Analysis
-
max time kernel
1793s -
max time network
1504s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
04-04-2024 17:02
General
-
Target
BotNets/SmokeBot/Builder.exe
-
Size
150KB
-
MD5
a9fbbab787268d6b6b7591c731994cde
-
SHA1
eff857cce9a252470b80b63710226058bc9d2c9c
-
SHA256
fc7a97e7bf86c69a409c1211dddc4e97cbc109ffd4a8d1a13ff3b9aab9b9d0f9
-
SHA512
d6ce3a60c0b3b2df9d07adb68e2578f7fabb97a7ccc370cd0871fe23d299f6e7251869d380dbd2561d35972131995a41dacacfdeba4c2ec3d0c9da1a21161ccc
-
SSDEEP
3072:roOzSNRh6+Cs7nKCageYQ+f5keXt3RI7VlFtYtrdi9ddDojSLR205Pbt:cA+57KCaget+f5ky3QVlwtrdir9oM/x
Malware Config
Signatures
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\BotNets\SmokeBot\Builder.exe"C:\Users\Admin\AppData\Local\Temp\BotNets\SmokeBot\Builder.exe"1⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfmFilesize
16KB
MD511f9f5b02cf7829d9d2efae3e4816536
SHA13c91022dc8fab2a71ecc79764eaa35faac7204e8
SHA25639309a013708e575f0af5bf759aae52af49b140b8b23df4b3b978e273639f29a
SHA5121dd604040f5c5ceec10063e6b1c79d303df6d4eef62555a5d6885a4c999caa039fda48ce374052bc07b0846b61b7fd4d53f7c2db7fa8d908b83d7d86ca26369b
-
memory/2292-0-0x0000000000400000-0x0000000000465000-memory.dmpFilesize
404KB
-
memory/2292-1-0x0000000000B40000-0x0000000000B41000-memory.dmpFilesize
4KB
-
memory/2292-2-0x0000000000400000-0x0000000000465000-memory.dmpFilesize
404KB