Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
17-04-2024 14:54
Static task
static1
Behavioral task
behavioral1
Sample
684bcee9dcb5326013108c4f4fb40dce8d98bc937a00b64e9d9f9754d0c78377.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
684bcee9dcb5326013108c4f4fb40dce8d98bc937a00b64e9d9f9754d0c78377.exe
Resource
win10v2004-20240412-en
General
-
Target
684bcee9dcb5326013108c4f4fb40dce8d98bc937a00b64e9d9f9754d0c78377.exe
-
Size
311KB
-
MD5
6842403982c36b6c450fde3035eb7043
-
SHA1
d40806e8623b10811703aadf27d5b055da6e98a5
-
SHA256
684bcee9dcb5326013108c4f4fb40dce8d98bc937a00b64e9d9f9754d0c78377
-
SHA512
2d10d7bb85475a86f85019228a88cebf0da92ed5cb24102facbb34a875f3666d0ebf0783b1db1b996f2087feb672f337e91cb72c8b899c632496344a42e4ab37
-
SSDEEP
3072:uQLPli/LX0eRJibugxk++1iyvoBgDym4BV9JxNcdOOQVmRZ+pfTK7KVDrc+B5f2B:uQLPwkvB+iIoBoSVPW3ofTgYn79oUq
Malware Config
Extracted
smokeloader
up3
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1156 -
Executes dropped EXE 2 IoCs
Processes:
7FBB.exe8576.exepid process 2988 7FBB.exe 2428 8576.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
684bcee9dcb5326013108c4f4fb40dce8d98bc937a00b64e9d9f9754d0c78377.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 684bcee9dcb5326013108c4f4fb40dce8d98bc937a00b64e9d9f9754d0c78377.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 684bcee9dcb5326013108c4f4fb40dce8d98bc937a00b64e9d9f9754d0c78377.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 684bcee9dcb5326013108c4f4fb40dce8d98bc937a00b64e9d9f9754d0c78377.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
684bcee9dcb5326013108c4f4fb40dce8d98bc937a00b64e9d9f9754d0c78377.exepid process 2932 684bcee9dcb5326013108c4f4fb40dce8d98bc937a00b64e9d9f9754d0c78377.exe 2932 684bcee9dcb5326013108c4f4fb40dce8d98bc937a00b64e9d9f9754d0c78377.exe 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 1156 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
684bcee9dcb5326013108c4f4fb40dce8d98bc937a00b64e9d9f9754d0c78377.exepid process 2932 684bcee9dcb5326013108c4f4fb40dce8d98bc937a00b64e9d9f9754d0c78377.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 1156 1156 -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
pid process 1156 1156 -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
description pid process target process PID 1156 wrote to memory of 2988 1156 7FBB.exe PID 1156 wrote to memory of 2988 1156 7FBB.exe PID 1156 wrote to memory of 2988 1156 7FBB.exe PID 1156 wrote to memory of 2988 1156 7FBB.exe PID 1156 wrote to memory of 2988 1156 7FBB.exe PID 1156 wrote to memory of 2988 1156 7FBB.exe PID 1156 wrote to memory of 2988 1156 7FBB.exe PID 1156 wrote to memory of 2428 1156 8576.exe PID 1156 wrote to memory of 2428 1156 8576.exe PID 1156 wrote to memory of 2428 1156 8576.exe PID 1156 wrote to memory of 2428 1156 8576.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\684bcee9dcb5326013108c4f4fb40dce8d98bc937a00b64e9d9f9754d0c78377.exe"C:\Users\Admin\AppData\Local\Temp\684bcee9dcb5326013108c4f4fb40dce8d98bc937a00b64e9d9f9754d0c78377.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\7FBB.exeC:\Users\Admin\AppData\Local\Temp\7FBB.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\8576.exeC:\Users\Admin\AppData\Local\Temp\8576.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7FBB.exeFilesize
5.0MB
MD510ef283264e5050eb40f465feabeea60
SHA15c2b60ad7c2089db827532fed6069bdf74b505f8
SHA2566d45d61463e3521aa6d3d31bd7e953d38c6381c0e1b526dcb28c7f2786669eb6
SHA512c4e4080840991a829b05c76a55f6da6bffc9f618c7a1214d4d0b84e6e714d7b0e5646a99a5d92188f71801e6b7269069728f328d3a3b3fda577191372f399080
-
C:\Users\Admin\AppData\Local\Temp\8576.exeFilesize
385KB
MD5bdbfccc2b71c0d7f9de70aba81597b52
SHA1ebb97f2a7fe51ff607a1d1b7557c995dd1cc275a
SHA256082e8792e48e6ae0b16330f6bde833c42158ba2c9b75fad31ebc3d939f8a0042
SHA512fba755745e82b6acd1e74e15ce9bc729a9b0e85bbb1975959c1b5d7ab1e6859efc715de87c3f4b6ef4bb21a25d9246142e96323cfc5d732ae6007b4690dcd417
-
memory/1156-4-0x0000000003D40000-0x0000000003D56000-memory.dmpFilesize
88KB
-
memory/2428-22-0x0000000000010000-0x0000000000076000-memory.dmpFilesize
408KB
-
memory/2428-25-0x0000000000010000-0x0000000000076000-memory.dmpFilesize
408KB
-
memory/2932-2-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/2932-1-0x0000000000530000-0x0000000000630000-memory.dmpFilesize
1024KB
-
memory/2932-3-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/2932-5-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB