Resubmissions
09/04/2024, 13:53
240409-q7av3sca71 1009/04/2024, 13:53
240409-q699jsgg35 1009/04/2024, 13:53
240409-q69ysaca7z 1009/04/2024, 13:53
240409-q69m1sca7y 1002/12/2023, 07:46
231202-jmdmxaaf8t 10Analysis
-
max time kernel
1800s -
max time network
1264s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
09/04/2024, 13:53
Static task
static1
Behavioral task
behavioral1
Sample
caca493c10d47df328c029a270165a21afa50b350ec4f3dd3a6ea72ef2c54823.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
caca493c10d47df328c029a270165a21afa50b350ec4f3dd3a6ea72ef2c54823.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
caca493c10d47df328c029a270165a21afa50b350ec4f3dd3a6ea72ef2c54823.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
caca493c10d47df328c029a270165a21afa50b350ec4f3dd3a6ea72ef2c54823.exe
Resource
win11-20240221-en
General
-
Target
caca493c10d47df328c029a270165a21afa50b350ec4f3dd3a6ea72ef2c54823.exe
-
Size
301KB
-
MD5
d976e27be52536c60076fe9a3a646ad1
-
SHA1
9db98366d212bcd7e3926acb6505c45020604c61
-
SHA256
caca493c10d47df328c029a270165a21afa50b350ec4f3dd3a6ea72ef2c54823
-
SHA512
9a44b70bd35a1467c0af014fa13f7ade42b708928511dced8c4ad6f0813e46e9bd5897d476b9ba3c09972bcb757648925453396796f515aaf03ebff651c3985e
-
SSDEEP
3072:uNg1miw2R2eRVMvRz3jYziACBbFvfy4zoV25kGpYUX35U:qMRnVGDiiJRFMAK
Malware Config
Extracted
smokeloader
2022
http://onualituyrs.org/
http://sumagulituyo.org/
http://snukerukeutit.org/
http://lightseinsteniki.org/
http://liuliuoumumy.org/
http://stualialuyastrelia.net/
http://kumbuyartyty.net/
http://criogetikfenbut.org/
http://tonimiuyaytre.org/
http://tyiuiunuewqy.org/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
pid Process 3316 Process not Found -
Executes dropped EXE 3 IoCs
pid Process 4256 asgiieu 4744 asgiieu 1840 asgiieu -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI asgiieu Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI asgiieu Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI asgiieu Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI asgiieu Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI asgiieu Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI asgiieu Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI caca493c10d47df328c029a270165a21afa50b350ec4f3dd3a6ea72ef2c54823.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI asgiieu Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI asgiieu Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI asgiieu Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI caca493c10d47df328c029a270165a21afa50b350ec4f3dd3a6ea72ef2c54823.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI caca493c10d47df328c029a270165a21afa50b350ec4f3dd3a6ea72ef2c54823.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 768 caca493c10d47df328c029a270165a21afa50b350ec4f3dd3a6ea72ef2c54823.exe 768 caca493c10d47df328c029a270165a21afa50b350ec4f3dd3a6ea72ef2c54823.exe 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found 3316 Process not Found -
Suspicious behavior: MapViewOfSection 4 IoCs
pid Process 768 caca493c10d47df328c029a270165a21afa50b350ec4f3dd3a6ea72ef2c54823.exe 4256 asgiieu 4744 asgiieu 1840 asgiieu -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeShutdownPrivilege 3316 Process not Found Token: SeCreatePagefilePrivilege 3316 Process not Found Token: SeShutdownPrivilege 3316 Process not Found Token: SeCreatePagefilePrivilege 3316 Process not Found Token: SeShutdownPrivilege 3316 Process not Found Token: SeCreatePagefilePrivilege 3316 Process not Found Token: SeShutdownPrivilege 3316 Process not Found Token: SeCreatePagefilePrivilege 3316 Process not Found Token: SeShutdownPrivilege 3316 Process not Found Token: SeCreatePagefilePrivilege 3316 Process not Found Token: SeShutdownPrivilege 3316 Process not Found Token: SeCreatePagefilePrivilege 3316 Process not Found -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\caca493c10d47df328c029a270165a21afa50b350ec4f3dd3a6ea72ef2c54823.exe"C:\Users\Admin\AppData\Local\Temp\caca493c10d47df328c029a270165a21afa50b350ec4f3dd3a6ea72ef2c54823.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:768
-
C:\Users\Admin\AppData\Roaming\asgiieuC:\Users\Admin\AppData\Roaming\asgiieu1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4256
-
C:\Users\Admin\AppData\Roaming\asgiieuC:\Users\Admin\AppData\Roaming\asgiieu1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4744
-
C:\Users\Admin\AppData\Roaming\asgiieuC:\Users\Admin\AppData\Roaming\asgiieu1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1840
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
301KB
MD5d976e27be52536c60076fe9a3a646ad1
SHA19db98366d212bcd7e3926acb6505c45020604c61
SHA256caca493c10d47df328c029a270165a21afa50b350ec4f3dd3a6ea72ef2c54823
SHA5129a44b70bd35a1467c0af014fa13f7ade42b708928511dced8c4ad6f0813e46e9bd5897d476b9ba3c09972bcb757648925453396796f515aaf03ebff651c3985e