Analysis
-
max time kernel
21s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
15-01-2024 05:35
General
-
Target
toolspub2(1).exe
-
Size
204KB
-
MD5
42fd43493fe458c14357e791d574da30
-
SHA1
cc8add3c129d5a6ea818ff818e6dcf83dbb61691
-
SHA256
0a995df69165131d1a7a2c734f8f1b221338b2f9754ee1863cb8fd7fbdd296f7
-
SHA512
49aed3b2bb525f285928d0aecde5d4189356c1374a5ab525e63442da6fe321c278b06216a0a739357bba6028f087d77070cb4d06765ac34c9def6fc2d7a8c706
-
SSDEEP
3072:ZkIknM3Jq/AmlEkJiAj1K/2sIMOfbAichhFye+Uv3+RLzT+cmk:ZkIyXlEdOfEich3yIAzCcL
Malware Config
Extracted
smokeloader
up3
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Program crash 2 IoCs
-
NSIS installer 8 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\toolspub2(1).exe"C:\Users\Admin\AppData\Local\Temp\toolspub2(1).exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 3682⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3016 -ip 30161⤵
-
C:\Users\Admin\AppData\Local\Temp\A22B.exeC:\Users\Admin\AppData\Local\Temp\A22B.exe1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 11323⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe"C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\A605.exeC:\Users\Admin\AppData\Local\Temp\A605.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2340 -ip 23401⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
98KB
MD52c63c9da3570b45cca019dabc4c97c6a
SHA170ab7eea5f2ae9b063a20596af8ce555bf34fc69
SHA256db0413c9ae3fb3fd227996232f5e80f9df2c33467d83a5e55f953de302d56147
SHA512ab0e0fc2ef15668643500a766413096ad0bb9e8b9dfac2f9ec85f969a5f0035d3f0d9e5694d88dbfeb7d89aff46c2e21ccb15e3421264b5eb7769b51c86e6bc7
-
Filesize
159KB
MD59ed667e7739ea5137207a3f153373e01
SHA1d1ae12e418f71e87749d74d792e7e8b8c6c8a7de
SHA256d51beb7c8402833ed3e0059ab72c427ace599ae0c201ae5e220c137e50586c08
SHA5122ab80d24aa5c825707b990d14603d45a9c215d5d6695fddc3cf8261402707a332fb5c7ebe484da7c3bb710758d3426eb13125ae40a38b9b64bb4c85fa83fdef6
-
Filesize
141KB
MD5d3748d96ae52db562b189861e131a9a1
SHA1ff4434603162a3b90ff21b1cc5482462aa1cafd6
SHA256a925a10619c017d494a1d7d0181732a7e620e96a66a87810b31efdba77a66038
SHA512b647f2faa7daf758ab4f0242c16de1cfb70489c199baccb83db7a69761a95f2175907aaafcee07e34f220faf5811f95a0541eb3e373a9f63c71ef3d26f1a2837
-
Filesize
165KB
MD53c8b9ca780a13a55e185be2ff55275b7
SHA14b1a3a0b5dc4ac9eafaedb3d60386e52f65eef2a
SHA2564d23bc487472a6f1a59aab587f559575359d2c465f347ac8b60e2081189bab05
SHA512f40fddf7e0fc974017ab4657731f98f232519bce770b1671491804cb344b0e2070df4c486d999211b2b6cbefd024d42f7ffc8bb8d7e7594ff96b266474d483a8
-
Filesize
106KB
MD57a8202a5a056c985c874b2c4fa6274be
SHA1042fc00b50cf7dcffa70ae4958f823ffb751e4f7
SHA256ba8eb15836770688fcd8a642ef98eb243f0e8cc4f13973b23d7ee552a8e77bc4
SHA5124961e43e7d4687ad449c686c7a060e76fd75f681e4389400cf05a273656286d9790ad0b84bc3f21af794f1a522870aa1f1f8952502de5cce3ebe4baaf61e0bf3
-
Filesize
80KB
MD558dca512f2333bea158af0378ddcd526
SHA1c2276394a409c80ad221a128cfae0f95a9c1ac1d
SHA2568759c0f5dd30a44b83e350d0ba9b85ed36b9f9c8c70d07001a1a2ab26acd1748
SHA5126e37001ca753e9b8a8761d1a7de8c0218bc372a4dce91d30eb161e1c0b552031958f1e7666f61c2aa757f2e998c2c2d7c00daaf03a7e3ac9554d9039490f7304
-
Filesize
104KB
MD5497e5f2f559d20ea43c388d1b7a12990
SHA113cd4990dab2517b181086c7a7f1a9edc0e7008d
SHA25634974eae8d909c6806cd637edb7ca755e0d78951aefc721eb099027d6b2d9ad1
SHA5128652bce727b0c117b72da70d1c6bef4ad88a732eb88a86adea16d4295044e7e64828f66edf993fd1dbc059be9130a870435a256b017453b5c32dcd5abb81c775
-
Filesize
189KB
MD572906e3a97617171d6daf5410c266979
SHA1be84e8088089ed4f7de494f35c3be26875b69747
SHA25694095c889d9781a7824d60c5a1d0022262fb97645369e9210f6777eea1be4e68
SHA512bdb9e8bdba623a84b21bded96b699d1c3c105fd4758e2fb08169b8fd148ea41bddf4bd0c5d327dd677fe0911a53c19d688e2ac800708ef3436c1760a75643011
-
Filesize
12KB
MD5dd87a973e01c5d9f8e0fcc81a0af7c7a
SHA1c9206ced48d1e5bc648b1d0f54cccc18bf643a14
SHA2567fb0f8d452fefaac789986b933df050f3d3e4feb8a8d9944ada995f572dcdca1
SHA5124910b39b1a99622ac8b3c42f173bbe7035ac2f8d40c946468e7db7e2868a2da81ea94da453857f06f39957dd690c7f1ba498936a7aaa0039975e472376f92e8f
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
4.2MB
-
Filesize
8KB
-
Filesize
1024KB
-
Filesize
36KB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
372KB
-
Filesize
4KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
52KB
-
Filesize
408KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
48KB
-
Filesize
88KB
-
Filesize
7.1MB
-
Filesize
7.1MB