Analysis
- max time kernel
299s - max time network
295s - platform
windows10-1703_x64 - resource
win10-20231215-en - resource tags
arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system - submitted
07/01/2024, 22:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3334129bc2d087732c37d674a32c94c7aad0c688b700e6acb1f439f374827c34.exe
Resource
win7-20231215-en
windows7-x64
20 signatures
300 seconds
Behavioral task
behavioral2
Sample
3334129bc2d087732c37d674a32c94c7aad0c688b700e6acb1f439f374827c34.exe
Resource
win10-20231215-en
windows10-1703-x64
13 signatures
300 seconds
General
- Target 3334129bc2d087732c37d674a32c94c7aad0c688b700e6acb1f439f374827c34.exe
- Size 213KB
- Sample240107-178r8afcgn
- SHA256 3334129bc2d087732c37d674a32c94c7aad0c688b700e6acb1f439f374827c34
- MD5 bebd91ddd9995ca465c0d8d9eb73f584
- SHA1 ae3695b0557a3c72fc5e54937d110b190208df31
- SHA512 06d9fa2533d493e3ab1e10ed651821e83f11f82e0aaf011a66794acb8f8d161c57a45b04fd7e56014b2f2bb83a5dff7ba31d1735d2713855d960d5c924b207a1
- SSDEEP 3072:4fULIw/tgljb1faDKI1MivfhyDslfkNxZIMxdU:4fULntgBniwDS0OM
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Botnet
-
pub1
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://host-file-host6.com/
-
http://host-host-file8.com/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Executes dropped EXE 5 IoCs
pid Process 3484 FCEE.exe 3912 329.exe 4100 WindowsUpdater.exe 2376 urjhirj 4604 urjhirj - Loads dropped DLL 2 IoCs
pid Process 4100 WindowsUpdater.exe 4100 WindowsUpdater.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4892 set thread context of 3164 4892 3334129bc2d087732c37d674a32c94c7aad0c688b700e6acb1f439f374827c34.exe 74 PID 2376 set thread context of 4604 2376 urjhirj 81 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
pid pid_target Process procid_target 4696 3164 WerFault.exe 74 - NSIS installer 4 IoCs
resource yara_rule behavioral2/files/0x000700000001abd8-22.dat nsis_installer_2 behavioral2/files/0x000600000001abd9-29.dat nsis_installer_1 behavioral2/files/0x000600000001abd9-29.dat nsis_installer_2 behavioral2/files/0x000700000001abd8-21.dat nsis_installer_2 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3334129bc2d087732c37d674a32c94c7aad0c688b700e6acb1f439f374827c34.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3334129bc2d087732c37d674a32c94c7aad0c688b700e6acb1f439f374827c34.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3334129bc2d087732c37d674a32c94c7aad0c688b700e6acb1f439f374827c34.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3164 3334129bc2d087732c37d674a32c94c7aad0c688b700e6acb1f439f374827c34.exe 3164 3334129bc2d087732c37d674a32c94c7aad0c688b700e6acb1f439f374827c34.exe 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3164 3334129bc2d087732c37d674a32c94c7aad0c688b700e6acb1f439f374827c34.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeShutdownPrivilege 3476 Process not Found Token: SeCreatePagefilePrivilege 3476 Process not Found Token: SeShutdownPrivilege 3476 Process not Found Token: SeCreatePagefilePrivilege 3476 Process not Found Token: SeShutdownPrivilege 3476 Process not Found Token: SeCreatePagefilePrivilege 3476 Process not Found Token: SeShutdownPrivilege 3476 Process not Found Token: SeCreatePagefilePrivilege 3476 Process not Found Token: SeShutdownPrivilege 3476 Process not Found Token: SeCreatePagefilePrivilege 3476 Process not Found Token: SeShutdownPrivilege 3476 Process not Found Token: SeCreatePagefilePrivilege 3476 Process not Found - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 4892 wrote to memory of 3164 4892 3334129bc2d087732c37d674a32c94c7aad0c688b700e6acb1f439f374827c34.exe 74 PID 4892 wrote to memory of 3164 4892 3334129bc2d087732c37d674a32c94c7aad0c688b700e6acb1f439f374827c34.exe 74 PID 4892 wrote to memory of 3164 4892 3334129bc2d087732c37d674a32c94c7aad0c688b700e6acb1f439f374827c34.exe 74 PID 4892 wrote to memory of 3164 4892 3334129bc2d087732c37d674a32c94c7aad0c688b700e6acb1f439f374827c34.exe 74 PID 4892 wrote to memory of 3164 4892 3334129bc2d087732c37d674a32c94c7aad0c688b700e6acb1f439f374827c34.exe 74 PID 4892 wrote to memory of 3164 4892 3334129bc2d087732c37d674a32c94c7aad0c688b700e6acb1f439f374827c34.exe 74 PID 3476 wrote to memory of 3484 3476 Process not Found 77 PID 3476 wrote to memory of 3484 3476 Process not Found 77 PID 3476 wrote to memory of 3484 3476 Process not Found 77 PID 3476 wrote to memory of 3912 3476 Process not Found 78 PID 3476 wrote to memory of 3912 3476 Process not Found 78 PID 3476 wrote to memory of 3912 3476 Process not Found 78 PID 3912 wrote to memory of 4100 3912 329.exe 79 PID 3912 wrote to memory of 4100 3912 329.exe 79 PID 3912 wrote to memory of 4100 3912 329.exe 79 PID 2376 wrote to memory of 4604 2376 urjhirj 81 PID 2376 wrote to memory of 4604 2376 urjhirj 81 PID 2376 wrote to memory of 4604 2376 urjhirj 81 PID 2376 wrote to memory of 4604 2376 urjhirj 81 PID 2376 wrote to memory of 4604 2376 urjhirj 81 PID 2376 wrote to memory of 4604 2376 urjhirj 81 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3334129bc2d087732c37d674a32c94c7aad0c688b700e6acb1f439f374827c34.exe"C:\Users\Admin\AppData\Local\Temp\3334129bc2d087732c37d674a32c94c7aad0c688b700e6acb1f439f374827c34.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\3334129bc2d087732c37d674a32c94c7aad0c688b700e6acb1f439f374827c34.exe"C:\Users\Admin\AppData\Local\Temp\3334129bc2d087732c37d674a32c94c7aad0c688b700e6acb1f439f374827c34.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3164 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 5003⤵
- Program crash
PID:4696
-
-
-
C:\Users\Admin\AppData\Local\Temp\FCEE.exeC:\Users\Admin\AppData\Local\Temp\FCEE.exe1⤵
- Executes dropped EXE
PID:3484
-
C:\Users\Admin\AppData\Local\Temp\329.exeC:\Users\Admin\AppData\Local\Temp\329.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe"C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4100
-
-
C:\Users\Admin\AppData\Roaming\urjhirjC:\Users\Admin\AppData\Roaming\urjhirj1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Roaming\urjhirjC:\Users\Admin\AppData\Roaming\urjhirj2⤵
- Executes dropped EXE
PID:4604
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\329.exe
- Size 47KB
- SHA256 40178daf1b01484c748c58ea42a73133148786981ea91abb736251a762357b2c
- MD5 aa449f6a3f805266f5a0aaeb17662e8a
- SHA1 dd2738a8f365cc4c8fcef5ac3228800143088fdc
- SHA512 1129739f16624a9fcea75e37af85c1f080c48357f1fc1c8baadde4d7b997c1875afe4a60e404f5113ce142061778445b946bc1d2cfbec5f78b6ecd4961ff42b6
- SSDEEP 768:eqekxYcbANWAMI0yknSrOeai46z1NKmN3k9ncq8S6vUexo8Uo0O2ZSojve1KSf/v:eqe570IOea5evdOb6vFzUs2ZSozeD8o
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\329.exe
- Size 41KB
- SHA256 4a55b20c6af8481f8e0001139e9f382ff97207907f649a8c3708d02d58a209cf
- MD5 3266f968892d7250565a37400ec5aacc
- SHA1 97d88ab19d21a13f096cf8e9cc37303e79dbaf88
- SHA512 241a783b7c7ee0385738eb8245aa4bcdb54ba73d2b97ce34385cdcc7ef2d12792cfa63433d57a07709718f051dadb99cad1b674dd494e79e2fad37f6bfe2c799
- SSDEEP 768:eqekxYcbANWAMI0yknSrOeai46z1NKmN3k9ncq8S6vUexo8Uo0O2ZSoe:eqe570IOea5evdOb6vFzUs2ZSoe
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\FCEE.exe
- Size 35KB
- SHA256 67dc4ae90e9c30fce290691b870cf94c01e46f201c02f92ef4653cf02f80f7c2
- MD5 db026681e22ce0a2bd5b3f3a41297e42
- SHA1 141bfc4a488bf96a79d4e9580e4c93c379665e06
- SHA512 218cecb72522743b397fccca87225374fd94031fe47247dc5918107fc76658ff67b6ef63379263f33dc2d2c6a606908d7d34711430d7920e9270f5c4826cf518
- SSDEEP 768:GDqQnaEU1k55mx/CT7NMv7jS2hvc7LqBU8alUCDPi:VQX2yKhvGDe
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe
- Size 41KB
- SHA256 a6ffead076922af6b547c4fd59d9f77483b1c250cbb4b9a3d8f21da78dbe642d
- MD5 e0281727af77bee51766724ea6b0be81
- SHA1 6738bc079c08185a0ef106f8d0aa718c83c7ffe1
- SHA512 11de846feaf39e9a7dca4dd6817800fe9a76e17270c598001a39db7ad3f771c160efdcca90b3d3c7c0703c3c66a61a4f3d03a89b86c0baeccd4efdf414256070
- SSDEEP 768:XIqIN/vzS1t22jzufLvrW/EMLZjMDz30D3QvtOuI4dScQbq2KQ4:wtMzjzcvy9Qz30DAvd8cQbqRd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\urjhirj
- Size 7KB
- SHA256 df37d8d03f83883ff7d62cdbdb57e3b25df0825d6ca871d73ec25837d661280a
- MD5 e4e91a1deec856db610fd48087ca658e
- SHA1 83727cf460a3c98fd49f58421ed7e37a2f7562c7
- SHA512 37261c7db95d6fe05946934c1e215f9ce9d3fe22cf7e60efa41c0762d2203fc78632e0f20c9e0d5ea5158ce13abbccc6af18cad5e07d883be4ec5d4b5288e4f6
- SSDEEP 96:wfG9higFXgY69SsQWgUUgBpm8k2UHqtbl/q3TTfCFM+UDEYKzyrjunx8vu:wfJK6/QWfU2pdF5bRWTW2+UAEux8vu
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\lib.dll
- Size 37KB
- SHA256 d857ec887d852d8cf2ff9367f841b805a522ef2530a7bce54129093656b0588e
- MD5 d66dbb105bdc76b74980308634409fa0
- SHA1 ed94ec8e594d1ba0398d69d945b217916edaa840
- SHA512 5bf1e01a9ff474c1780a684b0f5ea545371634b73b72afc470c5646655c95ac3f71a005aef3d88380c70b772ebb772a87a3ffe391efcc350f257fb50aeb87cbd
- SSDEEP 768:GNn2JV/wyswNZ/DEGHKwa1ikVWJWlpgHwwM7Ve/eRHSGcadv8ph:GQJV/wyswNZrHaOJeXJewSIvUh
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nsp3F4.tmp\System.dll
- Size 1KB
- SHA256 170c5dab248a28ecf448493171d358032d7d432de98204df5cbe40fbb416c730
- MD5 18921e6752248358fc3d062230e49030
- SHA1 527420944a948a537692f332848046488c70952c
- SHA512 3000c35d996342573b601d4d5389a5ae9e507c5ca50816b7e5f556febc7e79b3e916bee3a77317e291bbbab860a763e070843a6806d5203da50c43a82b10a834
- MD5 SHA1 SHA512