Analysis
- max time kernel
150s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
04/01/2024, 01:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
toolspub2.exe
Resource
win7-20231215-en
windows7-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
toolspub2.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
28 signatures
150 seconds
General
- Target toolspub2.exe
- Size 239KB
- Sample240104-b3bt9aeefj
- SHA256 00415d3dbe1002e36e94d9e11459872b7fd485ffc59a4d96a7c8e7e5df80186b
- MD5 ef34b51ad43f82175fd285ec712b6ef6
- SHA1 0e31b26d117ba88e87b611991603cf3ffed95b78
- SHA512 31a9171cc9cea2828772505d7c26e586557b703947cd0f0bd66f1e8aab8e46bf1a3a5aa36648756f87325590bdaf1c6ebc094db3129dc330fce316c52b14d4d9
- SSDEEP 3072:+QT/QLtwugjI9mRN58SZbXO9HFSR9Ea81jzaa8A+hLMUOJxgeRp:+E/QLXgjIG8St8HFSPMU4Pxge
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
smokeloader
Botnet
-
up3
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://host-file-host6.com/
-
http://host-host-file8.com/
rc4.i32
rc4.i32
Signatures
- Modifies firewall policy service 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" explorer.exe - SmokeLoader
Modular backdoor trojan in use since 2014.
- Sets file execution options in registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcc13s9y9u11513.exe 1FA8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcc13s9y9u11513.exe\DisableExceptionChainValidation 1FA8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "ovbxw.exe" explorer.exe - Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation 28A2.exe - Deletes itself 1 IoCs
pid Process 3384 Process not Found - Executes dropped EXE 3 IoCs
pid Process 4472 1FA8.exe 4028 28A2.exe 4608 WindowsUpdater.exe - Loads dropped DLL 2 IoCs
pid Process 4608 WindowsUpdater.exe 4608 WindowsUpdater.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Java Updater = "C:\\ProgramData\\Java Updater\\mcc13s9y9u11513.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java Updater = "\"C:\\ProgramData\\Java Updater\\mcc13s9y9u11513.exe\"" explorer.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 1FA8.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
pid Process 4472 1FA8.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe 2784 explorer.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1788 set thread context of 2336 1788 toolspub2.exe 97 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
pid pid_target Process procid_target 1280 2784 WerFault.exe 104 - NSIS installer 8 IoCs
resource yara_rule behavioral2/files/0x0007000000023241-20.dat nsis_installer_2 behavioral2/files/0x0007000000023241-21.dat nsis_installer_2 behavioral2/files/0x0009000000023240-37.dat nsis_installer_1 behavioral2/files/0x0009000000023240-37.dat nsis_installer_2 behavioral2/files/0x0009000000023240-40.dat nsis_installer_1 behavioral2/files/0x0009000000023240-40.dat nsis_installer_2 behavioral2/files/0x0009000000023240-49.dat nsis_installer_1 behavioral2/files/0x0009000000023240-49.dat nsis_installer_2 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 1FA8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 1FA8.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer explorer.exe - Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" explorer.exe - Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2336 toolspub2.exe 2336 toolspub2.exe 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found - Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 2336 toolspub2.exe 4472 1FA8.exe 4472 1FA8.exe - Suspicious use of AdjustPrivilegeToken 30 IoCs
description pid Process Token: SeDebugPrivilege 4472 1FA8.exe Token: SeRestorePrivilege 4472 1FA8.exe Token: SeBackupPrivilege 4472 1FA8.exe Token: SeLoadDriverPrivilege 4472 1FA8.exe Token: SeCreatePagefilePrivilege 4472 1FA8.exe Token: SeShutdownPrivilege 4472 1FA8.exe Token: SeTakeOwnershipPrivilege 4472 1FA8.exe Token: SeChangeNotifyPrivilege 4472 1FA8.exe Token: SeCreateTokenPrivilege 4472 1FA8.exe Token: SeMachineAccountPrivilege 4472 1FA8.exe Token: SeSecurityPrivilege 4472 1FA8.exe Token: SeAssignPrimaryTokenPrivilege 4472 1FA8.exe Token: SeCreateGlobalPrivilege 4472 1FA8.exe Token: 33 4472 1FA8.exe Token: SeDebugPrivilege 2784 explorer.exe Token: SeRestorePrivilege 2784 explorer.exe Token: SeBackupPrivilege 2784 explorer.exe Token: SeLoadDriverPrivilege 2784 explorer.exe Token: SeCreatePagefilePrivilege 2784 explorer.exe Token: SeShutdownPrivilege 2784 explorer.exe Token: SeTakeOwnershipPrivilege 2784 explorer.exe Token: SeChangeNotifyPrivilege 2784 explorer.exe Token: SeCreateTokenPrivilege 2784 explorer.exe Token: SeMachineAccountPrivilege 2784 explorer.exe Token: SeSecurityPrivilege 2784 explorer.exe Token: SeAssignPrimaryTokenPrivilege 2784 explorer.exe Token: SeCreateGlobalPrivilege 2784 explorer.exe Token: 33 2784 explorer.exe Token: SeShutdownPrivilege 3384 Process not Found Token: SeCreatePagefilePrivilege 3384 Process not Found - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3384 Process not Found - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1788 wrote to memory of 2336 1788 toolspub2.exe 97 PID 1788 wrote to memory of 2336 1788 toolspub2.exe 97 PID 1788 wrote to memory of 2336 1788 toolspub2.exe 97 PID 1788 wrote to memory of 2336 1788 toolspub2.exe 97 PID 1788 wrote to memory of 2336 1788 toolspub2.exe 97 PID 1788 wrote to memory of 2336 1788 toolspub2.exe 97 PID 3384 wrote to memory of 4472 3384 Process not Found 102 PID 3384 wrote to memory of 4472 3384 Process not Found 102 PID 3384 wrote to memory of 4472 3384 Process not Found 102 PID 3384 wrote to memory of 4028 3384 Process not Found 103 PID 3384 wrote to memory of 4028 3384 Process not Found 103 PID 3384 wrote to memory of 4028 3384 Process not Found 103 PID 4472 wrote to memory of 2784 4472 1FA8.exe 104 PID 4472 wrote to memory of 2784 4472 1FA8.exe 104 PID 4472 wrote to memory of 2784 4472 1FA8.exe 104 PID 4028 wrote to memory of 4608 4028 28A2.exe 105 PID 4028 wrote to memory of 4608 4028 28A2.exe 105 PID 4028 wrote to memory of 4608 4028 28A2.exe 105 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2336
-
-
C:\Users\Admin\AppData\Local\Temp\1FA8.exeC:\Users\Admin\AppData\Local\Temp\1FA8.exe1⤵
- Sets file execution options in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵
- Modifies firewall policy service
- Sets file execution options in registry
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
PID:2784 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 11323⤵
- Program crash
PID:1280
-
-
-
C:\Users\Admin\AppData\Local\Temp\28A2.exeC:\Users\Admin\AppData\Local\Temp\28A2.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe"C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4608
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2784 -ip 27841⤵PID:3780
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\1FA8.exe
- Size 360KB
- SHA256 6d99cec56614b6b8a23dfa84a50c6bbfde535411c6366ac2bcc20c9f5af62880
- MD5 80c413180b6bd0dd664adc4e0665b494
- SHA1 e791e4a3391fc6b7bcb58399cd4fa3c52a06b940
- SHA512 347f4ae6f308b37d055a6177478e45ab3838d7020abed70c7aa138d2c3771e709de204da8550aebdcaa6139d869dc7328cc7e645c4dd48d1066f9ad70225644a
- SSDEEP 6144:VuWFksgTOzEV6zs1hfk8MIcG1Zb7d+0PuSCU4CzmJkdVds:5FkRTOzEV6zs1hfk8oYVd+Dj4mYVds
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\28A2.exe
- Size 2.9MB
- SHA256 484c7c1e6ee56025524ca8bc9a8ada51d55bd96b462968207190143a7e34337a
- MD5 59de71aab5b896653870d87f7572bd61
- SHA1 ed979d5ae8ee7e6c23004701e618522747337236
- SHA512 ecba08bf89b808a11597a7fc21c1a2c3d5c4525a66dcb8a8776beaa2b513eefc1e7d73679db98728f0134394b63416f34cc9089506f5280375c1b349b7890c33
- SSDEEP 49152:YVcX0jpE9mUm1VMp/h+U9b34lzgplaVunjmZ9s+/vIsBiAi4RebVr+:keMUmbMp/oC4lzgpl6caZK+YsYA5ReZ6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\28A2.exe
- Size 4.1MB
- SHA256 ab3e6ecd6a6f9176472c1403b62190cc58e0859c7e16c54f9c71627c903dfce2
- MD5 7b79029e2968b19c1f265ba85b95a034
- SHA1 acb63034455be151ecb5a9dbeb5b0baf6a7d1d77
- SHA512 62d5df71903158f2cd365aa87ee87e75dc710d467783281b38c08aaa3623f41a2bc1aad56f62f073b80e4f63d1db4363ed0aadfa3eb09b4b88ee113a234e0a8a
- SSDEEP 98304:keMUmbMp/oC4lzgpl6caZK+YsYA5ReZwyxg+Ur:ke9tzYzgpl6X7/YAFr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe
- Size 449KB
- SHA256 9b824036a20bda6d6104ee3cf6b41790ae1e6924329131a72cd79d6392f0e569
- MD5 52f3ef437a975485831cd193eac4a534
- SHA1 5cabcffefd0bb749a3da90190824c4e70643e900
- SHA512 7f42ab56f1328b1f0784637eb69e4761dd9580db28b390258304ea670a998f2287f9e2b22b7f8641b888c5900e21abaea62c61a6a57f1fbe7e9a7a88d9a488d0
- SSDEEP 12288:gI8QY5O/PtXTWe+hjWrfQzYI1eaXXzbI38876U0fY:9F0cXuhjiIFeQXI9mU0g
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe
- Size 2.2MB
- SHA256 5ebb608342d1306743d1ab56bb587b00d7e14737f5af48be3fa738a98cf29668
- MD5 0badb0e573d95db49ac23c11163d9386
- SHA1 d86dd20e4498ba5576272df07cd71dd9ed40bf8d
- SHA512 a83d397fdcf2b749aac8f1db38a991b06a70c58d21c84d09cd8a732ee744287e7d7d58edeb817006b6ee245ed313993a3280aea32fd4c5a079b4f960ab35eff8
- SSDEEP 49152:4cX0jpE9mUm1VMp/h+U9b34lzgplaVunjmZ9s+/vIsBiAi4Rem:YeMUmbMp/oC4lzgpl6caZK+YsYA5Rem
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe
- Size 903KB
- SHA256 f7e86b71d8acd3f7e292ff5839d0818a09ddd5b6d40c61482db5257f990429fb
- MD5 fabb772e7eb33e4c02211e28e293a856
- SHA1 81deffa85943751744f0301be69f1deaa3705b8a
- SHA512 fe362fbb6a16ab27bf2b29def8b0a68e315c760c1c9241b9a632c7cc524a92da6672ad3db8e26da63f5091bf65773b605e3209f86bad5eab646a2c448724f53f
- SSDEEP 24576:9F0cXuhjiIFeQXI9mU01F1cwPXbqNIqB/l:4cX0jpE9mUm1VMp/l
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\lib.dll
- Size 92KB
- SHA256 fb3946bcf285f3d6b07e20ac4f2344de316c89afadc9a91829f5ae1b5f1af23c
- MD5 ddedfd23bdbb44a6b89cb63778c9a12f
- SHA1 c80b261146f16a9e34d40947f0b97024742713db
- SHA512 10931539ae3cc4ceede9cb70ba296c086349a8573737a74da9611bee72ddc7c319ac893df2c441a699bf1eeb160ea32846337ff7e00d4eb48a29c332fb248073
- SSDEEP 1536:GQJV/wyswNZrHaOJeXJewSIvUQ4HO3ytyF3qEODTS0EJ6sWycdbMXn4wUk8BKX:GGjaO+ewSIoO3syiT9bMXn4wUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsd3F38.tmp\System.dll
- Size 12KB
- SHA256 7fb0f8d452fefaac789986b933df050f3d3e4feb8a8d9944ada995f572dcdca1
- MD5 dd87a973e01c5d9f8e0fcc81a0af7c7a
- SHA1 c9206ced48d1e5bc648b1d0f54cccc18bf643a14
- SHA512 4910b39b1a99622ac8b3c42f173bbe7035ac2f8d40c946468e7db7e2868a2da81ea94da453857f06f39957dd690c7f1ba498936a7aaa0039975e472376f92e8f
- SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/993:97pJp48F2exrg5F/9
- MD5 SHA1 SHA512 SSDEEP