Analysis
-
max time kernel
146s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09-05-2024 23:48
Static task
static1
Behavioral task
behavioral1
Sample
27587755ccfed117ac06952e6a9a33752b327a344fac395bb4c3141a069734b2.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
27587755ccfed117ac06952e6a9a33752b327a344fac395bb4c3141a069734b2.exe
Resource
win11-20240426-en
General
-
Target
27587755ccfed117ac06952e6a9a33752b327a344fac395bb4c3141a069734b2.exe
-
Size
211KB
-
MD5
57494a7b70db072a8539e7fb3171e873
-
SHA1
9c521ea54a1c099c32bea8d9912008fd998a7e73
-
SHA256
27587755ccfed117ac06952e6a9a33752b327a344fac395bb4c3141a069734b2
-
SHA512
8609f7f692f9ae9cec51e172ae3f3780a5c2731191c1b8f71cf4b3fb41d649cb892e66aeb610014cbfcc8c4e3b38f58d49f8a76c539c163479a4cd1306de1fef
-
SSDEEP
3072:G//IweqtWGLkaYCRwG5UfnDjoylmNLhO5Pe7nDY7Yi:dGLk5tvPUL9
Malware Config
Extracted
smokeloader
pub1
Extracted
smokeloader
2022
http://trad-einmyus.com/index.php
http://tradein-myus.com/index.php
http://trade-inmyus.com/index.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3336 -
Executes dropped EXE 1 IoCs
Processes:
jvetjacpid process 4500 jvetjac -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
27587755ccfed117ac06952e6a9a33752b327a344fac395bb4c3141a069734b2.exejvetjacdescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 27587755ccfed117ac06952e6a9a33752b327a344fac395bb4c3141a069734b2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 27587755ccfed117ac06952e6a9a33752b327a344fac395bb4c3141a069734b2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jvetjac Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jvetjac Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jvetjac Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 27587755ccfed117ac06952e6a9a33752b327a344fac395bb4c3141a069734b2.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
27587755ccfed117ac06952e6a9a33752b327a344fac395bb4c3141a069734b2.exepid process 1384 27587755ccfed117ac06952e6a9a33752b327a344fac395bb4c3141a069734b2.exe 1384 27587755ccfed117ac06952e6a9a33752b327a344fac395bb4c3141a069734b2.exe 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 3336 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
27587755ccfed117ac06952e6a9a33752b327a344fac395bb4c3141a069734b2.exejvetjacpid process 1384 27587755ccfed117ac06952e6a9a33752b327a344fac395bb4c3141a069734b2.exe 4500 jvetjac -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 3336 Token: SeCreatePagefilePrivilege 3336 -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
cmd.execmd.exedescription pid process target process PID 3336 wrote to memory of 3376 3336 cmd.exe PID 3336 wrote to memory of 3376 3336 cmd.exe PID 3376 wrote to memory of 2344 3376 cmd.exe reg.exe PID 3376 wrote to memory of 2344 3376 cmd.exe reg.exe PID 3336 wrote to memory of 1844 3336 cmd.exe PID 3336 wrote to memory of 1844 3336 cmd.exe PID 1844 wrote to memory of 4648 1844 cmd.exe reg.exe PID 1844 wrote to memory of 4648 1844 cmd.exe reg.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\27587755ccfed117ac06952e6a9a33752b327a344fac395bb4c3141a069734b2.exe"C:\Users\Admin\AppData\Local\Temp\27587755ccfed117ac06952e6a9a33752b327a344fac395bb4c3141a069734b2.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:81⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\F3D1.bat" "1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\798.bat" "1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 12⤵
-
C:\Users\Admin\AppData\Roaming\jvetjacC:\Users\Admin\AppData\Roaming\jvetjac1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\F3D1.batFilesize
77B
MD555cc761bf3429324e5a0095cab002113
SHA12cc1ef4542a4e92d4158ab3978425d517fafd16d
SHA256d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a
SHA51233f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155
-
C:\Users\Admin\AppData\Roaming\jvetjacFilesize
211KB
MD557494a7b70db072a8539e7fb3171e873
SHA19c521ea54a1c099c32bea8d9912008fd998a7e73
SHA25627587755ccfed117ac06952e6a9a33752b327a344fac395bb4c3141a069734b2
SHA5128609f7f692f9ae9cec51e172ae3f3780a5c2731191c1b8f71cf4b3fb41d649cb892e66aeb610014cbfcc8c4e3b38f58d49f8a76c539c163479a4cd1306de1fef
-
memory/1384-4-0x0000000000400000-0x0000000002AF2000-memory.dmpFilesize
38.9MB
-
memory/1384-1-0x0000000002CD0000-0x0000000002DD0000-memory.dmpFilesize
1024KB
-
memory/1384-10-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1384-9-0x0000000002B80000-0x0000000002B8B000-memory.dmpFilesize
44KB
-
memory/1384-6-0x0000000000400000-0x0000000002AF2000-memory.dmpFilesize
38.9MB
-
memory/1384-3-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1384-2-0x0000000002B80000-0x0000000002B8B000-memory.dmpFilesize
44KB
-
memory/3336-5-0x0000000002E00000-0x0000000002E16000-memory.dmpFilesize
88KB
-
memory/3336-26-0x0000000003270000-0x0000000003286000-memory.dmpFilesize
88KB
-
memory/4500-25-0x0000000000400000-0x0000000002AF2000-memory.dmpFilesize
38.9MB
-
memory/4500-27-0x0000000000400000-0x0000000002AF2000-memory.dmpFilesize
38.9MB