Overview

overview

10

Static

static

3

ea040833f5...c4.exe

windows7-x64

10

ea040833f5...c4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-01-2024 03:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ea040833f500c29fb2229a00c1578500c65fffddab8eea70083ef392cc066bc4.exe

  • Size

    290KB

  • MD5

    6db27327a2233d8ee11abbed6229604b

  • SHA1

    feb1887bd6f9c0f84ed539be18d2812042d87e74

  • SHA256

    ea040833f500c29fb2229a00c1578500c65fffddab8eea70083ef392cc066bc4

  • SHA512

    a0fac0a468fbc7d4f4b9a03a2a5fb94ec90172f04805066250a6c2fbf322a149acba3ecfd4cfa6889218e0c51bcece9d26c355cf36d5f939cb828a7735d5c5bf

  • SSDEEP

    6144:BecoZjpjdRLk/7Y8XOFPN8v9ntG/689RjObRXMA:B+ZjpRRA/7XOFPSvJq68fjObph

Score
10/10
betabotsmokeloaderpub1backdoorbotnetevasionpersistencetrojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/
rc4.i32
rc4.i32

Signatures

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

    trojanbackdoorbotnetbetabot
  • Modifies firewall policy service 2 TTPs 4 IoCs
    evasion
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Sets file execution options in registry 2 TTPs 4 IoCs
    persistence
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • NSIS installer 8 IoCs
    installer
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\ea040833f500c29fb2229a00c1578500c65fffddab8eea70083ef392cc066bc4.exe
    "C:\Users\Admin\AppData\Local\Temp\ea040833f500c29fb2229a00c1578500c65fffddab8eea70083ef392cc066bc4.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4808
    • C:\Users\Admin\AppData\Local\Temp\ea040833f500c29fb2229a00c1578500c65fffddab8eea70083ef392cc066bc4.exe
      "C:\Users\Admin\AppData\Local\Temp\ea040833f500c29fb2229a00c1578500c65fffddab8eea70083ef392cc066bc4.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:4908
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 328
        3⤵
        • Program crash
        PID:2108
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4908 -ip 4908
    1⤵
      PID:4676
    • C:\Users\Admin\AppData\Local\Temp\99B0.exe
      C:\Users\Admin\AppData\Local\Temp\99B0.exe
      1⤵
      • Sets file execution options in registry
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Checks processor information in registry
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:852
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        2⤵
        • Modifies firewall policy service
        • Sets file execution options in registry
        • Checks BIOS information in registry
        • Adds Run key to start application
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Checks processor information in registry
        • Enumerates system info in registry
        • Modifies Internet Explorer Protected Mode
        • Modifies Internet Explorer Protected Mode Banner
        • Modifies Internet Explorer settings
        • Suspicious use of AdjustPrivilegeToken
        PID:2904
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 1072
          3⤵
          • Program crash
          PID:2172
    • C:\Users\Admin\AppData\Local\Temp\A058.exe
      C:\Users\Admin\AppData\Local\Temp\A058.exe
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3500
      • C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe
        "C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3804
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2904 -ip 2904
      1⤵
        PID:4156

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\99B0.exe
        Filesize

        360KB

        MD5

        80c413180b6bd0dd664adc4e0665b494

        SHA1

        e791e4a3391fc6b7bcb58399cd4fa3c52a06b940

        SHA256

        6d99cec56614b6b8a23dfa84a50c6bbfde535411c6366ac2bcc20c9f5af62880

        SHA512

        347f4ae6f308b37d055a6177478e45ab3838d7020abed70c7aa138d2c3771e709de204da8550aebdcaa6139d869dc7328cc7e645c4dd48d1066f9ad70225644a

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\A058.exe
        Filesize

        1.1MB

        MD5

        6b31e23c2b0d302a87f4ff0e971faab0

        SHA1

        11301e0a8c8d77ca283a05ef2a12b3078693d41e

        SHA256

        ff5bba9e5173d9da3e69e564b9ca35fda309c0dfba4a0e6de1e6d6ee35c00577

        SHA512

        8ad8d14a18472eac374d90cf028a023caea1a06f2b9a2bbefcf880436a797000642fd0f38f3d233409425b23aec419f11c5b0b5f0fecc11b7577b1ec7e9d252b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\A058.exe
        Filesize

        1.6MB

        MD5

        4418849fb4ce3f02c066a1e1464528e2

        SHA1

        6b022bac813248ce0c0a73bd2c0994a228c41a98

        SHA256

        1f83add80e6e79379f051c668285e50271dd926a0224836ca914a6db1ddef3ec

        SHA512

        659223459e04a5b8c9ece58bc4f9bea5dccb5432f39f78a58defabec23622c9d31bd7b4fceacd8fe7e3eda6e34cd0b6087bd78aed8f0fd2a2fbb98471de2c05f

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe
        Filesize

        616KB

        MD5

        2aa7d4efb3faa9225a58195b68eb98d7

        SHA1

        9c70f1a0d5bac6dbec5251408fa47a028aaff444

        SHA256

        64399ae6964ba55f938a3b692d4ea1e866f1e8df040658184d2b01580b80d2e0

        SHA512

        04bb34406509ae261461f0fd2c3e08243c810ec3fa63d6cfee03b85e58011496b98cdc37944c9acd571cd585f694e4701b737b0ee90dee2263672f7c1939eb17

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe
        Filesize

        220KB

        MD5

        28507fc217cb276a92519823eac40774

        SHA1

        70025049ca79e3032b3c503e94f79c05d830d2eb

        SHA256

        7bbfea5a715c73f22770d937e607b3df2715ca4f5e3a4747ed68d2d9eca35459

        SHA512

        fb72acd3c879eec90e787188e0cce7434ed31e268fcc0404c49870829365e83695199b42c26eb7900868511ddc420c7b97574e37ef1fbeb6eca400c836f28d25

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe
        Filesize

        92KB

        MD5

        fa23949873a89ff520e2788b5c2bb55b

        SHA1

        187a183d9b0dafc8dc463fe80a6ccc8aba8f1279

        SHA256

        864defbec2fdbf1c26aa05e4c6c12f1fea98099890ae1349db642b3c31873b39

        SHA512

        b7bfbac096cad020e7ee7cb3fbd2985fc738fbdec7f70603b97c2b073217398b95c8b5ba66c23ffb26fe385f14e60307c29bc36bace916f7a65cb6c008bb880d

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\lib.dll
        Filesize

        92KB

        MD5

        ddedfd23bdbb44a6b89cb63778c9a12f

        SHA1

        c80b261146f16a9e34d40947f0b97024742713db

        SHA256

        fb3946bcf285f3d6b07e20ac4f2344de316c89afadc9a91829f5ae1b5f1af23c

        SHA512

        10931539ae3cc4ceede9cb70ba296c086349a8573737a74da9611bee72ddc7c319ac893df2c441a699bf1eeb160ea32846337ff7e00d4eb48a29c332fb248073

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nslA1A0.tmp\System.dll
        Filesize

        3KB

        MD5

        59051403ca9862579ef69cda1fc6d430

        SHA1

        a8fee347200937ddb715046fc67702f1ec93128f

        SHA256

        100371e908ffe9f8effa40cc4b5b52bfb81920eb99ad044625dc91ae1ec5a3e6

        SHA512

        b700295512045d9dc304064a7169ad3b532a45b46f39166d7059e2a692bc8f4126476f498fb496c2ef7e8bdabb410128ddf58778bd5882d465d9d1620270bff9

        Download Submit

      • memory/852-18-0x00000000022D0000-0x0000000002336000-memory.dmp

        Filesize

        408KB

        Download

      • memory/852-19-0x0000000000730000-0x000000000073D000-memory.dmp

        Filesize

        52KB

        Download

      • memory/852-20-0x0000000077B74000-0x0000000077B75000-memory.dmp

        Filesize

        4KB

        Download

      • memory/852-21-0x0000000002800000-0x0000000002801000-memory.dmp

        Filesize

        4KB

        Download

      • memory/852-25-0x00000000022D0000-0x0000000002336000-memory.dmp

        Filesize

        408KB

        Download

      • memory/852-23-0x0000000002830000-0x000000000283C000-memory.dmp

        Filesize

        48KB

        Download

      • memory/852-22-0x00000000022D0000-0x0000000002336000-memory.dmp

        Filesize

        408KB

        Download

      • memory/852-32-0x00000000022D0000-0x0000000002336000-memory.dmp

        Filesize

        408KB

        Download

      • memory/852-16-0x0000000000010000-0x000000000006D000-memory.dmp

        Filesize

        372KB

        Download

      • memory/852-34-0x0000000002820000-0x0000000002821000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2904-28-0x0000000000FF0000-0x0000000001424000-memory.dmp

        Filesize

        4.2MB

        Download

      • memory/2904-60-0x0000000000CC0000-0x0000000000D84000-memory.dmp

        Filesize

        784KB

        Download

      • memory/2904-29-0x0000000000CC0000-0x0000000000D84000-memory.dmp

        Filesize

        784KB

        Download

      • memory/2904-33-0x0000000000CC0000-0x0000000000D84000-memory.dmp

        Filesize

        784KB

        Download

      • memory/2904-61-0x00000000030D0000-0x00000000030D2000-memory.dmp

        Filesize

        8KB

        Download

      • memory/2904-26-0x0000000000FF0000-0x0000000001424000-memory.dmp

        Filesize

        4.2MB

        Download

      • memory/2904-63-0x0000000000FF0000-0x0000000001423000-memory.dmp

        Filesize

        4.2MB

        Download

      • memory/2904-64-0x0000000000CC0000-0x0000000000D84000-memory.dmp

        Filesize

        784KB

        Download

      • memory/2904-30-0x0000000000CC0000-0x0000000000D84000-memory.dmp

        Filesize

        784KB

        Download

      • memory/3500-48-0x0000000000DB0000-0x0000000001346000-memory.dmp

        Filesize

        5.6MB

        Download

      • memory/3500-41-0x0000000000DB0000-0x0000000001346000-memory.dmp

        Filesize

        5.6MB

        Download

      • memory/3560-5-0x0000000000680000-0x0000000000696000-memory.dmp

        Filesize

        88KB

        Download

      • memory/4808-2-0x0000000002060000-0x0000000002069000-memory.dmp

        Filesize

        36KB

        Download

      • memory/4808-1-0x00000000004F0000-0x00000000005F0000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/4908-4-0x0000000000400000-0x0000000000409000-memory.dmp

        Filesize

        36KB

        Download

      • memory/4908-3-0x0000000000400000-0x0000000000409000-memory.dmp

        Filesize

        36KB

        Download

      • memory/4908-8-0x0000000000400000-0x0000000000409000-memory.dmp

        Filesize

        36KB

        Download