Resubmissions
09-04-2024 12:36
240409-psyg6afa72 1009-04-2024 12:36
240409-psxwmaad2s 1009-04-2024 12:36
240409-psw94afa69 1009-04-2024 12:36
240409-pswnkaac9z 1029-02-2024 04:55
240229-fkfspsdh3x 10Analysis
-
max time kernel
600s -
max time network
457s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
09-04-2024 12:36
Static task
static1
Behavioral task
behavioral1
Sample
6d533c8a98cee42c8f797a0b982a0be0da8d7503da8c42e8da10a88bfee9bf23.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6d533c8a98cee42c8f797a0b982a0be0da8d7503da8c42e8da10a88bfee9bf23.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
6d533c8a98cee42c8f797a0b982a0be0da8d7503da8c42e8da10a88bfee9bf23.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
6d533c8a98cee42c8f797a0b982a0be0da8d7503da8c42e8da10a88bfee9bf23.exe
Resource
win11-20240221-en
General
-
Target
6d533c8a98cee42c8f797a0b982a0be0da8d7503da8c42e8da10a88bfee9bf23.exe
-
Size
162KB
-
MD5
5cddaacf9782c030db128e3ebfd8f301
-
SHA1
71bae291b66ecfad6ee79ab150c9b4bdc676f06c
-
SHA256
6d533c8a98cee42c8f797a0b982a0be0da8d7503da8c42e8da10a88bfee9bf23
-
SHA512
bee3cbdeac5a317f58ebb2d621740f8b7e81e47db236327cb0e908bc49886e320e30a95191470953177740f702adfe704a626325ddd2a33f10c8ec3060059797
-
SSDEEP
3072:pR3aImWaDnBilDV8X+Ld1VVuLtKsQfk1RoGJS4dNVEv:pIbWaDBilDVNLdJBsQfk77X
Malware Config
Extracted
smokeloader
2022
http://selebration17io.io/index.php
http://vacantion18ffeu.cc/index.php
http://valarioulinity1.net/index.php
http://buriatiarutuhuob.net/index.php
http://cassiosssionunu.me/index.php
http://sulugilioiu19.net/index.php
http://goodfooggooftool.net/index.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid Process 3320 -
Executes dropped EXE 1 IoCs
Processes:
hwssihbpid Process 4796 hwssihb -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
hwssihb6d533c8a98cee42c8f797a0b982a0be0da8d7503da8c42e8da10a88bfee9bf23.exedescription ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hwssihb Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6d533c8a98cee42c8f797a0b982a0be0da8d7503da8c42e8da10a88bfee9bf23.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6d533c8a98cee42c8f797a0b982a0be0da8d7503da8c42e8da10a88bfee9bf23.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6d533c8a98cee42c8f797a0b982a0be0da8d7503da8c42e8da10a88bfee9bf23.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hwssihb Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hwssihb -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
6d533c8a98cee42c8f797a0b982a0be0da8d7503da8c42e8da10a88bfee9bf23.exepid Process 3952 6d533c8a98cee42c8f797a0b982a0be0da8d7503da8c42e8da10a88bfee9bf23.exe 3952 6d533c8a98cee42c8f797a0b982a0be0da8d7503da8c42e8da10a88bfee9bf23.exe 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
6d533c8a98cee42c8f797a0b982a0be0da8d7503da8c42e8da10a88bfee9bf23.exehwssihbpid Process 3952 6d533c8a98cee42c8f797a0b982a0be0da8d7503da8c42e8da10a88bfee9bf23.exe 4796 hwssihb -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
description pid Process Token: SeShutdownPrivilege 3320 Token: SeCreatePagefilePrivilege 3320 Token: SeShutdownPrivilege 3320 Token: SeCreatePagefilePrivilege 3320 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d533c8a98cee42c8f797a0b982a0be0da8d7503da8c42e8da10a88bfee9bf23.exe"C:\Users\Admin\AppData\Local\Temp\6d533c8a98cee42c8f797a0b982a0be0da8d7503da8c42e8da10a88bfee9bf23.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3952
-
C:\Users\Admin\AppData\Roaming\hwssihbC:\Users\Admin\AppData\Roaming\hwssihb1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4796
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162KB
MD55cddaacf9782c030db128e3ebfd8f301
SHA171bae291b66ecfad6ee79ab150c9b4bdc676f06c
SHA2566d533c8a98cee42c8f797a0b982a0be0da8d7503da8c42e8da10a88bfee9bf23
SHA512bee3cbdeac5a317f58ebb2d621740f8b7e81e47db236327cb0e908bc49886e320e30a95191470953177740f702adfe704a626325ddd2a33f10c8ec3060059797