Analysis
-
max time kernel
36s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
09-01-2024 03:02
General
-
Target
2739b41aab3ff3cc0727ada7ad04162f0379ef151c7d4b4296e963a2a74891c5.exe
-
Size
300KB
-
MD5
8c6bef1a357f339aae97e1e29a5eb682
-
SHA1
43da742dc3c195f703680ee5078c4a9ec77b92e0
-
SHA256
2739b41aab3ff3cc0727ada7ad04162f0379ef151c7d4b4296e963a2a74891c5
-
SHA512
35da85906b763230494a348d3f08ae21172f1680af940661d5dec51becb45b9f783eefc130f7611290a8cf4cfa263c195c0ca9152cb4c2f3e8e80a981f180931
-
SSDEEP
6144:qLSLqSQSiZ9jlMWzLUeBPSGfTgYn79o6q:qLSmSiZ9jlMWXdP5n7a
Malware Config
Extracted
smokeloader
pub1
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Program crash 1 IoCs
-
NSIS installer 8 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 14 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2739b41aab3ff3cc0727ada7ad04162f0379ef151c7d4b4296e963a2a74891c5.exe"C:\Users\Admin\AppData\Local\Temp\2739b41aab3ff3cc0727ada7ad04162f0379ef151c7d4b4296e963a2a74891c5.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\D1B7.exeC:\Users\Admin\AppData\Local\Temp\D1B7.exe1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 11483⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\D8AE.exeC:\Users\Admin\AppData\Local\Temp\D8AE.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe"C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4612 -ip 46121⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
360KB
MD580c413180b6bd0dd664adc4e0665b494
SHA1e791e4a3391fc6b7bcb58399cd4fa3c52a06b940
SHA2566d99cec56614b6b8a23dfa84a50c6bbfde535411c6366ac2bcc20c9f5af62880
SHA512347f4ae6f308b37d055a6177478e45ab3838d7020abed70c7aa138d2c3771e709de204da8550aebdcaa6139d869dc7328cc7e645c4dd48d1066f9ad70225644a
-
Filesize
2.0MB
MD5c74486643fc206113cf40f9ae565a63f
SHA109825afb45e1dcc2090b8768eb40e8a12bcc5bd0
SHA256d13b4c567263f7cc3b9ae8c8410d44066cfdb847a0530d4e07538fb2557027e6
SHA51244fd96d509bb8b71b272976129f56c2735badb6ed129bdf05d13b7e7ea9bf60143de93e581f918b27027ef237f0d7b027e03642678bde920c82cbd5984dec3c3
-
Filesize
2.1MB
MD58436d56518f09ce75f84ab69fac478e4
SHA16ac0278c03dd601479642f568093e5e5c9dc9690
SHA256e773feb8c25e797c4d26d4a459995ebf05565b5ac19a77fdc7f2a490a5ccc69a
SHA5124c7384a3004760e83b3ab630f610e3b0574328a85d4abca9c20f812355f7f7800188b628cfc829a813c85fa3addbc0804f61454a40b1853ce893d675f8f349e6
-
Filesize
147KB
MD5be845b62057f54b1210b5e52600b4544
SHA18506b4c209914fa0c50b361c78c3b3d3c81fad93
SHA256623e53ebe1c923e65b9f6cea9c99244eef6a1e04bd3582952ff1a636ecb8452d
SHA51287f5e0b1d314af098db68653f4fdfb42abd186d162d0e6c9f697f0f2ce88df2d0a00b58d26b693e0b536e3e937299f89e2a2eea4ca632149484406751fec311f
-
Filesize
123KB
MD529e849fa9c84877961b2c8714eaf8f84
SHA18502aa4c4be20d604e3cd451af8257dca9ce0f86
SHA2566fae06496ca47739a1dcc0e931c9d1b89a01c85327a861223c0fa95a7258baca
SHA51211c3981f157faba73f40bfc0c1dd6afdd360a0dbbc2481684624c86932ac39b30ea715c11457a25e4695fd5c910c991842628edb7d2fc12542d04589fec61d93
-
Filesize
87KB
MD53cbb401424f9570422172c620b82ec48
SHA1a62e5001b4642436c2bc1dd5e297e67c497284e2
SHA2568f80fdb5571b757887594504d1e0883d36fcb6725e941906298933bc5fe6b168
SHA512dc4dc737bd94f1e260f6c366023dcba55f4f548a12ffb898023b0f4e40a6758fce8e094a3530108395feade89483520c1f3caf7f7a8ade1855d9e8599142a171
-
Filesize
98KB
MD50aa4a4d113d3d4a4fa010b99ced2bab3
SHA1fe2b963b602a41aef0411296fa31414700fc4ed1
SHA256cc9ec7ad11d1a67bcd56faa8b04805787f828248ce5b8b9acc8b8c25cf519a55
SHA512d8bd894061a40c5b8f2a1ce594720a45d249dcc225f369e61f0f7b08850aa9c7c26c24e5b3089027806da6061481bf52eccb0fbd89283c3c13e5bc5b1c679983
-
Filesize
12KB
MD5dd87a973e01c5d9f8e0fcc81a0af7c7a
SHA1c9206ced48d1e5bc648b1d0f54cccc18bf643a14
SHA2567fb0f8d452fefaac789986b933df050f3d3e4feb8a8d9944ada995f572dcdca1
SHA5124910b39b1a99622ac8b3c42f173bbe7035ac2f8d40c946468e7db7e2868a2da81ea94da453857f06f39957dd690c7f1ba498936a7aaa0039975e472376f92e8f
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
88KB
-
Filesize
324KB
-
Filesize
36KB
-
Filesize
324KB
-
Filesize
1024KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
4.2MB
-
Filesize
8KB
-
Filesize
784KB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
52KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
4KB
-
Filesize
408KB
-
Filesize
372KB
-
Filesize
4KB
-
Filesize
48KB
-
Filesize
408KB
-
Filesize
4KB