Analysis

  • max time kernel
    23s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/01/2024, 15:30

General

  • Target

    9c98f0f798b53d28919e7c8f7331619c509e24045d1f4dd192f86f2a6115d483.exe

  • Size

    203KB

  • MD5

    7b2592bee2a2b4cfb28502892c619612

  • SHA1

    c4477fef847e926783d54efb7c577fdb8d2407f9

  • SHA256

    9c98f0f798b53d28919e7c8f7331619c509e24045d1f4dd192f86f2a6115d483

  • SHA512

    c9527802e2d80f8f226471fc1d0791dea2efc29e51eba03c2525defc6d6be41e8b8f2bcf1ecf30c543a9476d520ef53ab898b912a1a69086b83cc0bb5d28c1fe

  • SSDEEP

    3072:dDoO2LbVS5fgevom6PJiMrt+NqaDD3LP2uHv49GriBditdi16kwxZRUiaD:S3LbfGMTI3LPJPqG2Bkeia

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\9c98f0f798b53d28919e7c8f7331619c509e24045d1f4dd192f86f2a6115d483.exe
    "C:\Users\Admin\AppData\Local\Temp\9c98f0f798b53d28919e7c8f7331619c509e24045d1f4dd192f86f2a6115d483.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:5028
    • C:\Users\Admin\AppData\Local\Temp\9c98f0f798b53d28919e7c8f7331619c509e24045d1f4dd192f86f2a6115d483.exe
      "C:\Users\Admin\AppData\Local\Temp\9c98f0f798b53d28919e7c8f7331619c509e24045d1f4dd192f86f2a6115d483.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:3352
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3352 -s 328
        3⤵
        • Program crash
        PID:4948
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3352 -ip 3352
    1⤵
      PID:4356
    • C:\Users\Admin\AppData\Local\Temp\9E82.exe
      C:\Users\Admin\AppData\Local\Temp\9E82.exe
      1⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:2876
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        2⤵
          PID:3388
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3388 -s 1144
            3⤵
            • Program crash
            PID:1612
      • C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe"
        1⤵
          PID:3864
        • C:\Users\Admin\AppData\Local\Temp\A47E.exe
          C:\Users\Admin\AppData\Local\Temp\A47E.exe
          1⤵
            PID:4292
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3388 -ip 3388
            1⤵
              PID:2804

            Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • memory/2876-19-0x0000000002160000-0x00000000021C6000-memory.dmp

                    Filesize

                    408KB

                  • memory/2876-36-0x0000000002160000-0x00000000021C6000-memory.dmp

                    Filesize

                    408KB

                  • memory/2876-37-0x00000000026F0000-0x00000000026F1000-memory.dmp

                    Filesize

                    4KB

                  • memory/2876-20-0x0000000000A70000-0x0000000000A7D000-memory.dmp

                    Filesize

                    52KB

                  • memory/2876-21-0x0000000002160000-0x00000000021C6000-memory.dmp

                    Filesize

                    408KB

                  • memory/2876-23-0x0000000077CD4000-0x0000000077CD5000-memory.dmp

                    Filesize

                    4KB

                  • memory/2876-24-0x0000000002680000-0x0000000002681000-memory.dmp

                    Filesize

                    4KB

                  • memory/2876-17-0x0000000000010000-0x000000000006D000-memory.dmp

                    Filesize

                    372KB

                  • memory/2876-26-0x0000000002160000-0x00000000021C6000-memory.dmp

                    Filesize

                    408KB

                  • memory/2876-25-0x0000000002700000-0x000000000270C000-memory.dmp

                    Filesize

                    48KB

                  • memory/3352-4-0x0000000000400000-0x0000000000409000-memory.dmp

                    Filesize

                    36KB

                  • memory/3352-5-0x0000000000400000-0x0000000000409000-memory.dmp

                    Filesize

                    36KB

                  • memory/3352-9-0x0000000000400000-0x0000000000409000-memory.dmp

                    Filesize

                    36KB

                  • memory/3352-3-0x0000000000400000-0x0000000000409000-memory.dmp

                    Filesize

                    36KB

                  • memory/3388-30-0x0000000000E00000-0x0000000000EC4000-memory.dmp

                    Filesize

                    784KB

                  • memory/3388-66-0x0000000000010000-0x0000000000443000-memory.dmp

                    Filesize

                    4.2MB

                  • memory/3388-34-0x0000000000E00000-0x0000000000EC4000-memory.dmp

                    Filesize

                    784KB

                  • memory/3388-31-0x0000000000E00000-0x0000000000EC4000-memory.dmp

                    Filesize

                    784KB

                  • memory/3388-63-0x0000000000E00000-0x0000000000EC4000-memory.dmp

                    Filesize

                    784KB

                  • memory/3388-33-0x0000000000E00000-0x0000000000EC4000-memory.dmp

                    Filesize

                    784KB

                  • memory/3388-27-0x0000000000010000-0x0000000000444000-memory.dmp

                    Filesize

                    4.2MB

                  • memory/3388-29-0x0000000000010000-0x0000000000444000-memory.dmp

                    Filesize

                    4.2MB

                  • memory/3388-67-0x0000000000E00000-0x0000000000EC4000-memory.dmp

                    Filesize

                    784KB

                  • memory/3388-64-0x0000000004710000-0x0000000004712000-memory.dmp

                    Filesize

                    8KB

                  • memory/3412-6-0x0000000002EB0000-0x0000000002EC6000-memory.dmp

                    Filesize

                    88KB

                  • memory/3864-68-0x0000000073210000-0x0000000073927000-memory.dmp

                    Filesize

                    7.1MB

                  • memory/3864-62-0x0000000073210000-0x0000000073927000-memory.dmp

                    Filesize

                    7.1MB

                  • memory/4292-43-0x0000000000380000-0x0000000000916000-memory.dmp

                    Filesize

                    5.6MB

                  • memory/4292-50-0x0000000000380000-0x0000000000916000-memory.dmp

                    Filesize

                    5.6MB

                  • memory/5028-1-0x00000000005E0000-0x00000000006E0000-memory.dmp

                    Filesize

                    1024KB

                  • memory/5028-2-0x0000000002180000-0x0000000002189000-memory.dmp

                    Filesize

                    36KB