Analysis
- max time kernel
299s - max time network
301s - platform
windows10-1703_x64 - resource
win10-20231215-en - resource tags
arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system - submitted
01/01/2024, 04:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
25381ed3f2da7940e89e2f4561b200509c833998b10a94f9c71c64bb27604a6e.exe
Resource
win7-20231215-en
windows7-x64
32 signatures
300 seconds
Behavioral task
behavioral2
Sample
25381ed3f2da7940e89e2f4561b200509c833998b10a94f9c71c64bb27604a6e.exe
Resource
win10-20231215-en
windows10-1703-x64
13 signatures
300 seconds
General
- Target 25381ed3f2da7940e89e2f4561b200509c833998b10a94f9c71c64bb27604a6e.exe
- Size 163KB
- Sample240101-ff3rnsbggj
- SHA256 25381ed3f2da7940e89e2f4561b200509c833998b10a94f9c71c64bb27604a6e
- MD5 49c2aa89287ad4e0f7ad04d996b8dbab
- SHA1 60675ce7fec48df29c75d847429e8144082e93bb
- SHA512 e8fcc459a63ad6d2f652461cd64268c03cf1236b697348fe16de16d728b52cb286cf71d5e114ea5532deb8c5a9944329011286b6420aa02110aee758fd9de1bb
- SSDEEP 3072:+iMLLXUY1oWrDH0qZjVPftaEsXmcVFndZbQujKD7wGZyNhr4Z:+iMLjLVrDHDF1a52mnXQVAF+
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Botnet
-
pub1
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://host-file-host6.com/
-
http://host-host-file8.com/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Executes dropped EXE 3 IoCs
pid Process 3792 C747.exe 4288 CC0B.exe 4144 WindowsUpdater.exe - Loads dropped DLL 2 IoCs
pid Process 4144 WindowsUpdater.exe 4144 WindowsUpdater.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4624 set thread context of 2192 4624 25381ed3f2da7940e89e2f4561b200509c833998b10a94f9c71c64bb27604a6e.exe 74 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
pid pid_target Process procid_target 4740 2192 WerFault.exe 74 - NSIS installer 6 IoCs
resource yara_rule behavioral2/files/0x000700000001ac01-20.dat nsis_installer_2 behavioral2/files/0x000700000001ac01-21.dat nsis_installer_2 behavioral2/files/0x000600000001ac02-28.dat nsis_installer_1 behavioral2/files/0x000600000001ac02-28.dat nsis_installer_2 behavioral2/files/0x000600000001ac02-26.dat nsis_installer_1 behavioral2/files/0x000600000001ac02-26.dat nsis_installer_2 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 25381ed3f2da7940e89e2f4561b200509c833998b10a94f9c71c64bb27604a6e.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 25381ed3f2da7940e89e2f4561b200509c833998b10a94f9c71c64bb27604a6e.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 25381ed3f2da7940e89e2f4561b200509c833998b10a94f9c71c64bb27604a6e.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2192 25381ed3f2da7940e89e2f4561b200509c833998b10a94f9c71c64bb27604a6e.exe 2192 25381ed3f2da7940e89e2f4561b200509c833998b10a94f9c71c64bb27604a6e.exe 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found 3372 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2192 25381ed3f2da7940e89e2f4561b200509c833998b10a94f9c71c64bb27604a6e.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeShutdownPrivilege 3372 Process not Found Token: SeCreatePagefilePrivilege 3372 Process not Found Token: SeShutdownPrivilege 3372 Process not Found Token: SeCreatePagefilePrivilege 3372 Process not Found Token: SeShutdownPrivilege 3372 Process not Found Token: SeCreatePagefilePrivilege 3372 Process not Found Token: SeShutdownPrivilege 3372 Process not Found Token: SeCreatePagefilePrivilege 3372 Process not Found Token: SeShutdownPrivilege 3372 Process not Found Token: SeCreatePagefilePrivilege 3372 Process not Found - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4624 wrote to memory of 2192 4624 25381ed3f2da7940e89e2f4561b200509c833998b10a94f9c71c64bb27604a6e.exe 74 PID 4624 wrote to memory of 2192 4624 25381ed3f2da7940e89e2f4561b200509c833998b10a94f9c71c64bb27604a6e.exe 74 PID 4624 wrote to memory of 2192 4624 25381ed3f2da7940e89e2f4561b200509c833998b10a94f9c71c64bb27604a6e.exe 74 PID 4624 wrote to memory of 2192 4624 25381ed3f2da7940e89e2f4561b200509c833998b10a94f9c71c64bb27604a6e.exe 74 PID 4624 wrote to memory of 2192 4624 25381ed3f2da7940e89e2f4561b200509c833998b10a94f9c71c64bb27604a6e.exe 74 PID 4624 wrote to memory of 2192 4624 25381ed3f2da7940e89e2f4561b200509c833998b10a94f9c71c64bb27604a6e.exe 74 PID 3372 wrote to memory of 3792 3372 Process not Found 77 PID 3372 wrote to memory of 3792 3372 Process not Found 77 PID 3372 wrote to memory of 3792 3372 Process not Found 77 PID 3372 wrote to memory of 4288 3372 Process not Found 78 PID 3372 wrote to memory of 4288 3372 Process not Found 78 PID 3372 wrote to memory of 4288 3372 Process not Found 78 PID 4288 wrote to memory of 4144 4288 CC0B.exe 79 PID 4288 wrote to memory of 4144 4288 CC0B.exe 79 PID 4288 wrote to memory of 4144 4288 CC0B.exe 79 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\25381ed3f2da7940e89e2f4561b200509c833998b10a94f9c71c64bb27604a6e.exe"C:\Users\Admin\AppData\Local\Temp\25381ed3f2da7940e89e2f4561b200509c833998b10a94f9c71c64bb27604a6e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\25381ed3f2da7940e89e2f4561b200509c833998b10a94f9c71c64bb27604a6e.exe"C:\Users\Admin\AppData\Local\Temp\25381ed3f2da7940e89e2f4561b200509c833998b10a94f9c71c64bb27604a6e.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2192 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 4963⤵
- Program crash
PID:4740
-
-
-
C:\Users\Admin\AppData\Local\Temp\C747.exeC:\Users\Admin\AppData\Local\Temp\C747.exe1⤵
- Executes dropped EXE
PID:3792
-
C:\Users\Admin\AppData\Local\Temp\CC0B.exeC:\Users\Admin\AppData\Local\Temp\CC0B.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe"C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4144
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\C747.exe
- Size 360KB
- SHA256 6d99cec56614b6b8a23dfa84a50c6bbfde535411c6366ac2bcc20c9f5af62880
- MD5 80c413180b6bd0dd664adc4e0665b494
- SHA1 e791e4a3391fc6b7bcb58399cd4fa3c52a06b940
- SHA512 347f4ae6f308b37d055a6177478e45ab3838d7020abed70c7aa138d2c3771e709de204da8550aebdcaa6139d869dc7328cc7e645c4dd48d1066f9ad70225644a
- SSDEEP 6144:VuWFksgTOzEV6zs1hfk8MIcG1Zb7d+0PuSCU4CzmJkdVds:5FkRTOzEV6zs1hfk8oYVd+Dj4mYVds
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\CC0B.exe
- Size 897KB
- SHA256 0e61ac642c86b08ac5c2bf2f64f8c5d3702d7be40378290fcfc845193ee7994b
- MD5 ba202556d4f32c4a44d3ed7b1e3da924
- SHA1 1a8b9b28ca764c4a5ec7c067247a0ea72550522b
- SHA512 039460ffb0d0894844a1e2e37a92e527eecda8390a067b15b82a2de29c0adf7a64b206bd29a54acaa9ffb333289f0fe11486adec04499e47cf4d37582ba0da8a
- SSDEEP 12288:JORLI8QY5O/PtXTWe+hjWrfQzYI1eaXXzbI38876U0fa6ZhB1x8ZkeGpnRW9CXed:YUF0cXuhjiIFeQXI9mU01F1cwPXbqNX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\CC0B.exe
- Size 359KB
- SHA256 665608477a224931cee167aa0ff18a794d938469e3abcff45a1d2ce89c0b393e
- MD5 c49e9c091da884f6509b7348997ac676
- SHA1 e1c16c43d534be067d78159e880c658fd55d7fa2
- SHA512 55bf5d39157ab5e6d6a55ad1f931d5d6c77bdc25b2750bbaa3e2254afb5abf475f472dea1af426b61cfcf9da19195fbdf11d5a1b33632a86ff6650ef0615b556
- SSDEEP 6144:Jt50ObWRVZnvA8QpqJGshTM9r/PkY1XGaJWe+hjWntaGZtpCVC0inI1gxa4:JORLI8QY5O/PtXTWe+hjWrfQzYI1ea4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe
- Size 893KB
- SHA256 e047e7822e36b84b23bd7d7defdb6b574f4d078d8797f9c4e68ff6e009d09c90
- MD5 798f1756b280d89f172b0ccae657e5f3
- SHA1 96c229794547cec929bcd6331d58345c641c87f8
- SHA512 fe03cffb55636fa17e158d7a18b609685a9645a1038de27f7b5ab012204690e53269d8abd04aec4285e1aff503560d1c34f1a6820e564f3b2bc5a347daabf1b9
- SSDEEP 24576:9F0cXuhjiIFeQXI9mU01F1cwPXbqNIqB/Q:4cX0jpE9mUm1VMp/Q
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe
- Size 894KB
- SHA256 e535f046861f812702ca7d2e6a3f549e382c082704a72257c0c6600cd8e2887e
- MD5 3e39384da84b3a27606515cc6f3387c8
- SHA1 28374afa16a6cd586894fae18fcb08ee25357040
- SHA512 33c3edc326ad3cab67555d30d424c525339d920f7abca25a2b168cbe93b60a5410a29f39c131a03cec49498a92a851473eaf8c93fb541b0fc7bb524022b40705
- SSDEEP 24576:9F0cXuhjiIFeQXI9mU01F1cwPXbqNIqB/N:4cX0jpE9mUm1VMp/N
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nsdCCF6.tmp\System.dll
- Size 12KB
- SHA256 7fb0f8d452fefaac789986b933df050f3d3e4feb8a8d9944ada995f572dcdca1
- MD5 dd87a973e01c5d9f8e0fcc81a0af7c7a
- SHA1 c9206ced48d1e5bc648b1d0f54cccc18bf643a14
- SHA512 4910b39b1a99622ac8b3c42f173bbe7035ac2f8d40c946468e7db7e2868a2da81ea94da453857f06f39957dd690c7f1ba498936a7aaa0039975e472376f92e8f
- SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/993:97pJp48F2exrg5F/9
- MD5 SHA1 SHA512 SSDEEP