Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17-04-2024 14:56
Static task
static1
Behavioral task
behavioral1
Sample
cedd6842dc8e5b7b943cba42c7b1229e71963dfc5c47c52165947adb1287248b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cedd6842dc8e5b7b943cba42c7b1229e71963dfc5c47c52165947adb1287248b.exe
Resource
win10v2004-20240226-en
General
-
Target
cedd6842dc8e5b7b943cba42c7b1229e71963dfc5c47c52165947adb1287248b.exe
-
Size
239KB
-
MD5
8a5998ead64eeb32576a01030d890393
-
SHA1
5cd5662226bd724a136627834e2b1beacdb951a0
-
SHA256
cedd6842dc8e5b7b943cba42c7b1229e71963dfc5c47c52165947adb1287248b
-
SHA512
85387bd3ff646c17666dfd850e698654eafde9708de53b3b51e74f40e69e5afe76e40edaa25b0771f8d7594c5dd9aaa6626901a6f3ffdf424ae60d32e995142b
-
SSDEEP
3072:rfULUw/frbCOs7FHrG1d7nQ3At2ui0gjLM+LgeRp:rfULzfSOaFUdOI8IGge
Malware Config
Extracted
smokeloader
up3
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1176 -
Executes dropped EXE 2 IoCs
Processes:
50DE.exe5B7A.exepid process 2336 50DE.exe 2888 5B7A.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
cedd6842dc8e5b7b943cba42c7b1229e71963dfc5c47c52165947adb1287248b.exedescription pid process target process PID 2216 set thread context of 2580 2216 cedd6842dc8e5b7b943cba42c7b1229e71963dfc5c47c52165947adb1287248b.exe cedd6842dc8e5b7b943cba42c7b1229e71963dfc5c47c52165947adb1287248b.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
cedd6842dc8e5b7b943cba42c7b1229e71963dfc5c47c52165947adb1287248b.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cedd6842dc8e5b7b943cba42c7b1229e71963dfc5c47c52165947adb1287248b.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cedd6842dc8e5b7b943cba42c7b1229e71963dfc5c47c52165947adb1287248b.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cedd6842dc8e5b7b943cba42c7b1229e71963dfc5c47c52165947adb1287248b.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
cedd6842dc8e5b7b943cba42c7b1229e71963dfc5c47c52165947adb1287248b.exepid process 2580 cedd6842dc8e5b7b943cba42c7b1229e71963dfc5c47c52165947adb1287248b.exe 2580 cedd6842dc8e5b7b943cba42c7b1229e71963dfc5c47c52165947adb1287248b.exe 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 1176 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
cedd6842dc8e5b7b943cba42c7b1229e71963dfc5c47c52165947adb1287248b.exepid process 2580 cedd6842dc8e5b7b943cba42c7b1229e71963dfc5c47c52165947adb1287248b.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
cedd6842dc8e5b7b943cba42c7b1229e71963dfc5c47c52165947adb1287248b.exedescription pid process target process PID 2216 wrote to memory of 2580 2216 cedd6842dc8e5b7b943cba42c7b1229e71963dfc5c47c52165947adb1287248b.exe cedd6842dc8e5b7b943cba42c7b1229e71963dfc5c47c52165947adb1287248b.exe PID 2216 wrote to memory of 2580 2216 cedd6842dc8e5b7b943cba42c7b1229e71963dfc5c47c52165947adb1287248b.exe cedd6842dc8e5b7b943cba42c7b1229e71963dfc5c47c52165947adb1287248b.exe PID 2216 wrote to memory of 2580 2216 cedd6842dc8e5b7b943cba42c7b1229e71963dfc5c47c52165947adb1287248b.exe cedd6842dc8e5b7b943cba42c7b1229e71963dfc5c47c52165947adb1287248b.exe PID 2216 wrote to memory of 2580 2216 cedd6842dc8e5b7b943cba42c7b1229e71963dfc5c47c52165947adb1287248b.exe cedd6842dc8e5b7b943cba42c7b1229e71963dfc5c47c52165947adb1287248b.exe PID 2216 wrote to memory of 2580 2216 cedd6842dc8e5b7b943cba42c7b1229e71963dfc5c47c52165947adb1287248b.exe cedd6842dc8e5b7b943cba42c7b1229e71963dfc5c47c52165947adb1287248b.exe PID 2216 wrote to memory of 2580 2216 cedd6842dc8e5b7b943cba42c7b1229e71963dfc5c47c52165947adb1287248b.exe cedd6842dc8e5b7b943cba42c7b1229e71963dfc5c47c52165947adb1287248b.exe PID 2216 wrote to memory of 2580 2216 cedd6842dc8e5b7b943cba42c7b1229e71963dfc5c47c52165947adb1287248b.exe cedd6842dc8e5b7b943cba42c7b1229e71963dfc5c47c52165947adb1287248b.exe PID 1176 wrote to memory of 2336 1176 50DE.exe PID 1176 wrote to memory of 2336 1176 50DE.exe PID 1176 wrote to memory of 2336 1176 50DE.exe PID 1176 wrote to memory of 2336 1176 50DE.exe PID 1176 wrote to memory of 2336 1176 50DE.exe PID 1176 wrote to memory of 2336 1176 50DE.exe PID 1176 wrote to memory of 2336 1176 50DE.exe PID 1176 wrote to memory of 2888 1176 5B7A.exe PID 1176 wrote to memory of 2888 1176 5B7A.exe PID 1176 wrote to memory of 2888 1176 5B7A.exe PID 1176 wrote to memory of 2888 1176 5B7A.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cedd6842dc8e5b7b943cba42c7b1229e71963dfc5c47c52165947adb1287248b.exe"C:\Users\Admin\AppData\Local\Temp\cedd6842dc8e5b7b943cba42c7b1229e71963dfc5c47c52165947adb1287248b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cedd6842dc8e5b7b943cba42c7b1229e71963dfc5c47c52165947adb1287248b.exe"C:\Users\Admin\AppData\Local\Temp\cedd6842dc8e5b7b943cba42c7b1229e71963dfc5c47c52165947adb1287248b.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\50DE.exeC:\Users\Admin\AppData\Local\Temp\50DE.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\5B7A.exeC:\Users\Admin\AppData\Local\Temp\5B7A.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\50DE.exeFilesize
5.0MB
MD510ef283264e5050eb40f465feabeea60
SHA15c2b60ad7c2089db827532fed6069bdf74b505f8
SHA2566d45d61463e3521aa6d3d31bd7e953d38c6381c0e1b526dcb28c7f2786669eb6
SHA512c4e4080840991a829b05c76a55f6da6bffc9f618c7a1214d4d0b84e6e714d7b0e5646a99a5d92188f71801e6b7269069728f328d3a3b3fda577191372f399080
-
C:\Users\Admin\AppData\Local\Temp\5B7A.exeFilesize
385KB
MD5bdbfccc2b71c0d7f9de70aba81597b52
SHA1ebb97f2a7fe51ff607a1d1b7557c995dd1cc275a
SHA256082e8792e48e6ae0b16330f6bde833c42158ba2c9b75fad31ebc3d939f8a0042
SHA512fba755745e82b6acd1e74e15ce9bc729a9b0e85bbb1975959c1b5d7ab1e6859efc715de87c3f4b6ef4bb21a25d9246142e96323cfc5d732ae6007b4690dcd417
-
memory/1176-8-0x0000000002200000-0x0000000002216000-memory.dmpFilesize
88KB
-
memory/2216-2-0x00000000002B0000-0x00000000003B0000-memory.dmpFilesize
1024KB
-
memory/2216-4-0x00000000001B0000-0x00000000001B9000-memory.dmpFilesize
36KB
-
memory/2580-5-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2580-1-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2580-6-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2580-7-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2580-9-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2888-27-0x0000000000010000-0x0000000000076000-memory.dmpFilesize
408KB
-
memory/2888-30-0x0000000000010000-0x0000000000076000-memory.dmpFilesize
408KB