Analysis
-
max time kernel
300s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-04-2024 04:57
Static task
static1
Behavioral task
behavioral1
Sample
a28767af8137e72d25d10ecf309db3e2a6500b53e65930fb801a5eeb08970e7d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a28767af8137e72d25d10ecf309db3e2a6500b53e65930fb801a5eeb08970e7d.exe
Resource
win10-20240404-en
General
-
Target
a28767af8137e72d25d10ecf309db3e2a6500b53e65930fb801a5eeb08970e7d.exe
-
Size
296KB
-
MD5
149fd2af87560517461896494348b0b5
-
SHA1
46236249a25cb2e763b7ef51183f816888fcd5b3
-
SHA256
a28767af8137e72d25d10ecf309db3e2a6500b53e65930fb801a5eeb08970e7d
-
SHA512
65f92c1d1d09084b5a17fa5860fab8187042df1ac07742d8acd814dbf7d6a8dcabc7eb979fafc22d282c7ed90675f6db18b8da94c5aff80b90193e475b9de86e
-
SSDEEP
3072:FseCPxLfW0ZwuKTLnDTL52XVMQ6BHVgXCjnoXnP5ZgSoz5iuj87:FEPxLFwXLHQXVB6BHVeMUnPRuj
Malware Config
Extracted
smokeloader
pub3
Extracted
smokeloader
2022
http://nidoe.org/tmp/index.php
http://sodez.ru/tmp/index.php
http://uama.com.ua/tmp/index.php
http://talesofpirates.net/tmp/index.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
pid Process 1256 Process not Found -
Executes dropped EXE 1 IoCs
pid Process 1932 tvrfedj -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a28767af8137e72d25d10ecf309db3e2a6500b53e65930fb801a5eeb08970e7d.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a28767af8137e72d25d10ecf309db3e2a6500b53e65930fb801a5eeb08970e7d.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a28767af8137e72d25d10ecf309db3e2a6500b53e65930fb801a5eeb08970e7d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tvrfedj Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tvrfedj Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tvrfedj -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2872 a28767af8137e72d25d10ecf309db3e2a6500b53e65930fb801a5eeb08970e7d.exe 2872 a28767af8137e72d25d10ecf309db3e2a6500b53e65930fb801a5eeb08970e7d.exe 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2872 a28767af8137e72d25d10ecf309db3e2a6500b53e65930fb801a5eeb08970e7d.exe 1932 tvrfedj -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 1256 Process not Found -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1972 wrote to memory of 1932 1972 taskeng.exe 31 PID 1972 wrote to memory of 1932 1972 taskeng.exe 31 PID 1972 wrote to memory of 1932 1972 taskeng.exe 31 PID 1972 wrote to memory of 1932 1972 taskeng.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\a28767af8137e72d25d10ecf309db3e2a6500b53e65930fb801a5eeb08970e7d.exe"C:\Users\Admin\AppData\Local\Temp\a28767af8137e72d25d10ecf309db3e2a6500b53e65930fb801a5eeb08970e7d.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2872
-
C:\Windows\system32\taskeng.exetaskeng.exe {057A104F-F319-4C0C-9664-CD3BA8DC1DD6} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Roaming\tvrfedjC:\Users\Admin\AppData\Roaming\tvrfedj2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1932
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
296KB
MD5149fd2af87560517461896494348b0b5
SHA146236249a25cb2e763b7ef51183f816888fcd5b3
SHA256a28767af8137e72d25d10ecf309db3e2a6500b53e65930fb801a5eeb08970e7d
SHA51265f92c1d1d09084b5a17fa5860fab8187042df1ac07742d8acd814dbf7d6a8dcabc7eb979fafc22d282c7ed90675f6db18b8da94c5aff80b90193e475b9de86e