Analysis
- max time kernel
144s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
10/01/2024, 09:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
30c64a63c72dc00e34ae6b7febee331c.exe
Resource
win7-20231215-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
30c64a63c72dc00e34ae6b7febee331c.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
28 signatures
150 seconds
General
- Target 30c64a63c72dc00e34ae6b7febee331c.exe
- Size 320KB
- Sample240110-ltyb1aeaf2
- SHA256 d9c84cb774cb69a853abf29df256adadb039ac9db07d4a042ce3d12620add5c3
- MD5 30c64a63c72dc00e34ae6b7febee331c
- SHA1 30b3a51b302f939703c817f7295e6f2091aa0a4a
- SHA512 4a54e41d6f82d27c9e90dd19e7a64898dae7a4df4cc52651b23e4b7aa19e92bdf665254f8040f2a06121da9bf161b3f62bcbcc3be0aa766acd76f3fe1d9c6a3b
- SSDEEP 6144:IaxVLX+cGjrDMbHRPKpvcobTU5AtSqji:vxV7+cGjEbwvcon0+Sw
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
smokeloader
Botnet
-
up3
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://host-file-host6.com/
-
http://host-host-file8.com/
rc4.i32
rc4.i32
Signatures
- Modifies firewall policy service 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" explorer.exe - SmokeLoader
Modular backdoor trojan in use since 2014.
- Sets file execution options in registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1971q975s1ee.exe D0AE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1971q975s1ee.exe\DisableExceptionChainValidation D0AE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "uocvhuq.exe" explorer.exe - Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation D552.exe - Deletes itself 1 IoCs
pid Process 3364 Process not Found - Executes dropped EXE 3 IoCs
pid Process 5072 D0AE.exe 3636 D552.exe 3936 WindowsUpdater.exe - Loads dropped DLL 2 IoCs
pid Process 3936 WindowsUpdater.exe 3936 WindowsUpdater.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Java Updater = "C:\\ProgramData\\Java Updater\\1971q975s1ee.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java Updater = "\"C:\\ProgramData\\Java Updater\\1971q975s1ee.exe\"" explorer.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA D0AE.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
pid Process 5072 D0AE.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe 1516 explorer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
pid pid_target Process procid_target 624 3104 WerFault.exe 71 2748 1516 WerFault.exe 104 - NSIS installer 4 IoCs
resource yara_rule behavioral2/files/0x0008000000023221-35.dat nsis_installer_2 behavioral2/files/0x0008000000023221-34.dat nsis_installer_2 behavioral2/files/0x0006000000023222-41.dat nsis_installer_1 behavioral2/files/0x0006000000023222-41.dat nsis_installer_2 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 30c64a63c72dc00e34ae6b7febee331c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 30c64a63c72dc00e34ae6b7febee331c.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 30c64a63c72dc00e34ae6b7febee331c.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 D0AE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString D0AE.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer explorer.exe - Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" explorer.exe - Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3104 30c64a63c72dc00e34ae6b7febee331c.exe 3104 30c64a63c72dc00e34ae6b7febee331c.exe 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found - Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 3104 30c64a63c72dc00e34ae6b7febee331c.exe 5072 D0AE.exe 5072 D0AE.exe - Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeShutdownPrivilege 3364 Process not Found Token: SeCreatePagefilePrivilege 3364 Process not Found Token: SeDebugPrivilege 5072 D0AE.exe Token: SeRestorePrivilege 5072 D0AE.exe Token: SeBackupPrivilege 5072 D0AE.exe Token: SeLoadDriverPrivilege 5072 D0AE.exe Token: SeCreatePagefilePrivilege 5072 D0AE.exe Token: SeShutdownPrivilege 5072 D0AE.exe Token: SeTakeOwnershipPrivilege 5072 D0AE.exe Token: SeChangeNotifyPrivilege 5072 D0AE.exe Token: SeCreateTokenPrivilege 5072 D0AE.exe Token: SeMachineAccountPrivilege 5072 D0AE.exe Token: SeSecurityPrivilege 5072 D0AE.exe Token: SeAssignPrimaryTokenPrivilege 5072 D0AE.exe Token: SeCreateGlobalPrivilege 5072 D0AE.exe Token: 33 5072 D0AE.exe Token: SeDebugPrivilege 1516 explorer.exe Token: SeRestorePrivilege 1516 explorer.exe Token: SeBackupPrivilege 1516 explorer.exe Token: SeLoadDriverPrivilege 1516 explorer.exe Token: SeCreatePagefilePrivilege 1516 explorer.exe Token: SeShutdownPrivilege 1516 explorer.exe Token: SeTakeOwnershipPrivilege 1516 explorer.exe Token: SeChangeNotifyPrivilege 1516 explorer.exe Token: SeCreateTokenPrivilege 1516 explorer.exe Token: SeMachineAccountPrivilege 1516 explorer.exe Token: SeSecurityPrivilege 1516 explorer.exe Token: SeAssignPrimaryTokenPrivilege 1516 explorer.exe Token: SeCreateGlobalPrivilege 1516 explorer.exe Token: 33 1516 explorer.exe Token: SeShutdownPrivilege 3364 Process not Found Token: SeCreatePagefilePrivilege 3364 Process not Found Token: SeShutdownPrivilege 3364 Process not Found Token: SeCreatePagefilePrivilege 3364 Process not Found Token: SeShutdownPrivilege 3364 Process not Found Token: SeCreatePagefilePrivilege 3364 Process not Found Token: SeShutdownPrivilege 3364 Process not Found Token: SeCreatePagefilePrivilege 3364 Process not Found Token: SeShutdownPrivilege 3364 Process not Found Token: SeCreatePagefilePrivilege 3364 Process not Found Token: SeShutdownPrivilege 3364 Process not Found Token: SeCreatePagefilePrivilege 3364 Process not Found Token: SeShutdownPrivilege 3364 Process not Found Token: SeCreatePagefilePrivilege 3364 Process not Found - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3364 Process not Found 3364 Process not Found - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3364 Process not Found - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3364 wrote to memory of 5072 3364 Process not Found 103 PID 3364 wrote to memory of 5072 3364 Process not Found 103 PID 3364 wrote to memory of 5072 3364 Process not Found 103 PID 5072 wrote to memory of 1516 5072 D0AE.exe 104 PID 5072 wrote to memory of 1516 5072 D0AE.exe 104 PID 5072 wrote to memory of 1516 5072 D0AE.exe 104 PID 3364 wrote to memory of 3636 3364 Process not Found 105 PID 3364 wrote to memory of 3636 3364 Process not Found 105 PID 3364 wrote to memory of 3636 3364 Process not Found 105 PID 3636 wrote to memory of 3936 3636 D552.exe 106 PID 3636 wrote to memory of 3936 3636 D552.exe 106 PID 3636 wrote to memory of 3936 3636 D552.exe 106 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\30c64a63c72dc00e34ae6b7febee331c.exe"C:\Users\Admin\AppData\Local\Temp\30c64a63c72dc00e34ae6b7febee331c.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3104 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 3682⤵
- Program crash
PID:624
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3104 -ip 31041⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\D0AE.exeC:\Users\Admin\AppData\Local\Temp\D0AE.exe1⤵
- Sets file execution options in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵
- Modifies firewall policy service
- Sets file execution options in registry
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
PID:1516 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 10843⤵
- Program crash
PID:2748
-
-
-
C:\Users\Admin\AppData\Local\Temp\D552.exeC:\Users\Admin\AppData\Local\Temp\D552.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe"C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3936
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1516 -ip 15161⤵PID:3520
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\D0AE.exe
- Size 360KB
- SHA256 6d99cec56614b6b8a23dfa84a50c6bbfde535411c6366ac2bcc20c9f5af62880
- MD5 80c413180b6bd0dd664adc4e0665b494
- SHA1 e791e4a3391fc6b7bcb58399cd4fa3c52a06b940
- SHA512 347f4ae6f308b37d055a6177478e45ab3838d7020abed70c7aa138d2c3771e709de204da8550aebdcaa6139d869dc7328cc7e645c4dd48d1066f9ad70225644a
- SSDEEP 6144:VuWFksgTOzEV6zs1hfk8MIcG1Zb7d+0PuSCU4CzmJkdVds:5FkRTOzEV6zs1hfk8oYVd+Dj4mYVds
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\D552.exe
- Size 893KB
- SHA256 103425b8d5e70cc274adc700a8a68335a77d5aba82e209fca0594ca3398dd648
- MD5 1832f18947ffbfb6500da548e362318b
- SHA1 81dc908b313f9698ee6d12eeacaa22813c76d337
- SHA512 07f8188f0a79e727c85c0b9a8ed34699f7ad737bf923cc185273a6c47ad503743c7c86cc5c688ba088055bc8fc302afbed8e01710b866b00b4acb908d46eaa5c
- SSDEEP 12288:JORLI8QY5O/PtXTWe+hjWrfQzYI1eaXXzbI38876U0fa6ZhB1x8ZkeGpnRW9CXex:YUF0cXuhjiIFeQXI9mU01F1cwPXbqNL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\D552.exe
- Size 381KB
- SHA256 4fa951583b146ecc4789c7c44d1caa49c26852c48e33dd722988cbea3e9ac965
- MD5 90604ca6cddb2b59b4d07145709693e0
- SHA1 a89db9ca6e0e31be896c958a361c32185108947a
- SHA512 45005505725febd9796b5d62aac121cc106e10c8119a8b2705a40d58d05b297a2bab76bc7714738f02c83bcd1fff7868478d6604ae565a1674fd4c9286de6770
- SSDEEP 6144:Jt50ObWRVZnvA8QpqJGshTM9r/PkY1XGaJWe+hjWntaGZtpCVC0inI1gxaXn:JORLI8QY5O/PtXTWe+hjWrfQzYI1eaXn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe
- Size 92KB
- SHA256 864defbec2fdbf1c26aa05e4c6c12f1fea98099890ae1349db642b3c31873b39
- MD5 fa23949873a89ff520e2788b5c2bb55b
- SHA1 187a183d9b0dafc8dc463fe80a6ccc8aba8f1279
- SHA512 b7bfbac096cad020e7ee7cb3fbd2985fc738fbdec7f70603b97c2b073217398b95c8b5ba66c23ffb26fe385f14e60307c29bc36bace916f7a65cb6c008bb880d
- SSDEEP 1536:wtMzjzcvy9Qz30DAvd8cQbqRv38ubButixyp1XZabfOg2gkpNTbi7rR:wtovcIDAvScQba2dZabfQpNnMV
- MD5 SHA1 SHA512 SSDEEP