Analysis
-
max time kernel
300s -
max time network
298s -
platform
windows10-1703_x64 -
resource
win10-20240214-en -
resource tags
arch:x64arch:x86image:win10-20240214-enlocale:en-usos:windows10-1703-x64system -
submitted
21-02-2024 04:58
Static task
static1
Behavioral task
behavioral1
Sample
92b95597a7dde38ab3c182a7df8f27b8193370755b3f453a71b50fa670afcf8d.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
92b95597a7dde38ab3c182a7df8f27b8193370755b3f453a71b50fa670afcf8d.exe
Resource
win10-20240214-en
General
-
Target
92b95597a7dde38ab3c182a7df8f27b8193370755b3f453a71b50fa670afcf8d.exe
-
Size
140KB
-
MD5
fcb0fb8bba03aa7272d74cf4fa222889
-
SHA1
15ebe4683e9dca78d430a0b3e0ea2e824d947d70
-
SHA256
92b95597a7dde38ab3c182a7df8f27b8193370755b3f453a71b50fa670afcf8d
-
SHA512
0bebaa1ffad0fa62b99e3aea8e853d3fbe8c02af15661524db2bb2df0639343ae7d124e2464f098f0472cd1a65ee3bb0b54703b34703b17453c59550300fcfca
-
SSDEEP
3072:yvBSZHsPMUKdL6tf6eT2UNGNquenY7+P:yvGMPMhF6t2nOn
Malware Config
Extracted
smokeloader
pub3
Extracted
smokeloader
2022
http://sjyey.com/tmp/index.php
http://babonwo.ru/tmp/index.php
http://mth.com.ua/tmp/index.php
http://piratia.pw/tmp/index.php
http://go-piratia.ru/tmp/index.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3496 -
Executes dropped EXE 1 IoCs
Processes:
rggiwcfpid process 4884 rggiwcf -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
rggiwcf92b95597a7dde38ab3c182a7df8f27b8193370755b3f453a71b50fa670afcf8d.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI rggiwcf Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI rggiwcf Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 92b95597a7dde38ab3c182a7df8f27b8193370755b3f453a71b50fa670afcf8d.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 92b95597a7dde38ab3c182a7df8f27b8193370755b3f453a71b50fa670afcf8d.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 92b95597a7dde38ab3c182a7df8f27b8193370755b3f453a71b50fa670afcf8d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI rggiwcf -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
92b95597a7dde38ab3c182a7df8f27b8193370755b3f453a71b50fa670afcf8d.exepid process 2360 92b95597a7dde38ab3c182a7df8f27b8193370755b3f453a71b50fa670afcf8d.exe 2360 92b95597a7dde38ab3c182a7df8f27b8193370755b3f453a71b50fa670afcf8d.exe 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 3496 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
92b95597a7dde38ab3c182a7df8f27b8193370755b3f453a71b50fa670afcf8d.exerggiwcfpid process 2360 92b95597a7dde38ab3c182a7df8f27b8193370755b3f453a71b50fa670afcf8d.exe 4884 rggiwcf -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 3496 Token: SeCreatePagefilePrivilege 3496 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\92b95597a7dde38ab3c182a7df8f27b8193370755b3f453a71b50fa670afcf8d.exe"C:\Users\Admin\AppData\Local\Temp\92b95597a7dde38ab3c182a7df8f27b8193370755b3f453a71b50fa670afcf8d.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2360
-
C:\Users\Admin\AppData\Roaming\rggiwcfC:\Users\Admin\AppData\Roaming\rggiwcf1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4884
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
140KB
MD5fcb0fb8bba03aa7272d74cf4fa222889
SHA115ebe4683e9dca78d430a0b3e0ea2e824d947d70
SHA25692b95597a7dde38ab3c182a7df8f27b8193370755b3f453a71b50fa670afcf8d
SHA5120bebaa1ffad0fa62b99e3aea8e853d3fbe8c02af15661524db2bb2df0639343ae7d124e2464f098f0472cd1a65ee3bb0b54703b34703b17453c59550300fcfca