Analysis

  • max time kernel
    23s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/01/2024, 19:36

General

  • Target

    f92523fa104575e0605f90ce4a75a95204bc8af656c27a04aa26782cb64d938dexe.exe

  • Size

    167KB

  • MD5

    e22cb3768b8f1f0bd6a8334fe9480230

  • SHA1

    8330fbc04aec9f431b7b7e78bb9cc27dadc1d07a

  • SHA256

    f92523fa104575e0605f90ce4a75a95204bc8af656c27a04aa26782cb64d938d

  • SHA512

    129e2fa45cbe86d5095e2729a941af32cbfa92f64a4cd301cdc73d7963b8a8b69616f21350efec22b043c127da0411aad13efe3b9277f759e31530bf3dc04d40

  • SSDEEP

    3072:I70460vVgQa7NLfIMCSBnp8iqXzNY4LHUegh2cp:0Fa7NLfIMCSB2NzSCO5

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\f92523fa104575e0605f90ce4a75a95204bc8af656c27a04aa26782cb64d938dexe.exe
    "C:\Users\Admin\AppData\Local\Temp\f92523fa104575e0605f90ce4a75a95204bc8af656c27a04aa26782cb64d938dexe.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4456
    • C:\Users\Admin\AppData\Local\Temp\f92523fa104575e0605f90ce4a75a95204bc8af656c27a04aa26782cb64d938dexe.exe
      "C:\Users\Admin\AppData\Local\Temp\f92523fa104575e0605f90ce4a75a95204bc8af656c27a04aa26782cb64d938dexe.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:3096
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 328
        3⤵
        • Program crash
        PID:3472
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3096 -ip 3096
    1⤵
      PID:2588
    • C:\Users\Admin\AppData\Local\Temp\9C9E.exe
      C:\Users\Admin\AppData\Local\Temp\9C9E.exe
      1⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:4880
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        2⤵
          PID:1444
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 1068
            3⤵
            • Program crash
            PID:4420
      • C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe"
        1⤵
          PID:4444
        • C:\Users\Admin\AppData\Local\Temp\A1A0.exe
          C:\Users\Admin\AppData\Local\Temp\A1A0.exe
          1⤵
            PID:4092
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 1444 -ip 1444
            1⤵
              PID:4604

            Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • memory/1444-34-0x0000000000800000-0x00000000008C4000-memory.dmp

                    Filesize

                    784KB

                  • memory/1444-63-0x0000000000800000-0x00000000008C4000-memory.dmp

                    Filesize

                    784KB

                  • memory/1444-30-0x0000000000800000-0x00000000008C4000-memory.dmp

                    Filesize

                    784KB

                  • memory/1444-27-0x0000000000020000-0x0000000000454000-memory.dmp

                    Filesize

                    4.2MB

                  • memory/1444-25-0x0000000000020000-0x0000000000454000-memory.dmp

                    Filesize

                    4.2MB

                  • memory/1444-29-0x0000000000800000-0x00000000008C4000-memory.dmp

                    Filesize

                    784KB

                  • memory/1444-59-0x0000000000800000-0x00000000008C4000-memory.dmp

                    Filesize

                    784KB

                  • memory/1444-60-0x0000000002A80000-0x0000000002A82000-memory.dmp

                    Filesize

                    8KB

                  • memory/1444-62-0x0000000000020000-0x0000000000453000-memory.dmp

                    Filesize

                    4.2MB

                  • memory/3096-7-0x0000000000400000-0x0000000000409000-memory.dmp

                    Filesize

                    36KB

                  • memory/3096-2-0x0000000000400000-0x0000000000409000-memory.dmp

                    Filesize

                    36KB

                  • memory/3096-3-0x0000000000400000-0x0000000000409000-memory.dmp

                    Filesize

                    36KB

                  • memory/3428-4-0x0000000002B00000-0x0000000002B16000-memory.dmp

                    Filesize

                    88KB

                  • memory/4092-47-0x0000000000B10000-0x00000000010A6000-memory.dmp

                    Filesize

                    5.6MB

                  • memory/4092-38-0x0000000000B10000-0x00000000010A6000-memory.dmp

                    Filesize

                    5.6MB

                  • memory/4456-0-0x00000000005E0000-0x00000000005E8000-memory.dmp

                    Filesize

                    32KB

                  • memory/4456-1-0x00000000005F0000-0x00000000005F9000-memory.dmp

                    Filesize

                    36KB

                  • memory/4880-18-0x0000000000720000-0x000000000072D000-memory.dmp

                    Filesize

                    52KB

                  • memory/4880-36-0x0000000002300000-0x0000000002366000-memory.dmp

                    Filesize

                    408KB

                  • memory/4880-40-0x0000000000980000-0x0000000000981000-memory.dmp

                    Filesize

                    4KB

                  • memory/4880-21-0x0000000000960000-0x0000000000961000-memory.dmp

                    Filesize

                    4KB

                  • memory/4880-23-0x0000000002830000-0x000000000283C000-memory.dmp

                    Filesize

                    48KB

                  • memory/4880-24-0x0000000002300000-0x0000000002366000-memory.dmp

                    Filesize

                    408KB

                  • memory/4880-15-0x0000000000010000-0x000000000006D000-memory.dmp

                    Filesize

                    372KB

                  • memory/4880-20-0x0000000002300000-0x0000000002366000-memory.dmp

                    Filesize

                    408KB

                  • memory/4880-19-0x0000000077974000-0x0000000077975000-memory.dmp

                    Filesize

                    4KB

                  • memory/4880-17-0x0000000002300000-0x0000000002366000-memory.dmp

                    Filesize

                    408KB

                  • memory/4880-64-0x0000000000980000-0x0000000000981000-memory.dmp

                    Filesize

                    4KB