Analysis
-
max time kernel
300s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-04-2024 04:48
Static task
static1
Behavioral task
behavioral1
Sample
14e644152f3a2b76ccd905cb21a4b9299ef0d86007e7629c6f02f0546c5cad44.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
14e644152f3a2b76ccd905cb21a4b9299ef0d86007e7629c6f02f0546c5cad44.exe
Resource
win10-20240404-en
General
-
Target
14e644152f3a2b76ccd905cb21a4b9299ef0d86007e7629c6f02f0546c5cad44.exe
-
Size
296KB
-
MD5
1f89ee113750e8080ad2aff62da7b483
-
SHA1
57cfb704a1cf1220faaf9774fd480c75eca13c5e
-
SHA256
14e644152f3a2b76ccd905cb21a4b9299ef0d86007e7629c6f02f0546c5cad44
-
SHA512
b1d12e20122f2cb094bb14e58014f4e25fa40fb196acb513b2ff155dd3b257b89d7c11cf34bff5a42d3a0c20204a7eb54f8614cf92721725ca1220313329807a
-
SSDEEP
3072:5ETMdoLxW0mhxewNX08v7v4gnR4A5+Op54K1uIKF:hdoLohIExjRRsOpSou
Malware Config
Extracted
smokeloader
pub3
Extracted
smokeloader
2022
http://nidoe.org/tmp/index.php
http://sodez.ru/tmp/index.php
http://uama.com.ua/tmp/index.php
http://talesofpirates.net/tmp/index.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1216 -
Executes dropped EXE 1 IoCs
Processes:
rdrddcspid process 2496 rdrddcs -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
14e644152f3a2b76ccd905cb21a4b9299ef0d86007e7629c6f02f0546c5cad44.exerdrddcsdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 14e644152f3a2b76ccd905cb21a4b9299ef0d86007e7629c6f02f0546c5cad44.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 14e644152f3a2b76ccd905cb21a4b9299ef0d86007e7629c6f02f0546c5cad44.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 14e644152f3a2b76ccd905cb21a4b9299ef0d86007e7629c6f02f0546c5cad44.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI rdrddcs Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI rdrddcs Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI rdrddcs -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
14e644152f3a2b76ccd905cb21a4b9299ef0d86007e7629c6f02f0546c5cad44.exepid process 2300 14e644152f3a2b76ccd905cb21a4b9299ef0d86007e7629c6f02f0546c5cad44.exe 2300 14e644152f3a2b76ccd905cb21a4b9299ef0d86007e7629c6f02f0546c5cad44.exe 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
14e644152f3a2b76ccd905cb21a4b9299ef0d86007e7629c6f02f0546c5cad44.exerdrddcspid process 2300 14e644152f3a2b76ccd905cb21a4b9299ef0d86007e7629c6f02f0546c5cad44.exe 2496 rdrddcs -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 1216 -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
taskeng.exedescription pid process target process PID 668 wrote to memory of 2496 668 taskeng.exe rdrddcs PID 668 wrote to memory of 2496 668 taskeng.exe rdrddcs PID 668 wrote to memory of 2496 668 taskeng.exe rdrddcs PID 668 wrote to memory of 2496 668 taskeng.exe rdrddcs
Processes
-
C:\Users\Admin\AppData\Local\Temp\14e644152f3a2b76ccd905cb21a4b9299ef0d86007e7629c6f02f0546c5cad44.exe"C:\Users\Admin\AppData\Local\Temp\14e644152f3a2b76ccd905cb21a4b9299ef0d86007e7629c6f02f0546c5cad44.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\taskeng.exetaskeng.exe {3A1A9996-7144-45D6-9E38-CD2BF9A2DBC8} S-1-5-21-778096762-2241304387-192235952-1000:AYFLYVMK\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\rdrddcsC:\Users\Admin\AppData\Roaming\rdrddcs2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\rdrddcsFilesize
296KB
MD51f89ee113750e8080ad2aff62da7b483
SHA157cfb704a1cf1220faaf9774fd480c75eca13c5e
SHA25614e644152f3a2b76ccd905cb21a4b9299ef0d86007e7629c6f02f0546c5cad44
SHA512b1d12e20122f2cb094bb14e58014f4e25fa40fb196acb513b2ff155dd3b257b89d7c11cf34bff5a42d3a0c20204a7eb54f8614cf92721725ca1220313329807a
-
memory/1216-4-0x00000000029B0000-0x00000000029C6000-memory.dmpFilesize
88KB
-
memory/1216-16-0x0000000002A80000-0x0000000002A96000-memory.dmpFilesize
88KB
-
memory/2300-1-0x0000000002D70000-0x0000000002E70000-memory.dmpFilesize
1024KB
-
memory/2300-2-0x0000000000220000-0x000000000022B000-memory.dmpFilesize
44KB
-
memory/2300-3-0x0000000000400000-0x0000000002C2D000-memory.dmpFilesize
40.2MB
-
memory/2300-5-0x0000000000400000-0x0000000002C2D000-memory.dmpFilesize
40.2MB
-
memory/2496-14-0x0000000002D90000-0x0000000002E90000-memory.dmpFilesize
1024KB
-
memory/2496-15-0x0000000000400000-0x0000000002C2D000-memory.dmpFilesize
40.2MB
-
memory/2496-17-0x0000000000400000-0x0000000002C2D000-memory.dmpFilesize
40.2MB