Resubmissions
21-02-2024 21:44
240221-1lqdrafg5w 1021-02-2024 18:39
240221-xanh8sdd21 1015-02-2023 18:24
230215-w18fnada5x 1015-02-2023 17:35
230215-v6c19scg9t 1010-02-2023 13:30
230210-qr8geaah9x 1010-02-2023 13:25
230210-qn1x6abc29 1010-02-2023 13:11
230210-qe8awaag29 1029-01-2023 06:15
230129-gzxv7sbe38 1029-01-2023 06:02
230129-grzptsbb44 10Analysis
-
max time kernel
60s -
max time network
54s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
21-02-2024 18:39
Static task
static1
Behavioral task
behavioral1
Sample
79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exe
Resource
win10v2004-20240221-en
General
-
Target
79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exe
-
Size
298KB
-
MD5
11511ba5fd4de1fc5051d0bcefb388ae
-
SHA1
5e9476f39df92e01d0952e703869e71f85d470cd
-
SHA256
79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a
-
SHA512
904f0e3a252cd0ef8108492de955ac520008b10b66da736cc4bbdc6a8c3736440a9a11edb73707ba415d7f3f4c2c590dfa983aca01864b9d66a6c3559ed744e9
-
SSDEEP
3072:0pb2LIT54Ga9Qzgp4gaCJrSjgBoMZmYKxQCBnIyCSyxzID1C7hZW0KIsiuNZ:xLIKGa96dfkBoMsDlqSwzIDM/KPP
Malware Config
Extracted
smokeloader
2022
http://potunulit.org/
http://hutnilior.net/
http://bulimu55t.net/
http://soryytlic4.net/
http://novanosa5org.org/
http://nuljjjnuli.org/
http://tolilolihul.net/
http://somatoka51hub.net/
http://hujukui3.net/
http://bukubuka1.net/
http://golilopaster.org/
http://newzelannd66.org/
http://otriluyttn.org/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3436 -
Executes dropped EXE 1 IoCs
Processes:
grrvhswpid process 1764 grrvhsw -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exegrrvhswdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI grrvhsw Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI grrvhsw Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI grrvhsw -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exepid process 1688 79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exe 1688 79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exe 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exegrrvhswpid process 1688 79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exe 1764 grrvhsw -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exe"C:\Users\Admin\AppData\Local\Temp\79fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\grrvhswC:\Users\Admin\AppData\Roaming\grrvhsw1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\grrvhswFilesize
298KB
MD511511ba5fd4de1fc5051d0bcefb388ae
SHA15e9476f39df92e01d0952e703869e71f85d470cd
SHA25679fe08c83e8f2f3679c3dfdcff6698b92489fa915ccfb3c3458827861034814a
SHA512904f0e3a252cd0ef8108492de955ac520008b10b66da736cc4bbdc6a8c3736440a9a11edb73707ba415d7f3f4c2c590dfa983aca01864b9d66a6c3559ed744e9
-
memory/1688-2-0x00000000021A0000-0x00000000021A9000-memory.dmpFilesize
36KB
-
memory/1688-1-0x00000000004F0000-0x00000000005F0000-memory.dmpFilesize
1024KB
-
memory/1688-3-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/1688-5-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/1764-14-0x0000000000680000-0x0000000000780000-memory.dmpFilesize
1024KB
-
memory/1764-15-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/1764-17-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/3436-4-0x0000000002A40000-0x0000000002A56000-memory.dmpFilesize
88KB
-
memory/3436-16-0x0000000002420000-0x0000000002436000-memory.dmpFilesize
88KB