Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17-04-2024 14:53
Static task
static1
Behavioral task
behavioral1
Sample
2e08721f791305935eb167081cc4dc13b58297d3810ef998026c7a0a59f00f40.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2e08721f791305935eb167081cc4dc13b58297d3810ef998026c7a0a59f00f40.exe
Resource
win10v2004-20240412-en
General
-
Target
2e08721f791305935eb167081cc4dc13b58297d3810ef998026c7a0a59f00f40.exe
-
Size
301KB
-
MD5
f127ade2e89118628ebbbd9ec1cdc39d
-
SHA1
6b809f9841021a85db849335cb5dade1e6803b9b
-
SHA256
2e08721f791305935eb167081cc4dc13b58297d3810ef998026c7a0a59f00f40
-
SHA512
38cf4f2b67c3daa301a5d8431b3104a278357ec44cc485f969c3b11784f070fa00be466a1e3f901edc8bb48f3e8f52c784962c082d17cf263434bfc0bb15fa11
-
SSDEEP
6144:R8lL2DkSZY1P0N9pWXe8/5dfTgYn79o6q:R+7SZYd1Xegn7a
Malware Config
Extracted
smokeloader
up3
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1200 -
Executes dropped EXE 2 IoCs
Processes:
F9BA.exeFD82.exepid process 2580 F9BA.exe 2684 FD82.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
2e08721f791305935eb167081cc4dc13b58297d3810ef998026c7a0a59f00f40.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2e08721f791305935eb167081cc4dc13b58297d3810ef998026c7a0a59f00f40.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2e08721f791305935eb167081cc4dc13b58297d3810ef998026c7a0a59f00f40.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2e08721f791305935eb167081cc4dc13b58297d3810ef998026c7a0a59f00f40.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2e08721f791305935eb167081cc4dc13b58297d3810ef998026c7a0a59f00f40.exepid process 1924 2e08721f791305935eb167081cc4dc13b58297d3810ef998026c7a0a59f00f40.exe 1924 2e08721f791305935eb167081cc4dc13b58297d3810ef998026c7a0a59f00f40.exe 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
2e08721f791305935eb167081cc4dc13b58297d3810ef998026c7a0a59f00f40.exepid process 1924 2e08721f791305935eb167081cc4dc13b58297d3810ef998026c7a0a59f00f40.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 1200 1200 -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
pid process 1200 1200 -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
description pid process target process PID 1200 wrote to memory of 2580 1200 F9BA.exe PID 1200 wrote to memory of 2580 1200 F9BA.exe PID 1200 wrote to memory of 2580 1200 F9BA.exe PID 1200 wrote to memory of 2580 1200 F9BA.exe PID 1200 wrote to memory of 2580 1200 F9BA.exe PID 1200 wrote to memory of 2580 1200 F9BA.exe PID 1200 wrote to memory of 2580 1200 F9BA.exe PID 1200 wrote to memory of 2684 1200 FD82.exe PID 1200 wrote to memory of 2684 1200 FD82.exe PID 1200 wrote to memory of 2684 1200 FD82.exe PID 1200 wrote to memory of 2684 1200 FD82.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e08721f791305935eb167081cc4dc13b58297d3810ef998026c7a0a59f00f40.exe"C:\Users\Admin\AppData\Local\Temp\2e08721f791305935eb167081cc4dc13b58297d3810ef998026c7a0a59f00f40.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\F9BA.exeC:\Users\Admin\AppData\Local\Temp\F9BA.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\FD82.exeC:\Users\Admin\AppData\Local\Temp\FD82.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\F9BA.exeFilesize
5.0MB
MD510ef283264e5050eb40f465feabeea60
SHA15c2b60ad7c2089db827532fed6069bdf74b505f8
SHA2566d45d61463e3521aa6d3d31bd7e953d38c6381c0e1b526dcb28c7f2786669eb6
SHA512c4e4080840991a829b05c76a55f6da6bffc9f618c7a1214d4d0b84e6e714d7b0e5646a99a5d92188f71801e6b7269069728f328d3a3b3fda577191372f399080
-
C:\Users\Admin\AppData\Local\Temp\FD82.exeFilesize
385KB
MD5bdbfccc2b71c0d7f9de70aba81597b52
SHA1ebb97f2a7fe51ff607a1d1b7557c995dd1cc275a
SHA256082e8792e48e6ae0b16330f6bde833c42158ba2c9b75fad31ebc3d939f8a0042
SHA512fba755745e82b6acd1e74e15ce9bc729a9b0e85bbb1975959c1b5d7ab1e6859efc715de87c3f4b6ef4bb21a25d9246142e96323cfc5d732ae6007b4690dcd417
-
memory/1200-4-0x0000000002560000-0x0000000002576000-memory.dmpFilesize
88KB
-
memory/1924-1-0x0000000000630000-0x0000000000730000-memory.dmpFilesize
1024KB
-
memory/1924-2-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/1924-3-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1924-5-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/2684-22-0x0000000000010000-0x0000000000076000-memory.dmpFilesize
408KB
-
memory/2684-25-0x0000000000010000-0x0000000000076000-memory.dmpFilesize
408KB