Analysis
-
max time kernel
60s -
max time network
53s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05-04-2024 08:20
Static task
static1
Behavioral task
behavioral1
Sample
edc235f5b21f8230e1287d22bd884bc8c36424210b4c14e8e9c2f2e0dedd3f7e.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
edc235f5b21f8230e1287d22bd884bc8c36424210b4c14e8e9c2f2e0dedd3f7e.exe
Resource
win10v2004-20240226-en
General
-
Target
edc235f5b21f8230e1287d22bd884bc8c36424210b4c14e8e9c2f2e0dedd3f7e.exe
-
Size
168KB
-
MD5
ec093454a010a3e301e6b6e4cb5184cb
-
SHA1
d9912927633c0d7f95edab4a8cabacccf7ab58d6
-
SHA256
edc235f5b21f8230e1287d22bd884bc8c36424210b4c14e8e9c2f2e0dedd3f7e
-
SHA512
0fe24aa7fee463d2dc4bbcb628210bbbebc8f09495766a116da7e2ae9622daaa9d6a9a8ac2eda206a378987ec975f7cd87249d376b9775aef7fc820a7a07a027
-
SSDEEP
3072:42w44jo5hGz+SbvmhBGNm0T3eLQFbAwQeeyGACS:4HLyXG6H0TUGg
Malware Config
Extracted
smokeloader
pub3
Extracted
smokeloader
2022
http://sjyey.com/tmp/index.php
http://babonwo.ru/tmp/index.php
http://mth.com.ua/tmp/index.php
http://piratia.pw/tmp/index.php
http://go-piratia.ru/tmp/index.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3460 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
edc235f5b21f8230e1287d22bd884bc8c36424210b4c14e8e9c2f2e0dedd3f7e.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI edc235f5b21f8230e1287d22bd884bc8c36424210b4c14e8e9c2f2e0dedd3f7e.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI edc235f5b21f8230e1287d22bd884bc8c36424210b4c14e8e9c2f2e0dedd3f7e.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI edc235f5b21f8230e1287d22bd884bc8c36424210b4c14e8e9c2f2e0dedd3f7e.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
edc235f5b21f8230e1287d22bd884bc8c36424210b4c14e8e9c2f2e0dedd3f7e.exepid process 848 edc235f5b21f8230e1287d22bd884bc8c36424210b4c14e8e9c2f2e0dedd3f7e.exe 848 edc235f5b21f8230e1287d22bd884bc8c36424210b4c14e8e9c2f2e0dedd3f7e.exe 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 3460 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
edc235f5b21f8230e1287d22bd884bc8c36424210b4c14e8e9c2f2e0dedd3f7e.exepid process 848 edc235f5b21f8230e1287d22bd884bc8c36424210b4c14e8e9c2f2e0dedd3f7e.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
pid process 3460 3460 3460 -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
pid process 3460 3460 3460 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\edc235f5b21f8230e1287d22bd884bc8c36424210b4c14e8e9c2f2e0dedd3f7e.exe"C:\Users\Admin\AppData\Local\Temp\edc235f5b21f8230e1287d22bd884bc8c36424210b4c14e8e9c2f2e0dedd3f7e.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/848-1-0x0000000000640000-0x0000000000740000-memory.dmpFilesize
1024KB
-
memory/848-2-0x00000000005E0000-0x00000000005EB000-memory.dmpFilesize
44KB
-
memory/848-3-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/848-5-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/3460-4-0x0000000007B40000-0x0000000007B56000-memory.dmpFilesize
88KB