Analysis
- max time kernel
299s - max time network
301s - platform
windows10-1703_x64 - resource
win10-20231215-en - resource tags
arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system - submitted
01/01/2024, 04:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2956bc327016b74df177ace4cc464fdb444ec6c149d44136947e651d881c6c7c.exe
Resource
win7-20231215-en
windows7-x64
32 signatures
300 seconds
Behavioral task
behavioral2
Sample
2956bc327016b74df177ace4cc464fdb444ec6c149d44136947e651d881c6c7c.exe
Resource
win10-20231215-en
windows10-1703-x64
13 signatures
300 seconds
General
- Target 2956bc327016b74df177ace4cc464fdb444ec6c149d44136947e651d881c6c7c.exe
- Size 213KB
- Sample240101-ff8mxseec8
- SHA256 2956bc327016b74df177ace4cc464fdb444ec6c149d44136947e651d881c6c7c
- MD5 92aaf4b45cacf890daf577347c82643b
- SHA1 6101f1673fb7bf826962f52fb074324061dbb797
- SHA512 bfbc2033f9ffbe05e1c7ed2e8bc890c6cc03b8419c825588d77cc72cf646477e188d56bfd669fa02e59beb56f65322c68dd0af06be9ceade31b41ed7a96ad0da
- SSDEEP 3072:1QLlzxKKdOWRej724h8Ef5CxvOkjU/5+7gzFXHQ6ol:1QLl1mz24CEsvT4vzK
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Botnet
-
pub1
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://host-file-host6.com/
-
http://host-host-file8.com/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Executes dropped EXE 3 IoCs
pid Process 1012 EC83.exe 1772 FD2D.exe 2556 WindowsUpdater.exe - Loads dropped DLL 2 IoCs
pid Process 2556 WindowsUpdater.exe 2556 WindowsUpdater.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 656 set thread context of 3996 656 2956bc327016b74df177ace4cc464fdb444ec6c149d44136947e651d881c6c7c.exe 73 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
pid pid_target Process procid_target 1592 3996 WerFault.exe 73 - NSIS installer 6 IoCs
resource yara_rule behavioral2/files/0x000700000001abfd-21.dat nsis_installer_2 behavioral2/files/0x000700000001abfd-22.dat nsis_installer_2 behavioral2/files/0x000600000001abfe-27.dat nsis_installer_1 behavioral2/files/0x000600000001abfe-27.dat nsis_installer_2 behavioral2/files/0x000600000001abfe-29.dat nsis_installer_1 behavioral2/files/0x000600000001abfe-29.dat nsis_installer_2 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2956bc327016b74df177ace4cc464fdb444ec6c149d44136947e651d881c6c7c.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2956bc327016b74df177ace4cc464fdb444ec6c149d44136947e651d881c6c7c.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2956bc327016b74df177ace4cc464fdb444ec6c149d44136947e651d881c6c7c.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3996 2956bc327016b74df177ace4cc464fdb444ec6c149d44136947e651d881c6c7c.exe 3996 2956bc327016b74df177ace4cc464fdb444ec6c149d44136947e651d881c6c7c.exe 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found 3432 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3996 2956bc327016b74df177ace4cc464fdb444ec6c149d44136947e651d881c6c7c.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeShutdownPrivilege 3432 Process not Found Token: SeCreatePagefilePrivilege 3432 Process not Found Token: SeShutdownPrivilege 3432 Process not Found Token: SeCreatePagefilePrivilege 3432 Process not Found Token: SeShutdownPrivilege 3432 Process not Found Token: SeCreatePagefilePrivilege 3432 Process not Found Token: SeShutdownPrivilege 3432 Process not Found Token: SeCreatePagefilePrivilege 3432 Process not Found Token: SeShutdownPrivilege 3432 Process not Found Token: SeCreatePagefilePrivilege 3432 Process not Found - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 656 wrote to memory of 3996 656 2956bc327016b74df177ace4cc464fdb444ec6c149d44136947e651d881c6c7c.exe 73 PID 656 wrote to memory of 3996 656 2956bc327016b74df177ace4cc464fdb444ec6c149d44136947e651d881c6c7c.exe 73 PID 656 wrote to memory of 3996 656 2956bc327016b74df177ace4cc464fdb444ec6c149d44136947e651d881c6c7c.exe 73 PID 656 wrote to memory of 3996 656 2956bc327016b74df177ace4cc464fdb444ec6c149d44136947e651d881c6c7c.exe 73 PID 656 wrote to memory of 3996 656 2956bc327016b74df177ace4cc464fdb444ec6c149d44136947e651d881c6c7c.exe 73 PID 656 wrote to memory of 3996 656 2956bc327016b74df177ace4cc464fdb444ec6c149d44136947e651d881c6c7c.exe 73 PID 3432 wrote to memory of 1012 3432 Process not Found 76 PID 3432 wrote to memory of 1012 3432 Process not Found 76 PID 3432 wrote to memory of 1012 3432 Process not Found 76 PID 3432 wrote to memory of 1772 3432 Process not Found 77 PID 3432 wrote to memory of 1772 3432 Process not Found 77 PID 3432 wrote to memory of 1772 3432 Process not Found 77 PID 1772 wrote to memory of 2556 1772 FD2D.exe 78 PID 1772 wrote to memory of 2556 1772 FD2D.exe 78 PID 1772 wrote to memory of 2556 1772 FD2D.exe 78 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2956bc327016b74df177ace4cc464fdb444ec6c149d44136947e651d881c6c7c.exe"C:\Users\Admin\AppData\Local\Temp\2956bc327016b74df177ace4cc464fdb444ec6c149d44136947e651d881c6c7c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Users\Admin\AppData\Local\Temp\2956bc327016b74df177ace4cc464fdb444ec6c149d44136947e651d881c6c7c.exe"C:\Users\Admin\AppData\Local\Temp\2956bc327016b74df177ace4cc464fdb444ec6c149d44136947e651d881c6c7c.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3996 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 5003⤵
- Program crash
PID:1592
-
-
-
C:\Users\Admin\AppData\Local\Temp\EC83.exeC:\Users\Admin\AppData\Local\Temp\EC83.exe1⤵
- Executes dropped EXE
PID:1012
-
C:\Users\Admin\AppData\Local\Temp\FD2D.exeC:\Users\Admin\AppData\Local\Temp\FD2D.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe"C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\EC83.exe
- Size 360KB
- SHA256 6d99cec56614b6b8a23dfa84a50c6bbfde535411c6366ac2bcc20c9f5af62880
- MD5 80c413180b6bd0dd664adc4e0665b494
- SHA1 e791e4a3391fc6b7bcb58399cd4fa3c52a06b940
- SHA512 347f4ae6f308b37d055a6177478e45ab3838d7020abed70c7aa138d2c3771e709de204da8550aebdcaa6139d869dc7328cc7e645c4dd48d1066f9ad70225644a
- SSDEEP 6144:VuWFksgTOzEV6zs1hfk8MIcG1Zb7d+0PuSCU4CzmJkdVds:5FkRTOzEV6zs1hfk8oYVd+Dj4mYVds
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\EC83.exe
- Size 305KB
- SHA256 663ace9483120199444e65083cb9b6215e9c241c24a54ee470566829fb444e3b
- MD5 e52bad8128ae260cfd2cb22b76930e54
- SHA1 f852303e70530aa32292765f47a417df71039e84
- SHA512 af946b601e70935ce25a420a9416dff72425715f96f2619cc6f765861469e7d4d917503d373b4444621db62bd96822746d38cc32c2779fb8b8d73c95b2bc0e0b
- SSDEEP 6144:VuWFksgTOzEV6zs1hfk8MIcG1Zb7d+0PuSCU4CzmJkdVdsw:5FkRTOzEV6zs1hfk8oYVd+Dj4mYVdsw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\FD2D.exe
- Size 2.0MB
- SHA256 09ff25beec5067fb835e7c28c0b5a0b952b46157d603d1cc4e13fa778aedde78
- MD5 4d18646d5a8a969e67ac7eff16669741
- SHA1 ba7bd04d66af790354106d9fcd4b606dbf84aa1b
- SHA512 b8cf440de90a596cc6adca13ff3672795c24eab993343a5e0983258af1bd9c4666c7e3b785679a06e2dce3d6b90d51a0063505e1c1f655c026e48fdd10f2c479
- SSDEEP 49152:YVcX0jpE9mUm1VMp/h+U9b34lzgplaVunjmZ9s+/vIsBiq:keMUmbMp/oC4lzgpl6caZK+YsYq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe
- Size 893KB
- SHA256 e047e7822e36b84b23bd7d7defdb6b574f4d078d8797f9c4e68ff6e009d09c90
- MD5 798f1756b280d89f172b0ccae657e5f3
- SHA1 96c229794547cec929bcd6331d58345c641c87f8
- SHA512 fe03cffb55636fa17e158d7a18b609685a9645a1038de27f7b5ab012204690e53269d8abd04aec4285e1aff503560d1c34f1a6820e564f3b2bc5a347daabf1b9
- SSDEEP 24576:9F0cXuhjiIFeQXI9mU01F1cwPXbqNIqB/Q:4cX0jpE9mUm1VMp/Q
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe
- Size 381KB
- SHA256 2c53c6230503e9ac061e3a3ef5a2baa06457768fe18d30bedd9a9a29b859a902
- MD5 65a07d20fd12a87366b0951e0541db29
- SHA1 36f91897894c24390cf02181178e8efe04a7e15b
- SHA512 a1d4b90b6049cec4eec802f71ebab7bd158ee232c9fd1f430c8a68a217e4a00173a66255d8007c1433418c24523dc99ea3414ab66590200dc6f81305129ce2ad
- SSDEEP 6144:wZnvA8QpqJGshTM9r/PkY1XGaJWe+hjWntaGZtpCVC0inI1gxaXGKiMXPbbGJ32E:gI8QY5O/PtXTWe+hjWrfQzYI1eaXXzby
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\lib.dll
- Size 92KB
- SHA256 fb3946bcf285f3d6b07e20ac4f2344de316c89afadc9a91829f5ae1b5f1af23c
- MD5 ddedfd23bdbb44a6b89cb63778c9a12f
- SHA1 c80b261146f16a9e34d40947f0b97024742713db
- SHA512 10931539ae3cc4ceede9cb70ba296c086349a8573737a74da9611bee72ddc7c319ac893df2c441a699bf1eeb160ea32846337ff7e00d4eb48a29c332fb248073
- SSDEEP 1536:GQJV/wyswNZrHaOJeXJewSIvUQ4HO3ytyF3qEODTS0EJ6sWycdbMXn4wUk8BKX:GGjaO+ewSIoO3syiT9bMXn4wUy
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nsxFE18.tmp\System.dll
- Size 12KB
- SHA256 7fb0f8d452fefaac789986b933df050f3d3e4feb8a8d9944ada995f572dcdca1
- MD5 dd87a973e01c5d9f8e0fcc81a0af7c7a
- SHA1 c9206ced48d1e5bc648b1d0f54cccc18bf643a14
- SHA512 4910b39b1a99622ac8b3c42f173bbe7035ac2f8d40c946468e7db7e2868a2da81ea94da453857f06f39957dd690c7f1ba498936a7aaa0039975e472376f92e8f
- SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/993:97pJp48F2exrg5F/9
- MD5 SHA1 SHA512 SSDEEP