Analysis
- max time kernel
150s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
10/01/2024, 09:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
30c64a63c72dc00e34ae6b7febee331c.exe
Resource
win7-20231129-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
30c64a63c72dc00e34ae6b7febee331c.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
27 signatures
150 seconds
General
- Target 30c64a63c72dc00e34ae6b7febee331c.exe
- Size 320KB
- Sample240110-lrmgqaeaa6
- SHA256 d9c84cb774cb69a853abf29df256adadb039ac9db07d4a042ce3d12620add5c3
- MD5 30c64a63c72dc00e34ae6b7febee331c
- SHA1 30b3a51b302f939703c817f7295e6f2091aa0a4a
- SHA512 4a54e41d6f82d27c9e90dd19e7a64898dae7a4df4cc52651b23e4b7aa19e92bdf665254f8040f2a06121da9bf161b3f62bcbcc3be0aa766acd76f3fe1d9c6a3b
- SSDEEP 6144:IaxVLX+cGjrDMbHRPKpvcobTU5AtSqji:vxV7+cGjEbwvcon0+Sw
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
smokeloader
Botnet
-
up3
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://host-file-host6.com/
-
http://host-host-file8.com/
rc4.i32
rc4.i32
Signatures
- Modifies firewall policy service 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" explorer.exe - SmokeLoader
Modular backdoor trojan in use since 2014.
- Sets file execution options in registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\3739w9357i7595.exe 1A69.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\3739w9357i7595.exe\DisableExceptionChainValidation 1A69.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "hggdbvuxbm.exe" explorer.exe - Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation 219D.exe - Deletes itself 1 IoCs
pid Process 3332 Process not Found - Executes dropped EXE 3 IoCs
pid Process 4040 1A69.exe 1960 219D.exe 3948 WindowsUpdater.exe - Loads dropped DLL 2 IoCs
pid Process 3948 WindowsUpdater.exe 3948 WindowsUpdater.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Java Updater = "C:\\ProgramData\\Java Updater\\3739w9357i7595.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java Updater = "\"C:\\ProgramData\\Java Updater\\3739w9357i7595.exe\"" explorer.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 1A69.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
pid Process 4040 1A69.exe 1156 explorer.exe 1156 explorer.exe 1156 explorer.exe 1156 explorer.exe 1156 explorer.exe 1156 explorer.exe 1156 explorer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
pid pid_target Process procid_target 1912 1156 WerFault.exe 103 - NSIS installer 8 IoCs
resource yara_rule behavioral2/files/0x0007000000023274-20.dat nsis_installer_2 behavioral2/files/0x0007000000023274-22.dat nsis_installer_2 behavioral2/files/0x0008000000023143-35.dat nsis_installer_1 behavioral2/files/0x0008000000023143-35.dat nsis_installer_2 behavioral2/files/0x0008000000023143-37.dat nsis_installer_1 behavioral2/files/0x0008000000023143-37.dat nsis_installer_2 behavioral2/files/0x0008000000023143-41.dat nsis_installer_1 behavioral2/files/0x0008000000023143-41.dat nsis_installer_2 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 30c64a63c72dc00e34ae6b7febee331c.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 30c64a63c72dc00e34ae6b7febee331c.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 30c64a63c72dc00e34ae6b7febee331c.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 1A69.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 1A69.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer explorer.exe - Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" explorer.exe - Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4048 30c64a63c72dc00e34ae6b7febee331c.exe 4048 30c64a63c72dc00e34ae6b7febee331c.exe 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found 3332 Process not Found - Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 4048 30c64a63c72dc00e34ae6b7febee331c.exe 4040 1A69.exe 4040 1A69.exe - Suspicious use of AdjustPrivilegeToken 30 IoCs
description pid Process Token: SeDebugPrivilege 4040 1A69.exe Token: SeRestorePrivilege 4040 1A69.exe Token: SeBackupPrivilege 4040 1A69.exe Token: SeLoadDriverPrivilege 4040 1A69.exe Token: SeCreatePagefilePrivilege 4040 1A69.exe Token: SeShutdownPrivilege 4040 1A69.exe Token: SeTakeOwnershipPrivilege 4040 1A69.exe Token: SeChangeNotifyPrivilege 4040 1A69.exe Token: SeCreateTokenPrivilege 4040 1A69.exe Token: SeMachineAccountPrivilege 4040 1A69.exe Token: SeSecurityPrivilege 4040 1A69.exe Token: SeAssignPrimaryTokenPrivilege 4040 1A69.exe Token: SeCreateGlobalPrivilege 4040 1A69.exe Token: 33 4040 1A69.exe Token: SeDebugPrivilege 1156 explorer.exe Token: SeRestorePrivilege 1156 explorer.exe Token: SeBackupPrivilege 1156 explorer.exe Token: SeLoadDriverPrivilege 1156 explorer.exe Token: SeCreatePagefilePrivilege 1156 explorer.exe Token: SeShutdownPrivilege 1156 explorer.exe Token: SeTakeOwnershipPrivilege 1156 explorer.exe Token: SeChangeNotifyPrivilege 1156 explorer.exe Token: SeCreateTokenPrivilege 1156 explorer.exe Token: SeMachineAccountPrivilege 1156 explorer.exe Token: SeSecurityPrivilege 1156 explorer.exe Token: SeAssignPrimaryTokenPrivilege 1156 explorer.exe Token: SeCreateGlobalPrivilege 1156 explorer.exe Token: 33 1156 explorer.exe Token: SeShutdownPrivilege 3332 Process not Found Token: SeCreatePagefilePrivilege 3332 Process not Found - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3332 Process not Found - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3332 wrote to memory of 4040 3332 Process not Found 99 PID 3332 wrote to memory of 4040 3332 Process not Found 99 PID 3332 wrote to memory of 4040 3332 Process not Found 99 PID 3332 wrote to memory of 1960 3332 Process not Found 101 PID 3332 wrote to memory of 1960 3332 Process not Found 101 PID 3332 wrote to memory of 1960 3332 Process not Found 101 PID 4040 wrote to memory of 1156 4040 1A69.exe 103 PID 4040 wrote to memory of 1156 4040 1A69.exe 103 PID 4040 wrote to memory of 1156 4040 1A69.exe 103 PID 1960 wrote to memory of 3948 1960 219D.exe 104 PID 1960 wrote to memory of 3948 1960 219D.exe 104 PID 1960 wrote to memory of 3948 1960 219D.exe 104 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\30c64a63c72dc00e34ae6b7febee331c.exe"C:\Users\Admin\AppData\Local\Temp\30c64a63c72dc00e34ae6b7febee331c.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4048
-
C:\Users\Admin\AppData\Local\Temp\1A69.exeC:\Users\Admin\AppData\Local\Temp\1A69.exe1⤵
- Sets file execution options in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵
- Modifies firewall policy service
- Sets file execution options in registry
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
PID:1156 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 11323⤵
- Program crash
PID:1912
-
-
-
C:\Users\Admin\AppData\Local\Temp\219D.exeC:\Users\Admin\AppData\Local\Temp\219D.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe"C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3948
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1156 -ip 11561⤵PID:3496
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\1A69.exe
- Size 360KB
- SHA256 6d99cec56614b6b8a23dfa84a50c6bbfde535411c6366ac2bcc20c9f5af62880
- MD5 80c413180b6bd0dd664adc4e0665b494
- SHA1 e791e4a3391fc6b7bcb58399cd4fa3c52a06b940
- SHA512 347f4ae6f308b37d055a6177478e45ab3838d7020abed70c7aa138d2c3771e709de204da8550aebdcaa6139d869dc7328cc7e645c4dd48d1066f9ad70225644a
- SSDEEP 6144:VuWFksgTOzEV6zs1hfk8MIcG1Zb7d+0PuSCU4CzmJkdVds:5FkRTOzEV6zs1hfk8oYVd+Dj4mYVds
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\219D.exe
- Size 3.3MB
- SHA256 76710df554205fd91d436ca79e75c0611d0c6005daa47ef53ce0d2f9e9bd6013
- MD5 d5edbf6fd2fd0b35e117f971179cb0d6
- SHA1 27cb81e3f00a44a74937176f43289cb6d535c9a4
- SHA512 9548a9d9c3c4a8cec4164b36bc08f7e9ed70a5a0f185a77bed2c43ade9e025f8a341dbcef0836a227f7d4a24559495898aaef1c8961b328e6186b790baa9b254
- SSDEEP 98304:keMUmbMp/oC4lzgpl6caZK+YsYA5ReZwb:ke9tzYzgpl6X7/YA/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\219D.exe
- Size 2.9MB
- SHA256 a8eda196a543f68a98b7673233cc7e3cadc7be04b316c39c704935936df4a69d
- MD5 3a2e3ccc016dea76c5a228537b61dd40
- SHA1 e69858fd69ae5199adcf8ad7f606a3fe93a589e2
- SHA512 670d70cf372b2e5c929e991603ca08a4ce2c9246a4d662c47007c8fe873a5e1f55ed0fe1650ea2d2600d5d5e95616074e51d79b594cbc6b71bbfb85db98ed612
- SSDEEP 49152:YVcX0jpE9mUm1VMp/h+U9b34lzgplaVunjmZ9s+/vIsBiAi4RebVrj:keMUmbMp/oC4lzgpl6caZK+YsYA5ReZv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe
- Size 1.3MB
- SHA256 fef15994276439793721d091e8fb00cd1babc32dea5f3cbeec9aa9cac10f422c
- MD5 91ab7399b72b8922e5f008320d64935c
- SHA1 40d6915e0decc8cdbcaedeee8083156c51ecf3df
- SHA512 e1be8952752fa47bccd8bfd8d7041a48849bb3acf0d002327e0edb8bf57830480b31168aaa4ab52e9cf4047a2e6d22859adff7adaa5b0cc0726ee1698520e313
- SSDEEP 24576:9F0cXuhjiIFeQXI9mU01F1cwPXbqNIqB/h+0P9bBIYl6j5nlOd2pgoIWt:4cX0jpE9mUm1VMp/h+U9b34lzgpA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe
- Size 1.1MB
- SHA256 e2eaf377562e2ca3e60a93f76d6893e44af18f0d2c0aac9ae7cbfcd836739010
- MD5 eccde849238e7c2066be6006dee3c179
- SHA1 b56bcb2e66f5e486f4f6a9dde3963024312cea6c
- SHA512 7d62bac4da3da793161f018786b0ed6032740ba601472847b97d37ed6d813b334ad2d1151cf878aa4dfbc158f39287c12983f76b52678b55a028c32b75f0f0a0
- SSDEEP 24576:9F0cXuhjiIFeQXI9mU01F1cwPXbqNIqB/h+0P9bBIYl6j5nl8:4cX0jpE9mUm1VMp/h+U9b34l8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe
- Size 776KB
- SHA256 77fa3345f1006a78d030525f5a489d169acf3edacc469487cd90726b6bed055f
- MD5 1466a4db7b411c950143867b244859e2
- SHA1 2ab554cc1c3f792bf79802fe24a233f71d0a40dc
- SHA512 35ddeca06a8174bc3699ccabc29723fb6f968d8bed76d3dcf58a08e809e0067284c85913a46ce170582db734732e714c34c9bdfe08bac7d3607a8ad99e358db9
- SSDEEP 12288:gI8QY5O/PtXTWe+hjWrfQzYI1eaXXzbI38876U0fa6ZhB1x8ZkeGpnRW9CXePrwx:9F0cXuhjiIFeQXI9mU01F1cwPXbqNg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\lib.dll
- Size 1.5MB
- SHA256 315b111b92847a36ad03170f7de920cddc2a5e767e991fb14250e0e0c3571e7d
- MD5 e536b711b1a3e8a629f8bd8fd9c02627
- SHA1 66ab602e04c69c177f42643a2805032080f31bd4
- SHA512 98df6f11e852189085e305b7a7091bd0937c1cd208414a92202785694c4b52f1383b33e7baae44b317f6724f956d4debbd90d227ceddb77d0374c59d10601c05
- SSDEEP 24576:79F2hjiI/e+bi9mMEDD1Gw39zqv+q3/7+0B9btIYLmj5npAd6NgoAW2L+GO6nQQC:79Kjpo9mMG19gF/7+w9bRcpLgnB+36no
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsm3053.tmp\System.dll
- Size 12KB
- SHA256 7fb0f8d452fefaac789986b933df050f3d3e4feb8a8d9944ada995f572dcdca1
- MD5 dd87a973e01c5d9f8e0fcc81a0af7c7a
- SHA1 c9206ced48d1e5bc648b1d0f54cccc18bf643a14
- SHA512 4910b39b1a99622ac8b3c42f173bbe7035ac2f8d40c946468e7db7e2868a2da81ea94da453857f06f39957dd690c7f1ba498936a7aaa0039975e472376f92e8f
- SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/993:97pJp48F2exrg5F/9
- MD5 SHA1 SHA512 SSDEEP