Analysis
-
max time kernel
242s -
max time network
244s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
16-05-2024 23:47
Static task
static1
Behavioral task
behavioral1
Sample
a215b76c38d79ec3764923d2f17a5ccd06ac6741de5d2c0183fead43836db210.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
a215b76c38d79ec3764923d2f17a5ccd06ac6741de5d2c0183fead43836db210.exe
Resource
win10-20240404-en
General
-
Target
a215b76c38d79ec3764923d2f17a5ccd06ac6741de5d2c0183fead43836db210.exe
-
Size
226KB
-
MD5
dcfd9f02149a657f70ed4e58f5c71d74
-
SHA1
93140ba9a84c78ee3a4aece21c0d832e334efb2a
-
SHA256
a215b76c38d79ec3764923d2f17a5ccd06ac6741de5d2c0183fead43836db210
-
SHA512
5d9ba4c29bb1cdcd68acb82bf053804a5f07a6dbaa000fd82577b283823467324316c53d5be61c8e2ca4b0d67b98d249e7c36d67da94fa36e4e2265e4386003d
-
SSDEEP
3072:yvqVLdfvUMPQmPX5j8m+5BsanVkM3An8O0kmlxGzzdiLfhGFpX7BkDyGQ:f9QmPpomnJMwC3A0s/XO
Malware Config
Extracted
smokeloader
pub1
Extracted
smokeloader
2022
http://trad-einmyus.com/index.php
http://tradein-myus.com/index.php
http://trade-inmyus.com/index.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Deletes itself 1 IoCs
Processes:
pid process 1352 -
Executes dropped EXE 2 IoCs
Processes:
hwfaieb7ED.exepid process 960 hwfaieb 1092 7ED.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
hwfaieba215b76c38d79ec3764923d2f17a5ccd06ac6741de5d2c0183fead43836db210.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hwfaieb Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a215b76c38d79ec3764923d2f17a5ccd06ac6741de5d2c0183fead43836db210.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a215b76c38d79ec3764923d2f17a5ccd06ac6741de5d2c0183fead43836db210.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a215b76c38d79ec3764923d2f17a5ccd06ac6741de5d2c0183fead43836db210.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hwfaieb Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hwfaieb -
Modifies registry class 5 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a215b76c38d79ec3764923d2f17a5ccd06ac6741de5d2c0183fead43836db210.exepid process 2372 a215b76c38d79ec3764923d2f17a5ccd06ac6741de5d2c0183fead43836db210.exe 2372 a215b76c38d79ec3764923d2f17a5ccd06ac6741de5d2c0183fead43836db210.exe 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 1352 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 1656 explorer.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
a215b76c38d79ec3764923d2f17a5ccd06ac6741de5d2c0183fead43836db210.exehwfaiebpid process 2372 a215b76c38d79ec3764923d2f17a5ccd06ac6741de5d2c0183fead43836db210.exe 960 hwfaieb -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
explorer.exedescription pid process Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
Processes:
explorer.exepid process 1352 1352 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe -
Suspicious use of SendNotifyMessage 22 IoCs
Processes:
explorer.exepid process 1352 1352 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
cmd.execmd.exetaskeng.exeexplorer.exedescription pid process target process PID 1352 wrote to memory of 2656 1352 cmd.exe PID 1352 wrote to memory of 2656 1352 cmd.exe PID 1352 wrote to memory of 2656 1352 cmd.exe PID 2656 wrote to memory of 2600 2656 cmd.exe reg.exe PID 2656 wrote to memory of 2600 2656 cmd.exe reg.exe PID 2656 wrote to memory of 2600 2656 cmd.exe reg.exe PID 1352 wrote to memory of 804 1352 cmd.exe PID 1352 wrote to memory of 804 1352 cmd.exe PID 1352 wrote to memory of 804 1352 cmd.exe PID 804 wrote to memory of 1920 804 cmd.exe reg.exe PID 804 wrote to memory of 1920 804 cmd.exe reg.exe PID 804 wrote to memory of 1920 804 cmd.exe reg.exe PID 1104 wrote to memory of 960 1104 taskeng.exe hwfaieb PID 1104 wrote to memory of 960 1104 taskeng.exe hwfaieb PID 1104 wrote to memory of 960 1104 taskeng.exe hwfaieb PID 1104 wrote to memory of 960 1104 taskeng.exe hwfaieb PID 1656 wrote to memory of 1092 1656 explorer.exe 7ED.exe PID 1656 wrote to memory of 1092 1656 explorer.exe 7ED.exe PID 1656 wrote to memory of 1092 1656 explorer.exe 7ED.exe PID 1656 wrote to memory of 1092 1656 explorer.exe 7ED.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a215b76c38d79ec3764923d2f17a5ccd06ac6741de5d2c0183fead43836db210.exe"C:\Users\Admin\AppData\Local\Temp\a215b76c38d79ec3764923d2f17a5ccd06ac6741de5d2c0183fead43836db210.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\5CEF.bat" "1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 12⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\6C5B.bat" "1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 12⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ED.exeC:\Users\Admin\AppData\Local\Temp\7ED.exe2⤵
- Executes dropped EXE
-
C:\Windows\system32\taskeng.exetaskeng.exe {2EA67CCB-CDD3-44D7-83CD-CB0F6CA52B7E} S-1-5-21-3627615824-4061627003-3019543961-1000:SCFGBRBT\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\hwfaiebC:\Users\Admin\AppData\Roaming\hwfaieb2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeexplorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\5CEF.batFilesize
77B
MD555cc761bf3429324e5a0095cab002113
SHA12cc1ef4542a4e92d4158ab3978425d517fafd16d
SHA256d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a
SHA51233f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155
-
C:\Users\Admin\AppData\Local\Temp\7ED.exeFilesize
315KB
MD5af968e0f2d75d8d4a464945ad5d86c9a
SHA16d2443b5b0121eb6c31367f6fafe340522be3a09
SHA256744d4ef48ab5a84c8daf5a65b63be366bc18bd3662ba54c5e4184a8ad1bb4f46
SHA512a9d9ad8462e18adfd7aa109dc66a01d99d82d925839936c6203cdbd820a4ab9422bed2b82acbedf49f9a4ffe752f2f2362c8a8e058ab9e4cc10bb01cdeb4bcdd
-
C:\Users\Admin\AppData\Roaming\hwfaiebFilesize
226KB
MD5dcfd9f02149a657f70ed4e58f5c71d74
SHA193140ba9a84c78ee3a4aece21c0d832e334efb2a
SHA256a215b76c38d79ec3764923d2f17a5ccd06ac6741de5d2c0183fead43836db210
SHA5125d9ba4c29bb1cdcd68acb82bf053804a5f07a6dbaa000fd82577b283823467324316c53d5be61c8e2ca4b0d67b98d249e7c36d67da94fa36e4e2265e4386003d
-
memory/960-55-0x0000000000400000-0x000000000078F000-memory.dmpFilesize
3.6MB
-
memory/1092-65-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/1352-4-0x0000000002EC0000-0x0000000002ED6000-memory.dmpFilesize
88KB
-
memory/1352-47-0x0000000002EA0000-0x0000000002EA1000-memory.dmpFilesize
4KB
-
memory/1656-54-0x0000000002620000-0x0000000002636000-memory.dmpFilesize
88KB
-
memory/1656-66-0x0000000004170000-0x0000000004180000-memory.dmpFilesize
64KB
-
memory/2372-8-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2372-5-0x0000000000400000-0x000000000078F000-memory.dmpFilesize
3.6MB
-
memory/2372-2-0x0000000000220000-0x000000000022B000-memory.dmpFilesize
44KB
-
memory/2372-1-0x0000000000830000-0x0000000000930000-memory.dmpFilesize
1024KB
-
memory/2372-3-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB