Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240221-en - resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system - submitted
26/02/2024, 12:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c35a2a595857ec222d3e9fae7e2e189f1803a4e9feaf7202e5a2996abd6ab069.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
c35a2a595857ec222d3e9fae7e2e189f1803a4e9feaf7202e5a2996abd6ab069.exe
Resource
win10v2004-20240221-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target c35a2a595857ec222d3e9fae7e2e189f1803a4e9feaf7202e5a2996abd6ab069.exe
- Size 164KB
- Sample240226-phnj7sdd39
- SHA256 c35a2a595857ec222d3e9fae7e2e189f1803a4e9feaf7202e5a2996abd6ab069
- MD5 0c218f3d1d5568e5e0f81c04cf7f2da8
- SHA1 451f2e83454a533e7340dd5c4bae2120896c2fc2
- SHA512 70b63c6a8894280b7b3ff83c5982aa9f2fd7d859440d4ec0fbd32ab129437111496ee76d9e7f5f5cfa134a8b16226656ca9fafe7f2c3054717ad69702ea210ce
- SSDEEP 3072:tN3vfdGdDEa0Mk6hxpd0lEOQheRChEqL/2Um5XocSI:txlGdQaTtd+QaQG4XI
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Botnet
-
pub3
Extracted
Family
-
smokeloader
Version
-
2022
C2
-
http://kamsmad.com/tmp/index.php
-
http://souzhensil.ru/tmp/index.php
-
http://teplokub.com.ua/tmp/index.php
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Deletes itself 1 IoCs
pid Process 3500 Process not Found - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c35a2a595857ec222d3e9fae7e2e189f1803a4e9feaf7202e5a2996abd6ab069.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c35a2a595857ec222d3e9fae7e2e189f1803a4e9feaf7202e5a2996abd6ab069.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c35a2a595857ec222d3e9fae7e2e189f1803a4e9feaf7202e5a2996abd6ab069.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4004 c35a2a595857ec222d3e9fae7e2e189f1803a4e9feaf7202e5a2996abd6ab069.exe 4004 c35a2a595857ec222d3e9fae7e2e189f1803a4e9feaf7202e5a2996abd6ab069.exe 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found 3500 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4004 c35a2a595857ec222d3e9fae7e2e189f1803a4e9feaf7202e5a2996abd6ab069.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 3500 Process not Found Token: SeCreatePagefilePrivilege 3500 Process not Found Token: SeShutdownPrivilege 3500 Process not Found Token: SeCreatePagefilePrivilege 3500 Process not Found - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3500 Process not Found 3500 Process not Found - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c35a2a595857ec222d3e9fae7e2e189f1803a4e9feaf7202e5a2996abd6ab069.exe"C:\Users\Admin\AppData\Local\Temp\c35a2a595857ec222d3e9fae7e2e189f1803a4e9feaf7202e5a2996abd6ab069.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4004