Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29-12-2023 22:03
Static task
static1
Behavioral task
behavioral1
Sample
051b8fe31a4832078eb31d3b45228ddd.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
051b8fe31a4832078eb31d3b45228ddd.exe
Resource
win10v2004-20231215-en
General
-
Target
051b8fe31a4832078eb31d3b45228ddd.exe
-
Size
178KB
-
MD5
051b8fe31a4832078eb31d3b45228ddd
-
SHA1
d3e4eee251493d835ce57d093c2542a902daea04
-
SHA256
70b6e46b2d70a18bec9d70a986602c0d67fc0c4400290559e733c2f1c87fa64b
-
SHA512
950c112584f24c3c28938d54a2436dfb86aea352b7f075190f99e70482dd8bcf3017e6ecdf3453dc1fcff90f3e2bffdea14e01d9af2274530633530ab3b46672
-
SSDEEP
3072:5WdXlH1d/+brNwMKIGS1pQLLqzcyxzaRTVetumCvIWArywoOLi6:5AVduNDKIGuqLL4cy10VQSRwoOL
Malware Config
Extracted
smokeloader
0408
Extracted
smokeloader
2020
http://readinglistforjuly1.xyz/
http://readinglistforjuly2.xyz/
http://readinglistforjuly3.xyz/
http://readinglistforjuly4.xyz/
http://readinglistforjuly5.xyz/
http://readinglistforjuly6.xyz/
http://readinglistforjuly7.xyz/
http://readinglistforjuly8.xyz/
http://readinglistforjuly9.xyz/
http://readinglistforjuly10.xyz/
http://readinglistforjuly1.site/
http://readinglistforjuly2.site/
http://readinglistforjuly3.site/
http://readinglistforjuly4.site/
http://readinglistforjuly5.site/
http://readinglistforjuly6.site/
http://readinglistforjuly7.site/
http://readinglistforjuly8.site/
http://readinglistforjuly9.site/
http://readinglistforjuly10.site/
http://readinglistforjuly1.club/
http://readinglistforjuly2.club/
http://readinglistforjuly3.club/
http://readinglistforjuly4.club/
http://readinglistforjuly5.club/
http://readinglistforjuly6.club/
http://readinglistforjuly7.club/
http://readinglistforjuly8.club/
http://readinglistforjuly9.club/
http://readinglistforjuly10.club/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
pid Process 3388 Process not Found -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3364 set thread context of 4260 3364 051b8fe31a4832078eb31d3b45228ddd.exe 48 -
Program crash 1 IoCs
pid pid_target Process procid_target 4664 4260 WerFault.exe 48 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 051b8fe31a4832078eb31d3b45228ddd.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 051b8fe31a4832078eb31d3b45228ddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 051b8fe31a4832078eb31d3b45228ddd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4260 051b8fe31a4832078eb31d3b45228ddd.exe 4260 051b8fe31a4832078eb31d3b45228ddd.exe 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found 3388 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4260 051b8fe31a4832078eb31d3b45228ddd.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 3388 Process not Found Token: SeCreatePagefilePrivilege 3388 Process not Found -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3388 Process not Found -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3364 wrote to memory of 4260 3364 051b8fe31a4832078eb31d3b45228ddd.exe 48 PID 3364 wrote to memory of 4260 3364 051b8fe31a4832078eb31d3b45228ddd.exe 48 PID 3364 wrote to memory of 4260 3364 051b8fe31a4832078eb31d3b45228ddd.exe 48 PID 3364 wrote to memory of 4260 3364 051b8fe31a4832078eb31d3b45228ddd.exe 48 PID 3364 wrote to memory of 4260 3364 051b8fe31a4832078eb31d3b45228ddd.exe 48 PID 3364 wrote to memory of 4260 3364 051b8fe31a4832078eb31d3b45228ddd.exe 48 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\051b8fe31a4832078eb31d3b45228ddd.exe"C:\Users\Admin\AppData\Local\Temp\051b8fe31a4832078eb31d3b45228ddd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\051b8fe31a4832078eb31d3b45228ddd.exe"C:\Users\Admin\AppData\Local\Temp\051b8fe31a4832078eb31d3b45228ddd.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4260 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 3283⤵
- Program crash
PID:4664
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4260 -ip 42601⤵PID:1348