Resubmissions
24-01-2025 23:30
250124-3hgcsatray 1009-04-2024 08:35
240409-kg6xyaag48 1009-04-2024 08:35
240409-kg2m8aea6s 1009-04-2024 08:35
240409-kg12paag46 1009-04-2024 08:35
240409-kg1qxsag45 1023-02-2024 00:53
240223-a8rxzsha6z 1022-02-2024 06:18
240222-g2y62sdc6x 10Analysis
-
max time kernel
1200s -
max time network
846s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
09-04-2024 08:35
General
-
Target
d874c5f6b10e26cfd96af59be1a40b173d0614770703a36fb84dd855900fd78c.exe
-
Size
141KB
-
MD5
3151d44dd03886e5f64f34481b116c81
-
SHA1
ebef87d5fd54925493385fbff5ba4d175c046fbc
-
SHA256
d874c5f6b10e26cfd96af59be1a40b173d0614770703a36fb84dd855900fd78c
-
SHA512
6ebcb293583a6858a023bf71a347783b788064f9415421503155e2f87426ff52d7881f2a680331d4332e4062153901295f4b92771a1afd527624bb15230bbcc6
-
SSDEEP
3072:p13jvfNcgSRb5hPi9OTtA5HljuEa9ckZKD4Xxh:bTX2gSJL3t0HlyEa9cM
Malware Config
Extracted
smokeloader
2022
http://selebration17io.io/index.php
http://vacantion18ffeu.cc/index.php
http://valarioulinity1.net/index.php
http://buriatiarutuhuob.net/index.php
http://cassiosssionunu.me/index.php
http://sulugilioiu19.net/index.php
http://goodfooggooftool.net/index.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d874c5f6b10e26cfd96af59be1a40b173d0614770703a36fb84dd855900fd78c.exe"C:\Users\Admin\AppData\Local\Temp\d874c5f6b10e26cfd96af59be1a40b173d0614770703a36fb84dd855900fd78c.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\taskeng.exetaskeng.exe {253EAB35-35A6-4E83-9007-C178298B02B5} S-1-5-21-3787592910-3720486031-2929222812-1000:HSNHLVYA\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\idjuibcC:\Users\Admin\AppData\Roaming\idjuibc2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {10DC7AF6-8596-4890-98FF-CA6D82B230E1} S-1-5-21-3787592910-3720486031-2929222812-1000:HSNHLVYA\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\idjuibcC:\Users\Admin\AppData\Roaming\idjuibc2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
141KB
MD53151d44dd03886e5f64f34481b116c81
SHA1ebef87d5fd54925493385fbff5ba4d175c046fbc
SHA256d874c5f6b10e26cfd96af59be1a40b173d0614770703a36fb84dd855900fd78c
SHA5126ebcb293583a6858a023bf71a347783b788064f9415421503155e2f87426ff52d7881f2a680331d4332e4062153901295f4b92771a1afd527624bb15230bbcc6
-
Filesize
4.1MB
-
Filesize
1024KB
-
Filesize
4.1MB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
1024KB
-
Filesize
4.1MB
-
Filesize
4.1MB
-
Filesize
4.1MB
-
Filesize
4.1MB
-
Filesize
44KB
-
Filesize
1024KB