Resubmissions
11/04/2024, 09:38
240411-ll3lragg451011/04/2024, 09:38
240411-ll3azsbh8z1011/04/2024, 09:38
240411-ll2pfsgg441011/04/2024, 09:38
240411-ll2dpabh8x1011/04/2024, 09:37
240411-llsrjsbh8v1009/04/2024, 03:24
240409-dx2vlage811009/04/2024, 03:23
240409-dxjn1sda441016/01/2024, 16:35
240116-t3vapsehak10Analysis
- max time kernel
1800s - max time network
1766s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
11/04/2024, 09:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
1800 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10-20240404-en
windows10-1703-x64
3 signatures
1800 seconds
Behavioral task
behavioral3
Sample
file.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
10 signatures
1800 seconds
Behavioral task
behavioral4
Sample
file.exe
Resource
win11-20240221-en
windows11-21h2-x64
7 signatures
1800 seconds
General
- Target file.exe
- Size 234KB
- Sample240411-ll3lragg45
- SHA256 b4d9bc9471648ef8d072e524b4c6e3f5793e29b663bc85a9809912e7fad320c2
- MD5 ed0c899ce676b4f803a842b58805b16e
- SHA1 6de3ccba1d1cfa0a9825787ce860201367980b43
- SHA512 fd997ec5291062aea0c473dbdfe412c150296fc7794b8b9a77d3097726e2a6abc2af87d9d9eb1c12b2cf7f3420eaab49a85b387e8fe103381e310d82969eedf9
- SSDEEP 3072:MPh8al1TPcpuOmohvNAJIP1jkxKJoMazKzu2Zoib2LhYt2QeEN4I9jXO9ZJwVQk:Oh11EjhvNPhJo/ezTbrWESIxOTF
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2022
C2
-
http://selebration17io.io/index.php
-
http://vacantion18ffeu.cc/index.php
-
http://valarioulinity1.net/index.php
-
http://buriatiarutuhuob.net/index.php
-
http://cassiosssionunu.me/index.php
-
http://sulugilioiu19.net/index.php
-
http://goodfooggooftool.net/index.php
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Deletes itself 1 IoCs
pid Process 3528 Process not Found - Executes dropped EXE 3 IoCs
pid Process 3520 jeviwei 4024 jeviwei 4580 jeviwei - Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jeviwei Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jeviwei Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jeviwei Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jeviwei Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jeviwei Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jeviwei Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jeviwei Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jeviwei Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jeviwei - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Process not Found Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Process not Found - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2116 file.exe 2116 file.exe 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found 3528 Process not Found - Suspicious behavior: MapViewOfSection 4 IoCs
pid Process 2116 file.exe 3520 jeviwei 4024 jeviwei 4580 jeviwei - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeShutdownPrivilege 3528 Process not Found Token: SeCreatePagefilePrivilege 3528 Process not Found Token: SeShutdownPrivilege 3528 Process not Found Token: SeCreatePagefilePrivilege 3528 Process not Found Token: SeShutdownPrivilege 3528 Process not Found Token: SeCreatePagefilePrivilege 3528 Process not Found Token: SeShutdownPrivilege 3528 Process not Found Token: SeCreatePagefilePrivilege 3528 Process not Found Token: SeShutdownPrivilege 3528 Process not Found Token: SeCreatePagefilePrivilege 3528 Process not Found Token: SeShutdownPrivilege 3528 Process not Found Token: SeCreatePagefilePrivilege 3528 Process not Found Token: SeShutdownPrivilege 3528 Process not Found Token: SeCreatePagefilePrivilege 3528 Process not Found Token: SeShutdownPrivilege 3528 Process not Found Token: SeCreatePagefilePrivilege 3528 Process not Found Token: SeShutdownPrivilege 3528 Process not Found Token: SeCreatePagefilePrivilege 3528 Process not Found Token: SeShutdownPrivilege 3528 Process not Found Token: SeCreatePagefilePrivilege 3528 Process not Found Token: SeShutdownPrivilege 3528 Process not Found Token: SeCreatePagefilePrivilege 3528 Process not Found Token: SeShutdownPrivilege 3528 Process not Found Token: SeCreatePagefilePrivilege 3528 Process not Found Token: SeShutdownPrivilege 3528 Process not Found Token: SeCreatePagefilePrivilege 3528 Process not Found Token: SeShutdownPrivilege 3528 Process not Found Token: SeCreatePagefilePrivilege 3528 Process not Found Token: SeShutdownPrivilege 3528 Process not Found Token: SeCreatePagefilePrivilege 3528 Process not Found Token: SeShutdownPrivilege 3528 Process not Found Token: SeCreatePagefilePrivilege 3528 Process not Found Token: SeShutdownPrivilege 3528 Process not Found Token: SeCreatePagefilePrivilege 3528 Process not Found Token: SeShutdownPrivilege 3528 Process not Found Token: SeCreatePagefilePrivilege 3528 Process not Found Token: SeShutdownPrivilege 3528 Process not Found Token: SeCreatePagefilePrivilege 3528 Process not Found Token: SeShutdownPrivilege 3528 Process not Found Token: SeCreatePagefilePrivilege 3528 Process not Found Token: SeShutdownPrivilege 3528 Process not Found Token: SeCreatePagefilePrivilege 3528 Process not Found - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3528 Process not Found 3528 Process not Found - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2116
-
C:\Users\Admin\AppData\Roaming\jeviweiC:\Users\Admin\AppData\Roaming\jeviwei1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3520
-
C:\Users\Admin\AppData\Roaming\jeviweiC:\Users\Admin\AppData\Roaming\jeviwei1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4024
-
C:\Users\Admin\AppData\Roaming\jeviweiC:\Users\Admin\AppData\Roaming\jeviwei1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4580
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\jeviwei
- Size 234KB
- SHA256 b4d9bc9471648ef8d072e524b4c6e3f5793e29b663bc85a9809912e7fad320c2
- MD5 ed0c899ce676b4f803a842b58805b16e
- SHA1 6de3ccba1d1cfa0a9825787ce860201367980b43
- SHA512 fd997ec5291062aea0c473dbdfe412c150296fc7794b8b9a77d3097726e2a6abc2af87d9d9eb1c12b2cf7f3420eaab49a85b387e8fe103381e310d82969eedf9
- SSDEEP 3072:MPh8al1TPcpuOmohvNAJIP1jkxKJoMazKzu2Zoib2LhYt2QeEN4I9jXO9ZJwVQk:Oh11EjhvNPhJo/ezTbrWESIxOTF
- MD5 SHA1 SHA512 SSDEEP