Overview
overview
10Static
static
31b7cbee30e...8d.exe
windows10-2004-x64
101cb2277eea...2a.exe
windows10-2004-x64
1026dae86d00...a2.exe
windows10-2004-x64
1035cd974b16...ec.exe
windows10-2004-x64
1045e7028a78...91.exe
windows10-2004-x64
104cd2f124df...48.exe
windows10-2004-x64
105fdef2b38d...0a.exe
windows10-2004-x64
107284e9e031...c7.exe
windows10-2004-x64
10781c022afd...54.exe
windows10-2004-x64
1084163f9b0d...a5.exe
windows10-2004-x64
1090251e43cd...e4.exe
windows10-2004-x64
109a3023ff33...37.exe
windows10-2004-x64
10b4b999d8f3...50.exe
windows7-x64
10b4b999d8f3...50.exe
windows10-2004-x64
10bdd93956fe...8b.exe
windows10-2004-x64
10cf840721c0...70.exe
windows10-2004-x64
10e52fb58b8a...f1.exe
windows10-2004-x64
10ecfbac56ff...9e.exe
windows10-2004-x64
10f0f492b9b0...9a.exe
windows10-2004-x64
10f921df4c23...0d.exe
windows10-2004-x64
10Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 18:55
Static task
static1
Behavioral task
behavioral1
Sample
1b7cbee30e4459916b5b164befe5e20b7a876df411fdb5d2d2cd7c073a28b18d.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
1cb2277eead0aab1238acbbff542f7d6307542e95025dda95856efeb7bc12a2a.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
26dae86d0011ac84e93abfd2169b28a6dee3498b8be9c3b84f657506d4e2a9a2.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
35cd974b16f79c47cbb0de20c8a1ff5494093da28e9909d73df1cc40bc1e6dec.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
45e7028a78d903a8ece02b9d51f82b76972b2b5e64db0bc12aa6cb69f53a2291.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
4cd2f124dfaf247a46d235c0823069c1056a2efb67c0f74547fb75dcfb603748.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
5fdef2b38d6a927d590cbceb6a8c3f4e278c41ce01d872925603603cd7d0bc0a.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
7284e9e031d95f98bb1c673f3691adb26e5acc31e6d2c745b85bc97fc82edec7.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
781c022afdd03ecc97a7195986c14b7a81fc5a02d1b0e8c7561a1a1ff3406754.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
84163f9b0d959067de44eac4cb117f34b55119476a35c8291d0be25585618ea5.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
90251e43cdd68d8c070a8180eb78fdfc113d4e2ff40733af3a3332c51744eae4.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
9a3023ff334b34f4bea043eedeced95c41485b4799d3c2d56c0cb04b60143937.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
b4b999d8f3fb923a4d4cd17b173ba8474c698443430fdc63b8da6ad6eae57d50.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
b4b999d8f3fb923a4d4cd17b173ba8474c698443430fdc63b8da6ad6eae57d50.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
bdd93956feba699c1eac73030a5ce8e55ae51fab4852062d8e46e8ed460a2b8b.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
cf840721c08fa286313bd7ac68fc5bac88559652036dfbdcc7b3c6f0cfa13d70.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
e52fb58b8a7d4f8b7eea558e3f50385d34e76f92baeede9698343046ba3273f1.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
ecfbac56ff2c59238da4332d5cd1561d05a08ac0d65b57b9caf329f063fc939e.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
f0f492b9b0439f9df9e575d91555b387484582434a05ee11e543b6cd24ed979a.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
f921df4c23777a797ffd956196cd2ea4805eaf3eefcc839de781c7e6af836f0d.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
General
-
Target
b4b999d8f3fb923a4d4cd17b173ba8474c698443430fdc63b8da6ad6eae57d50.exe
-
Size
269KB
-
MD5
c019e19af0d4a7b3c4c51f45c50c7d9f
-
SHA1
ea0f9c0365bbc8aa19f43556c5552657d218af8c
-
SHA256
b4b999d8f3fb923a4d4cd17b173ba8474c698443430fdc63b8da6ad6eae57d50
-
SHA512
eb6ee1e040b6b593d60d5f4cacfdbd7db65977789a3035ab1640afd9aa2f2be055137289100f91a8e2b85156124b157ef5d4435bae4d9893c24277542699494d
-
SSDEEP
3072:VjT/e0ctZI6461YHBe6Itf1/iTY6ce6pn++RcNLkBHgDK6gpRnUuEeAg0FujD7zO:VjxctlMQMY6Vo++E0R6gFAOfLh6zd35
Malware Config
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1760 set thread context of 2604 1760 b4b999d8f3fb923a4d4cd17b173ba8474c698443430fdc63b8da6ad6eae57d50.exe 28 -
Program crash 1 IoCs
pid pid_target Process procid_target 3024 1760 WerFault.exe 27 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2604 AppLaunch.exe 2604 AppLaunch.exe 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2604 AppLaunch.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1760 wrote to memory of 2604 1760 b4b999d8f3fb923a4d4cd17b173ba8474c698443430fdc63b8da6ad6eae57d50.exe 28 PID 1760 wrote to memory of 2604 1760 b4b999d8f3fb923a4d4cd17b173ba8474c698443430fdc63b8da6ad6eae57d50.exe 28 PID 1760 wrote to memory of 2604 1760 b4b999d8f3fb923a4d4cd17b173ba8474c698443430fdc63b8da6ad6eae57d50.exe 28 PID 1760 wrote to memory of 2604 1760 b4b999d8f3fb923a4d4cd17b173ba8474c698443430fdc63b8da6ad6eae57d50.exe 28 PID 1760 wrote to memory of 2604 1760 b4b999d8f3fb923a4d4cd17b173ba8474c698443430fdc63b8da6ad6eae57d50.exe 28 PID 1760 wrote to memory of 2604 1760 b4b999d8f3fb923a4d4cd17b173ba8474c698443430fdc63b8da6ad6eae57d50.exe 28 PID 1760 wrote to memory of 2604 1760 b4b999d8f3fb923a4d4cd17b173ba8474c698443430fdc63b8da6ad6eae57d50.exe 28 PID 1760 wrote to memory of 2604 1760 b4b999d8f3fb923a4d4cd17b173ba8474c698443430fdc63b8da6ad6eae57d50.exe 28 PID 1760 wrote to memory of 2604 1760 b4b999d8f3fb923a4d4cd17b173ba8474c698443430fdc63b8da6ad6eae57d50.exe 28 PID 1760 wrote to memory of 2604 1760 b4b999d8f3fb923a4d4cd17b173ba8474c698443430fdc63b8da6ad6eae57d50.exe 28 PID 1760 wrote to memory of 3024 1760 b4b999d8f3fb923a4d4cd17b173ba8474c698443430fdc63b8da6ad6eae57d50.exe 29 PID 1760 wrote to memory of 3024 1760 b4b999d8f3fb923a4d4cd17b173ba8474c698443430fdc63b8da6ad6eae57d50.exe 29 PID 1760 wrote to memory of 3024 1760 b4b999d8f3fb923a4d4cd17b173ba8474c698443430fdc63b8da6ad6eae57d50.exe 29 PID 1760 wrote to memory of 3024 1760 b4b999d8f3fb923a4d4cd17b173ba8474c698443430fdc63b8da6ad6eae57d50.exe 29 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4b999d8f3fb923a4d4cd17b173ba8474c698443430fdc63b8da6ad6eae57d50.exe"C:\Users\Admin\AppData\Local\Temp\b4b999d8f3fb923a4d4cd17b173ba8474c698443430fdc63b8da6ad6eae57d50.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2604
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 922⤵
- Program crash
PID:3024
-