Analysis

  • max time kernel
    30s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    25-02-2024 05:07

General

  • Target

    98c3d93eeb1c3139c530df4aa6270bb3df7c24148e71f195c929486136872eee.exe

  • Size

    253KB

  • MD5

    c725af162ad3190c0b65770fb08fbe23

  • SHA1

    521eae0390bef9140f9a6e896066515ca7a98c5d

  • SHA256

    98c3d93eeb1c3139c530df4aa6270bb3df7c24148e71f195c929486136872eee

  • SHA512

    6fe7edc75ee4d52ace5450a211362808a4c24a41ae67d1e74dabd3adc687349dba35743acc4cd96e37c1d2701f03c6511a1127773f0aeb480f7025556bb3e59e

  • SSDEEP

    3072:yLsGBVVoWaf88khIqzHdWu7zCJDBfukHimJ3a1XMu5Q2e45KaHTz:UdebOLo6+JDNukHbJ3+k2YqT

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://selebration17io.io/index.php

http://vacantion18ffeu.cc/index.php

http://valarioulinity1.net/index.php

http://buriatiarutuhuob.net/index.php

http://cassiosssionunu.me/index.php

http://sulugilioiu19.net/index.php

http://goodfooggooftool.net/index.php

rc4.i32
rc4.i32

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 2 IoCs
  • UPX dump on OEP (original entry point) 35 IoCs
  • Downloads MZ/PE file
  • Deletes itself 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 4 IoCs
  • UPX packed file 35 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\98c3d93eeb1c3139c530df4aa6270bb3df7c24148e71f195c929486136872eee.exe
    "C:\Users\Admin\AppData\Local\Temp\98c3d93eeb1c3139c530df4aa6270bb3df7c24148e71f195c929486136872eee.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:1228
  • C:\Users\Admin\AppData\Local\Temp\692F.exe
    C:\Users\Admin\AppData\Local\Temp\692F.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2560
    • C:\Users\Admin\AppData\Local\Temp\692F.exe
      C:\Users\Admin\AppData\Local\Temp\692F.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:2724
  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6F76.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2472
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\6F76.dll
      2⤵
      • Loads dropped DLL
      PID:2352
  • C:\Users\Admin\AppData\Local\Temp\81B0.exe
    C:\Users\Admin\AppData\Local\Temp\81B0.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:2448
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 124
      2⤵
      • Loads dropped DLL
      • Program crash
      PID:2120
  • C:\Users\Admin\AppData\Local\Temp\898D.exe
    C:\Users\Admin\AppData\Local\Temp\898D.exe
    1⤵
      PID:2700

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp

      Filesize

      1.9MB

      MD5

      ed51aa2e212f72811969b0db8682131f

      SHA1

      9d23b08bc651d9f70e28174c0544b8aa92cadd4c

      SHA256

      68b03db481dde019b05d6c107fb796a29ae112b6872969ffba777617b4fbc396

      SHA512

      5ba07ad7db42971467f18d384679cae8056a92fc81991bb427cab45087f29b7d552216d672f3c6bb3a0d551cf9681783c43e0acb9a386f175ab379944c9b334a

    • C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new

      Filesize

      1.2MB

      MD5

      984e2050d12aaea6ea0512e832caf09c

      SHA1

      b17f8ab9cc533dbba34bbc16fd6ff9de9105b172

      SHA256

      bd81b032b9c18e6886bc94f90da98ea6e35683cc8186824d8ea7f0f080478530

      SHA512

      6d2d8a0751cf6180ffd6dd6371fbf3b8093d39dbd8e46a043afc928c4bb53b51ac8e9f082d461626410aeadf36e929b7eef35172b3eb9616dcb7d8054dbaf531

    • C:\Users\Admin\AppData\Local\Temp\692F.exe

      Filesize

      1.4MB

      MD5

      6f6acad159c227395d99e3e777afe1bf

      SHA1

      c50b629119f2a842f5926d1be2886a502bdae0f9

      SHA256

      9c69bc44be42ab3766f48caf1de6b7ef8ee6849453e08af589b5879d8421ff08

      SHA512

      bdc7dfa1c78f11d66ce49ababb5f61e78514a8b7cfd4a0e0859d628d3ac92f8887a4b73eb80e99a9b75eb4e06b64455dcae05f47f0afc58a17a050af45b5dc67

    • C:\Users\Admin\AppData\Local\Temp\692F.exe

      Filesize

      1.5MB

      MD5

      359cb18b9b67dc44321d9c484c2710c9

      SHA1

      3ffb07be9134cd76695325399efdc50630b507c9

      SHA256

      5b3a3bb023581294b0122b707cb88639859a1e6d3a20abded74d5e9881341adc

      SHA512

      682d6e616251db541bec2cc6f4c4c8fa69969e0eb8fb30d0456f39b2ddc8a174e21336a2bcd9f331c5f8c428a7768739f2ab8426dff0befc079bec8f0d4cbe29

    • C:\Users\Admin\AppData\Local\Temp\692F.exe

      Filesize

      65KB

      MD5

      1cc2b5d0c9ea714d9778caaf467f02ff

      SHA1

      9d2533c822fae993be0b9960dfdd29f61f245689

      SHA256

      1ecf64c2cb78ef255613e1c8a39542ce156e3af4f98bfc76c0cf29f1ac1abf37

      SHA512

      f8e070e8ee73eb0a0d5534cd8fb9e822d64d5fa64fad35f24e5e573ca5be3930f2e426d9f28251c370de5b03c575d982a1f9b1a40009422fcae1eff1fb77b70b

    • C:\Users\Admin\AppData\Local\Temp\692F.exe

      Filesize

      1.8MB

      MD5

      147f5f5bbc80b2ad753993e15f3f32c2

      SHA1

      16d73b4abeef12cf76414338901eb7bbef46775f

      SHA256

      40dc1ae099f2278650c0aa599ba00f659a87996208133d6a64b0cc5cbb5fe990

      SHA512

      9c43aaa68161ef04c60e3f64c3fd54426dfd387f0013f009f3da94d45f19e514cd41de7b95865c47f55e5800222fd74736659138bb96406aa37f9cdc8e5799b6

    • C:\Users\Admin\AppData\Local\Temp\6F76.dll

      Filesize

      1.9MB

      MD5

      a6e4c2197232278046c741c6128c72a2

      SHA1

      600e1a6bb0bbf69e3b4533a5f8d8de9a53abc615

      SHA256

      c0d213f77d33b057da5fbfaa1847ecfd63a6284ff5a54a44157ae2379abf76e1

      SHA512

      4e874dddaad2ea9c7c5b12d25c205464d35e60e7a5ddcc8eacef63db852312053c1ec048fbe43e19d87f5de7c7b0cfe9e436638904fe840e265ea3b3cdaa3010

    • C:\Users\Admin\AppData\Local\Temp\81B0.exe

      Filesize

      3.4MB

      MD5

      8bf81aa03a788ed190e0e607425d0329

      SHA1

      be7ebc1dce27f2579ed86715dfa1783937d5b671

      SHA256

      655f549e5bf785a06fcd9d20531f00fa3253f1049b4cd2a119ae67974d2cac37

      SHA512

      e1af6ad59a121db2a3b5a2632cb402fa6a1e47f8e6bdb479e70f5085c4ac181fc724146a5fe09796f82f584e25183f793b19a0cb6fdfedb213ca3d7d67b9af54

    • C:\Users\Admin\AppData\Local\Temp\81B0.exe

      Filesize

      3.1MB

      MD5

      6cc5e43d43a4f816dab267f271d508e7

      SHA1

      1d4c9c1a4a371158afd6e0a3dbc61c8977a8184f

      SHA256

      89c6ae2f975f341e966d07b25b9a68db044c9f3da30bdc2040522ff4babd499b

      SHA512

      45f370fcb6a3b1c05f1afda3497065e70a8fc32a657ab189607bd0779190ed383f2dc81ce814ed1eed9d49ffebe7d31947b8a3028e6ba3f109eab8103bedb6b6

    • C:\Users\Admin\AppData\Local\Temp\898D.exe

      Filesize

      560KB

      MD5

      e6dd149f484e5dd78f545b026f4a1691

      SHA1

      3ea5d0fb2de5bfad3dc6dc1744708ccd31102df6

      SHA256

      11243641663323721ba21494a394de70ae70d4ea23c23f2e2a397fcc3cfea1a7

      SHA512

      0defb358d59221c56731745a25250dfea49ecbb411f11f31a92ec20fa2123646f4aaf9fd4999898c39e4674f616bc1bed7ef2368b61a29d595dc7b9340dd058b

    • \Users\Admin\AppData\Local\Temp\692F.exe

      Filesize

      64KB

      MD5

      3a94f99f05c2343e9c0351c607eae248

      SHA1

      658b44f0b2ad93669154b9d4cd7c250a996f6bb0

      SHA256

      933e7f4447169bb8960d8d8af29420c18871dce491510d24a02ff86e4eb43dd1

      SHA512

      8b7c6b90f06df586fed0cb6ab2eaad128357c0bbbdfab61957cefa1a18041ade62d5a6d07d4dec51e4be5ec26a593546e11740555d14e869835ee04fda78b1d0

    • \Users\Admin\AppData\Local\Temp\6F76.dll

      Filesize

      1.6MB

      MD5

      e1837116bb692143a9d0f627f9ef5f32

      SHA1

      5d9773739c2e8fdf8003a88fc8870068ad3d9d6a

      SHA256

      34f77d0a1abec4911f4a32a5b390181ca0b840edeea4eaf43a15a73324527ca7

      SHA512

      c16213503795772cca05fa621476e40d8a4592f458337022b4bdf34cb7f8adde627ac763663010fcb83344effc192200e63c415a191372ca53898afd7e0b21fe

    • \Users\Admin\AppData\Local\Temp\81B0.exe

      Filesize

      2.2MB

      MD5

      44734c50fd10beb552a9fdf11c952801

      SHA1

      56b57818d8dcec39be34de5423f1d69855bfc588

      SHA256

      dc989a510bed23c78295680ebc68aec334ac95a760591de31dfd2d0edd37be6d

      SHA512

      e213acf8bffc2eed6f2d1c2b8fb310f3df5d05137957e00cb9bdec453242a4e90e0ff8b3560be587b592a4662cc98b7b8f8f6f885f5575c13652121a298a4e39

    • \Users\Admin\AppData\Local\Temp\81B0.exe

      Filesize

      2.3MB

      MD5

      7380983b85caff05cb70683d9aed46f4

      SHA1

      53fef1ba72de6e7f139f17b12a41cec7c81635ed

      SHA256

      9abacdd49ab8f8b12ee9165c73307947532ed155565fd436026c9c14fd3ea3cd

      SHA512

      b6a2de423203aee43640a1383a9eca0b0541c30850ea1365e562954b7db72cb6ab6d7df3df17a4191fef70d988dcf7e9314030c72700037193a071f205d26db5

    • \Users\Admin\AppData\Local\Temp\81B0.exe

      Filesize

      1.9MB

      MD5

      1345d94a03d17599a3fc39776ece28b0

      SHA1

      5d878eecbe2017deb757c9e22b1726aa53ec61c7

      SHA256

      caeea162992f298eeb25830241b72eeaf704418142102d194686f8a188c55e50

      SHA512

      66147e8942816525269b4a7bbddc37fd00ebce289cfa500e5f64d4396da27245fae549f647be2220d7cbd72665721f08bb9cbb18d0d9e72a2f41249f033b1ecc

    • memory/1204-4-0x0000000002D20000-0x0000000002D36000-memory.dmp

      Filesize

      88KB

    • memory/1228-3-0x0000000000400000-0x0000000002D3E000-memory.dmp

      Filesize

      41.2MB

    • memory/1228-2-0x00000000001B0000-0x00000000001BB000-memory.dmp

      Filesize

      44KB

    • memory/1228-1-0x00000000002F0000-0x00000000003F0000-memory.dmp

      Filesize

      1024KB

    • memory/1228-5-0x0000000000400000-0x0000000002D3E000-memory.dmp

      Filesize

      41.2MB

    • memory/2352-56-0x00000000025A0000-0x00000000026DC000-memory.dmp

      Filesize

      1.2MB

    • memory/2352-40-0x0000000010000000-0x000000001020C000-memory.dmp

      Filesize

      2.0MB

    • memory/2352-39-0x00000000001C0000-0x00000000001C6000-memory.dmp

      Filesize

      24KB

    • memory/2352-71-0x00000000026E0000-0x00000000027FB000-memory.dmp

      Filesize

      1.1MB

    • memory/2352-68-0x00000000026E0000-0x00000000027FB000-memory.dmp

      Filesize

      1.1MB

    • memory/2352-96-0x0000000010000000-0x000000001020C000-memory.dmp

      Filesize

      2.0MB

    • memory/2448-59-0x0000000000100000-0x0000000000101000-memory.dmp

      Filesize

      4KB

    • memory/2448-47-0x00000000000F0000-0x00000000000F1000-memory.dmp

      Filesize

      4KB

    • memory/2448-48-0x0000000000930000-0x00000000011DF000-memory.dmp

      Filesize

      8.7MB

    • memory/2448-50-0x00000000000F0000-0x00000000000F1000-memory.dmp

      Filesize

      4KB

    • memory/2448-52-0x00000000000F0000-0x00000000000F1000-memory.dmp

      Filesize

      4KB

    • memory/2448-54-0x0000000077700000-0x0000000077701000-memory.dmp

      Filesize

      4KB

    • memory/2560-18-0x0000000004810000-0x00000000049C8000-memory.dmp

      Filesize

      1.7MB

    • memory/2560-22-0x0000000004A00000-0x0000000004BB7000-memory.dmp

      Filesize

      1.7MB

    • memory/2560-17-0x0000000004810000-0x00000000049C8000-memory.dmp

      Filesize

      1.7MB

    • memory/2700-81-0x0000000002D90000-0x0000000002DFB000-memory.dmp

      Filesize

      428KB

    • memory/2700-80-0x0000000002E40000-0x0000000002F40000-memory.dmp

      Filesize

      1024KB

    • memory/2700-97-0x0000000000400000-0x0000000002D8C000-memory.dmp

      Filesize

      41.5MB

    • memory/2700-82-0x0000000000400000-0x0000000002D8C000-memory.dmp

      Filesize

      41.5MB

    • memory/2700-83-0x0000000000400000-0x0000000002D8C000-memory.dmp

      Filesize

      41.5MB

    • memory/2724-30-0x0000000000400000-0x0000000000848000-memory.dmp

      Filesize

      4.3MB

    • memory/2724-31-0x0000000000400000-0x0000000000848000-memory.dmp

      Filesize

      4.3MB

    • memory/2724-29-0x0000000000400000-0x0000000000848000-memory.dmp

      Filesize

      4.3MB

    • memory/2724-28-0x0000000000400000-0x0000000000848000-memory.dmp

      Filesize

      4.3MB

    • memory/2724-27-0x0000000000400000-0x0000000000848000-memory.dmp

      Filesize

      4.3MB

    • memory/2724-95-0x0000000000400000-0x0000000000848000-memory.dmp

      Filesize

      4.3MB

    • memory/2724-24-0x0000000000400000-0x0000000000848000-memory.dmp

      Filesize

      4.3MB

    • memory/2724-21-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2724-103-0x0000000000400000-0x0000000000848000-memory.dmp

      Filesize

      4.3MB

    • memory/2724-105-0x0000000000400000-0x0000000000848000-memory.dmp

      Filesize

      4.3MB

    • memory/2724-109-0x0000000000400000-0x0000000000848000-memory.dmp

      Filesize

      4.3MB

    • memory/2724-112-0x0000000000400000-0x0000000000848000-memory.dmp

      Filesize

      4.3MB

    • memory/2724-113-0x0000000000400000-0x0000000000848000-memory.dmp

      Filesize

      4.3MB

    • memory/2724-114-0x0000000000400000-0x0000000000848000-memory.dmp

      Filesize

      4.3MB

    • memory/2724-115-0x0000000000400000-0x0000000000848000-memory.dmp

      Filesize

      4.3MB

    • memory/2724-117-0x0000000000400000-0x0000000000848000-memory.dmp

      Filesize

      4.3MB

    • memory/2724-119-0x0000000000400000-0x0000000000848000-memory.dmp

      Filesize

      4.3MB

    • memory/2724-124-0x0000000000400000-0x0000000000848000-memory.dmp

      Filesize

      4.3MB

    • memory/2724-127-0x0000000000400000-0x0000000000848000-memory.dmp

      Filesize

      4.3MB

    • memory/2724-130-0x0000000000400000-0x0000000000848000-memory.dmp

      Filesize

      4.3MB

    • memory/2724-131-0x0000000000400000-0x0000000000848000-memory.dmp

      Filesize

      4.3MB

    • memory/2724-128-0x0000000000400000-0x0000000000848000-memory.dmp

      Filesize

      4.3MB

    • memory/2724-126-0x0000000000400000-0x0000000000848000-memory.dmp

      Filesize

      4.3MB

    • memory/2724-134-0x0000000000400000-0x0000000000848000-memory.dmp

      Filesize

      4.3MB

    • memory/2724-136-0x0000000000400000-0x0000000000848000-memory.dmp

      Filesize

      4.3MB

    • memory/2724-139-0x0000000000400000-0x0000000000848000-memory.dmp

      Filesize

      4.3MB

    • memory/2724-140-0x0000000000400000-0x0000000000848000-memory.dmp

      Filesize

      4.3MB

    • memory/2724-138-0x0000000000400000-0x0000000000848000-memory.dmp

      Filesize

      4.3MB

    • memory/2724-137-0x0000000000400000-0x0000000000848000-memory.dmp

      Filesize

      4.3MB

    • memory/2724-135-0x0000000000400000-0x0000000000848000-memory.dmp

      Filesize

      4.3MB

    • memory/2724-125-0x0000000000400000-0x0000000000848000-memory.dmp

      Filesize

      4.3MB

    • memory/2724-122-0x0000000000400000-0x0000000000848000-memory.dmp

      Filesize

      4.3MB

    • memory/2724-121-0x0000000000400000-0x0000000000848000-memory.dmp

      Filesize

      4.3MB

    • memory/2724-120-0x0000000000400000-0x0000000000848000-memory.dmp

      Filesize

      4.3MB

    • memory/2724-118-0x0000000000400000-0x0000000000848000-memory.dmp

      Filesize

      4.3MB

    • memory/2724-116-0x0000000000400000-0x0000000000848000-memory.dmp

      Filesize

      4.3MB