Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
15-01-2024 01:00
General
-
Target
00924a49c1fc68fa7b54e1cacdf19c93.exe
-
Size
235KB
-
MD5
00924a49c1fc68fa7b54e1cacdf19c93
-
SHA1
391c74453d3c3a23ebc22e307a6f071bcc818c9e
-
SHA256
ac78b4ea0e6ae2d971799e6505d937f15276df8f34a509983f423622fed31cf0
-
SHA512
d1cccc99f3df6cc0676f2a6e86ad9dc1284d6312148f2a389622d50a4469e159122118c14b30462e3e5fac8d54400f08e14948658804905615abf584daf87a67
-
SSDEEP
3072:RC2zySmwWaXJVCadJizA1KSB2JybTZS5ygptqwldE2fARvSL:RC2m6qaQMlLgpH7YSL
Malware Config
Extracted
smokeloader
pub1
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Signatures
-
BetaBot
Beta Bot is a Trojan that infects computers and disables Antivirus.
-
Modifies firewall policy service 2 TTPs 8 IoCs
-
Modifies security service 2 TTPs 1 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Disables taskbar notifications via registry modification
-
Disables use of System Restore points 1 TTPs
-
Sets file execution options in registry 2 TTPs 20 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks for any installed AV software in registry 1 TTPs 2 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Drops desktop.ini file(s) 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
-
NSIS installer 3 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 2 IoCs
-
Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
-
Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
NTFS ADS 2 IoCs
-
Runs regedit.exe 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 60 IoCs
-
Suspicious use of WriteProcessMemory 54 IoCs
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\00924a49c1fc68fa7b54e1cacdf19c93.exe"C:\Users\Admin\AppData\Local\Temp\00924a49c1fc68fa7b54e1cacdf19c93.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\AB3D.exeC:\Users\Admin\AppData\Local\Temp\AB3D.exe2⤵
- Sets file execution options in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Modifies firewall policy service
- Sets file execution options in registry
- Checks BIOS information in registry
- Loads dropped DLL
- Adds Run key to start application
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- NTFS ADS
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\y1g1q331gwcyei_1.exe/suac4⤵
- Modifies firewall policy service
- Sets file execution options in registry
- Executes dropped EXE
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regedit.exe"C:\Windows\SysWOW64\regedit.exe"5⤵
- Modifies security service
- Sets file execution options in registry
- Sets service image path in registry
- Runs regedit.exe
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /CREATE /SC ONLOGON /TN "Windows Update Check - 0x1BB70478" /TR "C:\PROGRA~3\JAVAUP~1\Y1G1Q3~1.EXE" /RL HIGHEST5⤵
- Creates scheduled task(s)
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\B0E9.exeC:\Users\Admin\AppData\Local\Temp\B0E9.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
360KB
MD580c413180b6bd0dd664adc4e0665b494
SHA1e791e4a3391fc6b7bcb58399cd4fa3c52a06b940
SHA2566d99cec56614b6b8a23dfa84a50c6bbfde535411c6366ac2bcc20c9f5af62880
SHA512347f4ae6f308b37d055a6177478e45ab3838d7020abed70c7aa138d2c3771e709de204da8550aebdcaa6139d869dc7328cc7e645c4dd48d1066f9ad70225644a
-
Filesize
100KB
MD57a156b2139100c9e1db95f29bf37cdc5
SHA19f7c416927e39882e843fc7234b5b408cd9ae1f0
SHA256bedacc9b03649fa2b50a86389faade3369b8429d2aae910f3f187cdf65a7dd4f
SHA5124ab189ee075e441e812b18a96b5d364c52bd42131e0634c4c7cb8df36db5ed2c757bdf437937504547e594a7e13c8457bd8cf747fe12d5d1c46bc17ce7bcef80
-
Filesize
404KB
MD55de47a79921940795ff700d31f2932c7
SHA14d8e06805e92b033b5fcf0d62a9edd71f5e4c73a
SHA2561cfa68d55b7a20fd87f7ea453f3448ec7dd2674f71efd6b1326d844e43a1f042
SHA5126ee63aaf6b417af411725dc40015d8d581060900284b2cf48a28f5b7f54a7dfeac0f39b2b2c6526389ee95c764ffe543dba4b9db7ccb4d7aab6240c82680ea15
-
Filesize
245KB
MD52d8dbed559721d1f50688444bbfd1682
SHA1342754d501a8b9e963c8afa5372fdad6b0755f38
SHA2565104783217624ecb247733086883aaec971a00e0750f7b27357b18db3738edea
SHA5123165de69bc5bec35db3aac3b86d61609a275939e109b063473ac72531f22b54acc183a2e1d21ed32d2ba5eb89ad9bf6ade62be2b34bfa9b012e6fc6246d6585a
-
Filesize
366KB
MD50eb4d39ce96b9decc916c7cdd8206267
SHA1330dce722f95e923e636739d9ae8d6258d145e4c
SHA25634b77b93363fe7337f0d523c0cc2409b78118f14af825a2a64ef2128873d4d2a
SHA51294047ef15c193807b4816667fd1e5e4576e1cc0fc42a116011d7245987835f63a8a2d862390924ea308e9c67f3f114e5410cabe2d4a58804ec1adb78b607d10f
-
Filesize
249KB
MD54dc22f3a6ceec986ad2849bdb3db87d0
SHA1d9204f6f4e0f6716a1cef914e83a7e4c7990199c
SHA2565eb9c01db8da8cd49cc64a7232703bc25aa808b345ebbde13c0cdb738d23d574
SHA51212e47d5caf43a4937aa2003bbb7e57223f2af0a9494d1742283b410bd95ba5f9ce00994cedfd93c84e54b8e875d9e75ea3ea30aa232b9cd4b2b09c4a5eab5933
-
Filesize
235KB
MD500924a49c1fc68fa7b54e1cacdf19c93
SHA1391c74453d3c3a23ebc22e307a6f071bcc818c9e
SHA256ac78b4ea0e6ae2d971799e6505d937f15276df8f34a509983f423622fed31cf0
SHA512d1cccc99f3df6cc0676f2a6e86ad9dc1284d6312148f2a389622d50a4469e159122118c14b30462e3e5fac8d54400f08e14948658804905615abf584daf87a67
-
Filesize
121KB
MD5720b3fd99822963db0348436caf475c9
SHA1ee1e75ba75ea13c952933cca731a87e94759ed7f
SHA256c443760e1335c35dd1e28c79047d550c69f70ea81fba88d6d0446e323a46f5d6
SHA512c7b758df2c078fc32aef4b723a4294431d09bdd0125fe0f49f21bc7caf00197214b4a2740182c78eddd05a0e44eddcedc6942d5c33ed81b79bb19d6e901f554b
-
Filesize
88KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
48KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
24KB
-
Filesize
372KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
24KB
-
Filesize
248KB
-
Filesize
1024KB
-
Filesize
248KB
-
Filesize
36KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
24KB
-
Filesize
1.5MB
-
Filesize
784KB
-
Filesize
1.5MB
-
Filesize
784KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
784KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.7MB
-
Filesize
784KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
48KB
-
Filesize
24KB
-
Filesize
1.5MB
-
Filesize
784KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
408KB
-
Filesize
404KB
-
Filesize
44KB
-
Filesize
408KB
-
Filesize
5.6MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
52KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
48KB
-
Filesize
408KB
-
Filesize
4KB
-
Filesize
408KB
-
Filesize
372KB
-
Filesize
4KB