Resubmissions
09-04-2024 12:36
240409-psyg6afa72 1009-04-2024 12:36
240409-psxwmaad2s 1009-04-2024 12:36
240409-psw94afa69 1009-04-2024 12:36
240409-pswnkaac9z 1029-02-2024 04:55
240229-fkfspsdh3x 10Analysis
-
max time kernel
1200s -
max time network
838s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09-04-2024 12:36
Static task
static1
Behavioral task
behavioral1
Sample
6d533c8a98cee42c8f797a0b982a0be0da8d7503da8c42e8da10a88bfee9bf23.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6d533c8a98cee42c8f797a0b982a0be0da8d7503da8c42e8da10a88bfee9bf23.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
6d533c8a98cee42c8f797a0b982a0be0da8d7503da8c42e8da10a88bfee9bf23.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
6d533c8a98cee42c8f797a0b982a0be0da8d7503da8c42e8da10a88bfee9bf23.exe
Resource
win11-20240221-en
General
-
Target
6d533c8a98cee42c8f797a0b982a0be0da8d7503da8c42e8da10a88bfee9bf23.exe
-
Size
162KB
-
MD5
5cddaacf9782c030db128e3ebfd8f301
-
SHA1
71bae291b66ecfad6ee79ab150c9b4bdc676f06c
-
SHA256
6d533c8a98cee42c8f797a0b982a0be0da8d7503da8c42e8da10a88bfee9bf23
-
SHA512
bee3cbdeac5a317f58ebb2d621740f8b7e81e47db236327cb0e908bc49886e320e30a95191470953177740f702adfe704a626325ddd2a33f10c8ec3060059797
-
SSDEEP
3072:pR3aImWaDnBilDV8X+Ld1VVuLtKsQfk1RoGJS4dNVEv:pIbWaDBilDVNLdJBsQfk77X
Malware Config
Extracted
smokeloader
2022
http://selebration17io.io/index.php
http://vacantion18ffeu.cc/index.php
http://valarioulinity1.net/index.php
http://buriatiarutuhuob.net/index.php
http://cassiosssionunu.me/index.php
http://sulugilioiu19.net/index.php
http://goodfooggooftool.net/index.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid Process 1256 -
Executes dropped EXE 2 IoCs
Processes:
jerjtghjerjtghpid Process 320 jerjtgh 3008 jerjtgh -
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
6d533c8a98cee42c8f797a0b982a0be0da8d7503da8c42e8da10a88bfee9bf23.exejerjtghjerjtghdescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6d533c8a98cee42c8f797a0b982a0be0da8d7503da8c42e8da10a88bfee9bf23.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6d533c8a98cee42c8f797a0b982a0be0da8d7503da8c42e8da10a88bfee9bf23.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jerjtgh Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jerjtgh Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6d533c8a98cee42c8f797a0b982a0be0da8d7503da8c42e8da10a88bfee9bf23.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jerjtgh Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jerjtgh Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jerjtgh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jerjtgh -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
6d533c8a98cee42c8f797a0b982a0be0da8d7503da8c42e8da10a88bfee9bf23.exepid Process 2152 6d533c8a98cee42c8f797a0b982a0be0da8d7503da8c42e8da10a88bfee9bf23.exe 2152 6d533c8a98cee42c8f797a0b982a0be0da8d7503da8c42e8da10a88bfee9bf23.exe 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
6d533c8a98cee42c8f797a0b982a0be0da8d7503da8c42e8da10a88bfee9bf23.exejerjtghjerjtghpid Process 2152 6d533c8a98cee42c8f797a0b982a0be0da8d7503da8c42e8da10a88bfee9bf23.exe 320 jerjtgh 3008 jerjtgh -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
description pid Process Token: SeShutdownPrivilege 1256 Token: SeShutdownPrivilege 1256 Token: SeShutdownPrivilege 1256 Token: SeShutdownPrivilege 1256 -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
taskeng.exetaskeng.exedescription pid Process procid_target PID 2140 wrote to memory of 320 2140 taskeng.exe 31 PID 2140 wrote to memory of 320 2140 taskeng.exe 31 PID 2140 wrote to memory of 320 2140 taskeng.exe 31 PID 2140 wrote to memory of 320 2140 taskeng.exe 31 PID 2224 wrote to memory of 3008 2224 taskeng.exe 33 PID 2224 wrote to memory of 3008 2224 taskeng.exe 33 PID 2224 wrote to memory of 3008 2224 taskeng.exe 33 PID 2224 wrote to memory of 3008 2224 taskeng.exe 33 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d533c8a98cee42c8f797a0b982a0be0da8d7503da8c42e8da10a88bfee9bf23.exe"C:\Users\Admin\AppData\Local\Temp\6d533c8a98cee42c8f797a0b982a0be0da8d7503da8c42e8da10a88bfee9bf23.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2152
-
C:\Windows\system32\taskeng.exetaskeng.exe {CD8F87B2-6F74-404F-85D1-41E939DA1ECE} S-1-5-21-1658372521-4246568289-2509113762-1000:PIRBKNPS\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Roaming\jerjtghC:\Users\Admin\AppData\Roaming\jerjtgh2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:320
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {A79E10C1-586F-41E0-9A10-03A7DA09373D} S-1-5-21-1658372521-4246568289-2509113762-1000:PIRBKNPS\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Roaming\jerjtghC:\Users\Admin\AppData\Roaming\jerjtgh2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3008
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162KB
MD55cddaacf9782c030db128e3ebfd8f301
SHA171bae291b66ecfad6ee79ab150c9b4bdc676f06c
SHA2566d533c8a98cee42c8f797a0b982a0be0da8d7503da8c42e8da10a88bfee9bf23
SHA512bee3cbdeac5a317f58ebb2d621740f8b7e81e47db236327cb0e908bc49886e320e30a95191470953177740f702adfe704a626325ddd2a33f10c8ec3060059797