Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08-04-2024 02:28
Static task
static1
Behavioral task
behavioral1
Sample
363c8a59e1aa5db76fbea9790e8a5d6aea34c91c31058f27b1d74cd61176d473.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
363c8a59e1aa5db76fbea9790e8a5d6aea34c91c31058f27b1d74cd61176d473.exe
Resource
win10v2004-20240226-en
General
-
Target
363c8a59e1aa5db76fbea9790e8a5d6aea34c91c31058f27b1d74cd61176d473.exe
-
Size
234KB
-
MD5
ebe71b5ba13ea1a61f3473ef01036eb4
-
SHA1
29a8e68384ecf60935a61b32b311002a620a85eb
-
SHA256
363c8a59e1aa5db76fbea9790e8a5d6aea34c91c31058f27b1d74cd61176d473
-
SHA512
f4c7d5b3ee3d4d1e27ef85b58b877f0d033f31881e96cddab7fe845d487a2b1d575f6bb61caada912b8e2b0b17249eafa0cefabeaa1440805a85e76227112746
-
SSDEEP
3072:+lzupUvMF2X7BHv1uhtw+LZiXhMFM4aNejxBykNwc45uhGg3eo0jCSETu:nWEF+7Bt/Akf44ePykuci+GDBjCSET
Malware Config
Extracted
smokeloader
pub3
Extracted
smokeloader
2022
http://nidoe.org/tmp/index.php
http://sodez.ru/tmp/index.php
http://uama.com.ua/tmp/index.php
http://talesofpirates.net/tmp/index.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3408 -
Executes dropped EXE 1 IoCs
Processes:
hwcbuaipid process 3104 hwcbuai -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
hwcbuai363c8a59e1aa5db76fbea9790e8a5d6aea34c91c31058f27b1d74cd61176d473.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hwcbuai Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hwcbuai Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hwcbuai Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 363c8a59e1aa5db76fbea9790e8a5d6aea34c91c31058f27b1d74cd61176d473.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 363c8a59e1aa5db76fbea9790e8a5d6aea34c91c31058f27b1d74cd61176d473.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 363c8a59e1aa5db76fbea9790e8a5d6aea34c91c31058f27b1d74cd61176d473.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
363c8a59e1aa5db76fbea9790e8a5d6aea34c91c31058f27b1d74cd61176d473.exepid process 1728 363c8a59e1aa5db76fbea9790e8a5d6aea34c91c31058f27b1d74cd61176d473.exe 1728 363c8a59e1aa5db76fbea9790e8a5d6aea34c91c31058f27b1d74cd61176d473.exe 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 3408 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
363c8a59e1aa5db76fbea9790e8a5d6aea34c91c31058f27b1d74cd61176d473.exehwcbuaipid process 1728 363c8a59e1aa5db76fbea9790e8a5d6aea34c91c31058f27b1d74cd61176d473.exe 3104 hwcbuai -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
pid process 3408 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\363c8a59e1aa5db76fbea9790e8a5d6aea34c91c31058f27b1d74cd61176d473.exe"C:\Users\Admin\AppData\Local\Temp\363c8a59e1aa5db76fbea9790e8a5d6aea34c91c31058f27b1d74cd61176d473.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\hwcbuaiC:\Users\Admin\AppData\Roaming\hwcbuai1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\hwcbuaiFilesize
234KB
MD5ebe71b5ba13ea1a61f3473ef01036eb4
SHA129a8e68384ecf60935a61b32b311002a620a85eb
SHA256363c8a59e1aa5db76fbea9790e8a5d6aea34c91c31058f27b1d74cd61176d473
SHA512f4c7d5b3ee3d4d1e27ef85b58b877f0d033f31881e96cddab7fe845d487a2b1d575f6bb61caada912b8e2b0b17249eafa0cefabeaa1440805a85e76227112746
-
memory/1728-1-0x0000000000980000-0x0000000000A80000-memory.dmpFilesize
1024KB
-
memory/1728-2-0x0000000002470000-0x000000000247B000-memory.dmpFilesize
44KB
-
memory/1728-3-0x0000000000400000-0x0000000000857000-memory.dmpFilesize
4.3MB
-
memory/1728-5-0x0000000000400000-0x0000000000857000-memory.dmpFilesize
4.3MB
-
memory/3104-14-0x00000000009E0000-0x0000000000AE0000-memory.dmpFilesize
1024KB
-
memory/3104-15-0x0000000000400000-0x0000000000857000-memory.dmpFilesize
4.3MB
-
memory/3104-19-0x0000000000400000-0x0000000000857000-memory.dmpFilesize
4.3MB
-
memory/3408-4-0x0000000002D00000-0x0000000002D16000-memory.dmpFilesize
88KB
-
memory/3408-16-0x00000000012D0000-0x00000000012E6000-memory.dmpFilesize
88KB