Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-03-2024 19:48
Static task
static1
Behavioral task
behavioral1
Sample
cc45ecb392b6ead669afcca3f27fa64b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cc45ecb392b6ead669afcca3f27fa64b.exe
Resource
win10v2004-20231215-en
General
-
Target
cc45ecb392b6ead669afcca3f27fa64b.exe
-
Size
328KB
-
MD5
cc45ecb392b6ead669afcca3f27fa64b
-
SHA1
2275e857cdd825578bedd978ed516a942c768f79
-
SHA256
d08f76dbb88b7a02d8f2ac71bed7d337cb46f7f13369dd2d33f471218f1d0e47
-
SHA512
4b0c5a476d281098f277dad687535456d4d5fcc637ae6cbdac8d8a6a649165f878aa2acd46ff59ad8a6e0c55f93d8dc45702c8ba3de3ee844e67e75c75f6b722
-
SSDEEP
6144:66Dqu5Z385JKDPrA3sWk5YmV5zQEHjH2XrTtWh3P9L0TrK2IAKk:EyZ3+6Pr6s9YmbZDH27pWh3PHGK
Malware Config
Extracted
smokeloader
pub2
Extracted
smokeloader
2020
http://conceitosseg.com/upload/
http://integrasidata.com/upload/
http://ozentekstil.com/upload/
http://finbelportal.com/upload/
http://telanganadigital.com/upload/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1368 -
Executes dropped EXE 1 IoCs
Processes:
rvurraapid process 2420 rvurraa -
Loads dropped DLL 4 IoCs
Processes:
cc45ecb392b6ead669afcca3f27fa64b.exeWerFault.exepid process 1152 cc45ecb392b6ead669afcca3f27fa64b.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2860 2420 WerFault.exe rvurraa -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
cc45ecb392b6ead669afcca3f27fa64b.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cc45ecb392b6ead669afcca3f27fa64b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cc45ecb392b6ead669afcca3f27fa64b.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cc45ecb392b6ead669afcca3f27fa64b.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
cc45ecb392b6ead669afcca3f27fa64b.exepid process 1152 cc45ecb392b6ead669afcca3f27fa64b.exe 1152 cc45ecb392b6ead669afcca3f27fa64b.exe 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
cc45ecb392b6ead669afcca3f27fa64b.exepid process 1152 cc45ecb392b6ead669afcca3f27fa64b.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 1368 -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
taskeng.exervurraadescription pid process target process PID 2492 wrote to memory of 2420 2492 taskeng.exe rvurraa PID 2492 wrote to memory of 2420 2492 taskeng.exe rvurraa PID 2492 wrote to memory of 2420 2492 taskeng.exe rvurraa PID 2492 wrote to memory of 2420 2492 taskeng.exe rvurraa PID 2420 wrote to memory of 2860 2420 rvurraa WerFault.exe PID 2420 wrote to memory of 2860 2420 rvurraa WerFault.exe PID 2420 wrote to memory of 2860 2420 rvurraa WerFault.exe PID 2420 wrote to memory of 2860 2420 rvurraa WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc45ecb392b6ead669afcca3f27fa64b.exe"C:\Users\Admin\AppData\Local\Temp\cc45ecb392b6ead669afcca3f27fa64b.exe"1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\taskeng.exetaskeng.exe {4227DD60-93B9-404A-A948-FFFE3A186555} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\rvurraaC:\Users\Admin\AppData\Roaming\rvurraa2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 1243⤵
- Loads dropped DLL
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\rvurraaFilesize
328KB
MD5cc45ecb392b6ead669afcca3f27fa64b
SHA12275e857cdd825578bedd978ed516a942c768f79
SHA256d08f76dbb88b7a02d8f2ac71bed7d337cb46f7f13369dd2d33f471218f1d0e47
SHA5124b0c5a476d281098f277dad687535456d4d5fcc637ae6cbdac8d8a6a649165f878aa2acd46ff59ad8a6e0c55f93d8dc45702c8ba3de3ee844e67e75c75f6b722
-
\Users\Admin\AppData\Local\Temp\CC4F.tmpFilesize
1.2MB
MD5d124f55b9393c976963407dff51ffa79
SHA12c7bbedd79791bfb866898c85b504186db610b5d
SHA256ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef
SHA512278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06
-
memory/1152-1-0x0000000000250000-0x0000000000350000-memory.dmpFilesize
1024KB
-
memory/1152-3-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/1152-2-0x00000000001B0000-0x00000000001B9000-memory.dmpFilesize
36KB
-
memory/1152-8-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/1368-7-0x0000000002610000-0x0000000002625000-memory.dmpFilesize
84KB
-
memory/2420-19-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/2420-18-0x0000000000230000-0x0000000000330000-memory.dmpFilesize
1024KB
-
memory/2420-25-0x0000000000230000-0x0000000000330000-memory.dmpFilesize
1024KB