilesize
1.5MB
-
memory/2740-49-0x0000000077AA0000-0x0000000077C21000-memory.dmpFilesize
1.5MB
-
memory/2740-50-0x0000000077AA0000-0x0000000077C21000-memory.dmpFilesize
1.5MB
-
memory/2740-52-0x0000000077AA0000-0x0000000077C21000-memory.dmpFilesize
1.5MB
-
memory/2740-53-0x0000000077AA0000-0x0000000077C21000-memory.dmpFilesize
1.5MB
-
memory/2740-33-0x0000000077AA0000-0x0000000077C21000-memory.dmpFilesize
1.5MB
-
memory/2740-55-0x0000000000220000-0x00000000002E4000-memory.dmpFilesize
784KB
-
memory/2740-56-0x00000000778C0000-0x0000000077A69000-memory.dmpFilesize
1.7MB
-
memory/2740-57-0x00000000000E0000-0x00000000000E6000-memory.dmpFilesize
24KB
-
memory/2740-58-0x0000000077AA0000-0x0000000077C21000-memory.dmpFilesize
1.5MB
-
memory/2740-59-0x0000000077AA0000-0x0000000077C21000-memory.dmpFilesize
1.5MB
-
memory/2740-60-0x0000000077AA0000-0x0000000077C21000-memory.dmpFilesize
1.5MB
-
memory/2740-61-0x0000000077AA0000-0x0000000077C21000-memory.dmpFilesize
1.5MB
-
memory/2740-62-0x0000000077AA0000-0x0000000077C21000-memory.dmpFilesize
1.5MB
-
memory/2740-63-0x0000000000220000-0x00000000002E4000-memory.dmpFilesize
784KB
-
memory/2740-70-0x0000000077AA0000-0x0000000077C21000-memory.dmpFilesize
1.5MB
-
memory/2740-30-0x0000000077AA0000-0x0000000077C21000-memory.dmpFilesize
1.5MB
-
memory/2740-31-0x0000000077AA0000-0x0000000077C21000-memory.dmpFilesize
1.5MB
-
memory/2884-65-0x0000000000310000-0x0000000000316000-memory.dmpFilesize
24KB
-
memory/2884-64-0x0000000077911000-0x0000000077912000-memory.dmpFilesize
4KB
-
memory/2940-68-0x0000000077911000-0x0000000077912000-memory.dmpFilesize
4KB