Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17-04-2024 13:42
Static task
static1
Behavioral task
behavioral1
Sample
b1637a25a2959c9a6da241d94d8ddac92f3e542d86dbebdc47c1a06a4f6190a0.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b1637a25a2959c9a6da241d94d8ddac92f3e542d86dbebdc47c1a06a4f6190a0.exe
Resource
win10v2004-20240226-en
General
-
Target
b1637a25a2959c9a6da241d94d8ddac92f3e542d86dbebdc47c1a06a4f6190a0.exe
-
Size
293KB
-
MD5
5360fe5781d535acfbaeedd08e9c5b04
-
SHA1
1d1aede764c4396086a9847c193b1ee15b528ea2
-
SHA256
b1637a25a2959c9a6da241d94d8ddac92f3e542d86dbebdc47c1a06a4f6190a0
-
SHA512
68a8943c4bffa60864d90c286d0423a06f9ddaaa8f85d4c6d92e091f938c57dd1a92865014dfac6ad3ecc2dc67c9b3e161e479112d2aa77ab8b6a1b422b5f6bf
-
SSDEEP
3072:p/c24x3493JSl4C+VunyX/Bo7bAGGT6XL1MS6DdWcvMNm2zDngP9mQ6FIwG:p/Yl4CAi/o6XCSwMNm2a9m1I
Malware Config
Extracted
smokeloader
pub1
Extracted
smokeloader
2022
http://trad-einmyus.com/index.php
http://tradein-myus.com/index.php
http://trade-inmyus.com/index.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Deletes itself 1 IoCs
Processes:
pid process 1388 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
b1637a25a2959c9a6da241d94d8ddac92f3e542d86dbebdc47c1a06a4f6190a0.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI b1637a25a2959c9a6da241d94d8ddac92f3e542d86dbebdc47c1a06a4f6190a0.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI b1637a25a2959c9a6da241d94d8ddac92f3e542d86dbebdc47c1a06a4f6190a0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI b1637a25a2959c9a6da241d94d8ddac92f3e542d86dbebdc47c1a06a4f6190a0.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
b1637a25a2959c9a6da241d94d8ddac92f3e542d86dbebdc47c1a06a4f6190a0.exepid process 2944 b1637a25a2959c9a6da241d94d8ddac92f3e542d86dbebdc47c1a06a4f6190a0.exe 2944 b1637a25a2959c9a6da241d94d8ddac92f3e542d86dbebdc47c1a06a4f6190a0.exe 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 1388 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
b1637a25a2959c9a6da241d94d8ddac92f3e542d86dbebdc47c1a06a4f6190a0.exepid process 2944 b1637a25a2959c9a6da241d94d8ddac92f3e542d86dbebdc47c1a06a4f6190a0.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 1388 1388 -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
pid process 1388 1388 -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
cmd.exedescription pid process target process PID 1388 wrote to memory of 2420 1388 cmd.exe PID 1388 wrote to memory of 2420 1388 cmd.exe PID 1388 wrote to memory of 2420 1388 cmd.exe PID 2420 wrote to memory of 2484 2420 cmd.exe reg.exe PID 2420 wrote to memory of 2484 2420 cmd.exe reg.exe PID 2420 wrote to memory of 2484 2420 cmd.exe reg.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b1637a25a2959c9a6da241d94d8ddac92f3e542d86dbebdc47c1a06a4f6190a0.exe"C:\Users\Admin\AppData\Local\Temp\b1637a25a2959c9a6da241d94d8ddac92f3e542d86dbebdc47c1a06a4f6190a0.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2944
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\F7B7.bat" "1⤵
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 12⤵PID:2484
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\F7B7.batFilesize
77B
MD555cc761bf3429324e5a0095cab002113
SHA12cc1ef4542a4e92d4158ab3978425d517fafd16d
SHA256d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a
SHA51233f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155
-
memory/1388-4-0x0000000002710000-0x0000000002726000-memory.dmpFilesize
88KB
-
memory/2944-1-0x0000000000F60000-0x0000000001060000-memory.dmpFilesize
1024KB
-
memory/2944-2-0x00000000003C0000-0x00000000003CB000-memory.dmpFilesize
44KB
-
memory/2944-3-0x0000000000400000-0x0000000000AF2000-memory.dmpFilesize
6.9MB
-
memory/2944-5-0x0000000000400000-0x0000000000AF2000-memory.dmpFilesize
6.9MB