Overview

overview

10

Static

static

3

722f80be3e...6b.exe

windows7-x64

10

722f80be3e...6b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-01-2024 12:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    722f80be3e3718bacd7d7904119cc26b.exe

  • Size

    175KB

  • MD5

    722f80be3e3718bacd7d7904119cc26b

  • SHA1

    8202f1ca6689f7ab989e53c109e1787cb006d1a6

  • SHA256

    5f04dc40d7308827696d57f1ced42d25039e17dc715b7714912bbe6d17fa8cdf

  • SHA512

    8bf3587c7515a7799195124a20a99b7b9094906ef74923c0cec4f788ef84e40effa20a6f08b2f95e826ddd6b0db9088fb87359775c1b6347b5718bd33d12246e

  • SSDEEP

    3072:3XXsPJjFQ1GFSkplZo99m+51683Tm7uxnPG2vHOV:3HsNK1GMelZo991DaubfO

Score
10/10
betabotgozismokeloaderbackdoorbankerbotnetevasionisfbpersistencetrojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://varmisende.com/upload/

http://fernandomayol.com/upload/

http://nextlytm.com/upload/

http://people4jan.com/upload/

http://asfaltwerk.com/upload/
rc4.i32
rc4.i32

Extracted

Family

gozi

Signatures

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

    trojanbackdoorbotnetbetabot
  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi
  • Modifies firewall policy service 2 TTPs 4 IoCs
    evasion
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Sets file execution options in registry 2 TTPs 4 IoCs
    persistence
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • NSIS installer 4 IoCs
    installer
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 30 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\722f80be3e3718bacd7d7904119cc26b.exe
    "C:\Users\Admin\AppData\Local\Temp\722f80be3e3718bacd7d7904119cc26b.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:1472
  • C:\Users\Admin\AppData\Local\Temp\C7C4.exe
    C:\Users\Admin\AppData\Local\Temp\C7C4.exe
    1⤵
    • Sets file execution options in registry
    • Executes dropped EXE
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Checks processor information in registry
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2500
    • C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      2⤵
      • Modifies firewall policy service
      • Sets file execution options in registry
      • Checks BIOS information in registry
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Checks processor information in registry
      • Enumerates system info in registry
      • Modifies Internet Explorer Protected Mode
      • Modifies Internet Explorer Protected Mode Banner
      • Modifies Internet Explorer settings
      • Suspicious use of AdjustPrivilegeToken
      PID:4852
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 1072
        3⤵
        • Program crash
        PID:4768
  • C:\Users\Admin\AppData\Local\Temp\D041.exe
    C:\Users\Admin\AppData\Local\Temp\D041.exe
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:1836
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1444
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4852 -ip 4852
    1⤵
      PID:4520

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Persistence

    Create or Modify System Process

    1
    T1543

    Windows Service

    1
    T1543.003

    Boot or Logon Autostart Execution

    2
    T1547

    Registry Run Keys / Startup Folder

    2
    T1547.001

    Privilege Escalation

    Create or Modify System Process

    1
    T1543

    Windows Service

    1
    T1543.003

    Boot or Logon Autostart Execution

    2
    T1547

    Registry Run Keys / Startup Folder

    2
    T1547.001

    Defense Evasion

    Modify Registry

    6
    T1112

    Credential Access

    Discovery

    Query Registry

    6
    T1012

    System Information Discovery

    7
    T1082

    Peripheral Device Discovery

    1
    T1120

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\C7C4.exe
      Filesize

      360KB

      MD5

      0c819dd27a128d9234daa3d772fb8c20

      SHA1

      d5d36492818872da8e70dc28cc85389b8e0f3819

      SHA256

      ae088798b181a2bf822fcd3bec3a11779f45a8e3b83cb6c75c5ffbffc3c3d5b2

      SHA512

      f502ddb79703297cf0592e68c3f1f964584725d7aa670272998f174ffa108bb7340c0d65d38d69e1b3f7f1217628dadda108fa2d5fe1eab73b7b3302b9f769b7

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\D041.exe
      Filesize

      397KB

      MD5

      7c66f19891b14bfe69d2e2e4bcaf6881

      SHA1

      1dbacc5ec8dc8059b23b9dd954e37bc20b86900f

      SHA256

      878983e8e4eaef1b7ab9bcdfac90cb2fb1df472dc7df0e71cfde188a9eb5e591

      SHA512

      3b7c20d4f5dc6c7b639d522442f0d4133199afc1e4fa7db4fc15107f6d9eca1b71538810f4a51046dd85ebdf861c59696a14147624b216f4e9320ae05bc7b850

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\D041.exe
      Filesize

      389KB

      MD5

      13664f304c31322a460ef5943eaf4d63

      SHA1

      be25d7ba7a9814b0ee5a615bdad5116ebb2253aa

      SHA256

      5a14defd321f836c77b4d0cc37b6f1eb85f23a62c516ba8361db3fdcbf0bb1bf

      SHA512

      3b929a3a407657e065dac2b3776695a60b40a564961e26af9684b07bd64df9c6815e0dfb57a5b3d2cfa52c0b5fb204db195adca798435f3f36aab346cb5324bf

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe
      Filesize

      2.2MB

      MD5

      0badb0e573d95db49ac23c11163d9386

      SHA1

      d86dd20e4498ba5576272df07cd71dd9ed40bf8d

      SHA256

      5ebb608342d1306743d1ab56bb587b00d7e14737f5af48be3fa738a98cf29668

      SHA512

      a83d397fdcf2b749aac8f1db38a991b06a70c58d21c84d09cd8a732ee744287e7d7d58edeb817006b6ee245ed313993a3280aea32fd4c5a079b4f960ab35eff8

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\lib.dll
      Filesize

      2.2MB

      MD5

      bc94fe5f3a7d234dceefa5a25c109358

      SHA1

      eefd19123cb554bd975d9848eff08f195c7794bb

      SHA256

      fdbd693e2a9eab791967e78eef8e1a3423c63b570d6fc8ccd9367be931c779c4

      SHA512

      650632899edc1bce009244cf228500c26df33c2036f774f60529c10bf7b277a49d3e635846097cf2d821a54e066a07f5f6ef2be055e1054e8c4a1a938fad9c69

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\nsqD39D.tmp\System.dll
      Filesize

      12KB

      MD5

      dd87a973e01c5d9f8e0fcc81a0af7c7a

      SHA1

      c9206ced48d1e5bc648b1d0f54cccc18bf643a14

      SHA256

      7fb0f8d452fefaac789986b933df050f3d3e4feb8a8d9944ada995f572dcdca1

      SHA512

      4910b39b1a99622ac8b3c42f173bbe7035ac2f8d40c946468e7db7e2868a2da81ea94da453857f06f39957dd690c7f1ba498936a7aaa0039975e472376f92e8f

      Download Submit
    • memory/1444-58-0x0000000073930000-0x0000000074047000-memory.dmp
      Filesize

      7.1MB

      Download
    • memory/1444-64-0x0000000073930000-0x0000000074047000-memory.dmp
      Filesize

      7.1MB

      Download
    • memory/1472-5-0x0000000000400000-0x0000000002149000-memory.dmp
      Filesize

      29.3MB

      Download
    • memory/1472-1-0x00000000022B0000-0x00000000023B0000-memory.dmp
      Filesize

      1024KB

      Download
    • memory/1472-3-0x0000000000400000-0x0000000002149000-memory.dmp
      Filesize

      29.3MB

      Download
    • memory/1472-2-0x00000000001C0000-0x00000000001C9000-memory.dmp
      Filesize

      36KB

      Download
    • memory/1836-46-0x00007FF6B19B0000-0x00007FF6B2075000-memory.dmp
      Filesize

      6.8MB

      Download
    • memory/1836-39-0x00007FF6B19B0000-0x00007FF6B2075000-memory.dmp
      Filesize

      6.8MB

      Download
    • memory/2500-17-0x00000000004E0000-0x00000000004ED000-memory.dmp
      Filesize

      52KB

      Download
    • memory/2500-22-0x0000000002830000-0x000000000283C000-memory.dmp
      Filesize

      48KB

      Download
    • memory/2500-14-0x0000000000010000-0x000000000006D000-memory.dmp
      Filesize

      372KB

      Download
    • memory/2500-16-0x00000000022A0000-0x0000000002306000-memory.dmp
      Filesize

      408KB

      Download
    • memory/2500-18-0x00000000022A0000-0x0000000002306000-memory.dmp
      Filesize

      408KB

      Download
    • memory/2500-32-0x0000000002820000-0x0000000002821000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2500-33-0x00000000022A0000-0x0000000002306000-memory.dmp
      Filesize

      408KB

      Download
    • memory/2500-19-0x0000000077AB4000-0x0000000077AB5000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2500-23-0x00000000022A0000-0x0000000002306000-memory.dmp
      Filesize

      408KB

      Download
    • memory/2500-21-0x0000000002800000-0x0000000002801000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3528-4-0x0000000002A10000-0x0000000002A25000-memory.dmp
      Filesize

      84KB

      Download
    • memory/4852-26-0x0000000000FF0000-0x0000000001424000-memory.dmp
      Filesize

      4.2MB

      Download
    • memory/4852-24-0x0000000000FF0000-0x0000000001424000-memory.dmp
      Filesize

      4.2MB

      Download
    • memory/4852-30-0x0000000000F00000-0x0000000000FC4000-memory.dmp
      Filesize

      784KB

      Download
    • memory/4852-28-0x0000000000F00000-0x0000000000FC4000-memory.dmp
      Filesize

      784KB

      Download
    • memory/4852-27-0x0000000000F00000-0x0000000000FC4000-memory.dmp
      Filesize

      784KB

      Download
    • memory/4852-59-0x0000000000F00000-0x0000000000FC4000-memory.dmp
      Filesize

      784KB

      Download
    • memory/4852-60-0x0000000004C50000-0x0000000004C52000-memory.dmp
      Filesize

      8KB

      Download
    • memory/4852-62-0x0000000000FF0000-0x0000000001423000-memory.dmp
      Filesize

      4.2MB

      Download
    • memory/4852-63-0x0000000000F00000-0x0000000000FC4000-memory.dmp
      Filesize

      784KB

      Download