Overview
overview
10Static
static
3169827445a...fd.exe
windows10-2004-x64
102c5911fd0a...9f.exe
windows10-2004-x64
103d26ff1c7f...6f.exe
windows10-2004-x64
104316c9cb7f...d5.exe
windows10-2004-x64
10453554affb...f6.exe
windows10-2004-x64
104be48036db...87.exe
windows10-2004-x64
106843058b07...7b.exe
windows10-2004-x64
106ab7739b7f...d6.exe
windows10-2004-x64
10741b5d1728...11.exe
windows10-2004-x64
107dbaeca4ac...3f.exe
windows7-x64
107dbaeca4ac...3f.exe
windows10-2004-x64
10889f2baa64...76.exe
windows10-2004-x64
1092288ddafe...85.exe
windows10-2004-x64
109697ffb24d...50.exe
windows10-2004-x64
10abd0fa453e...b8.exe
windows10-2004-x64
10b28f0b1322...38.exe
windows10-2004-x64
10d89a055085...df.exe
windows10-2004-x64
10db77a8c068...dc.exe
windows7-x64
10db77a8c068...dc.exe
windows10-2004-x64
10e00e311d45...53.exe
windows10-2004-x64
10e0990290e3...28.exe
windows10-2004-x64
10fedbb32d49...4c.exe
windows10-2004-x64
10Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 10:02
Static task
static1
Behavioral task
behavioral1
Sample
169827445a78f6e1cde6f851fe18dbe8b5850a2768cb303f453ceaacfe59d6fd.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
2c5911fd0a616aa00118b87a5216b4c3312dd590b4988b62bf0651b91fc5b29f.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
3d26ff1c7f2a98b2c2c03ddc43bd17ad629931d425986a46cb7ba3ef54b1ba6f.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
4316c9cb7f9e1a073313300df45a90e9457dec01ec27e4f7c9725091247276d5.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
453554affb4477ef1397310265a6a90ae0953e5bca58d9b7b98e7323e7cccdf6.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
4be48036db804507d4009d7d5ef56ad2feeb011ce624c73eef68521a4acf1687.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
6843058b079dbc0a22ff6542bd36408373534e51519828b2e5059a1c3a0a837b.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
6ab7739b7f0b5cc84bf55cd6f09beb3d4860ec6428202c54e8e023161020c8d6.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
741b5d17281b7e19ee8dd529a91b547c0bdf8938c84539f745ec882d49373311.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
7dbaeca4ac219449e315df2bb20e786dfc5c304cb5d522d6e15619a91276ba3f.exe
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral11
Sample
7dbaeca4ac219449e315df2bb20e786dfc5c304cb5d522d6e15619a91276ba3f.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
889f2baa640211bf12947cfab6157ff93a774d0b4ed9568df0eb65952cedf576.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
92288ddafeaa0f77357b90005f63961458788f6cd7af44be378bd1de6a725c85.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
9697ffb24dfe38f4a40e3cf91464543c6f5a47170c56b58a949e1a93ab9df050.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
abd0fa453ed59d06e5c3d6cbafe873f404a47cab8f3c4bcd545fdfa7491ff4b8.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
b28f0b13221fc5aaa297029cc7c28a22c5b5dfe8aa6626036342ae0b862d8838.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
d89a0550853b7067190a4816c540a6838fc7703bf9df0665fc491c92feb72adf.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
db77a8c0688fc65498578d6fb53ea4154ece1d8d958e3b911f81835c8aa908dc.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral19
Sample
db77a8c0688fc65498578d6fb53ea4154ece1d8d958e3b911f81835c8aa908dc.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
e00e311d4566f8b67392f945545d0e1ea579af2fa76c416042196eea3ca75753.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
e0990290e38dc94b3c6a8bd8d028c230706f11717bdc17beb40d9a73dcfb2628.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
General
-
Target
db77a8c0688fc65498578d6fb53ea4154ece1d8d958e3b911f81835c8aa908dc.exe
-
Size
269KB
-
MD5
7ec5ca4d34f4e800463edf4efb264e9f
-
SHA1
ff0a96b1b3e5f28a9fd9a288c5f6f65e1b1f26fa
-
SHA256
db77a8c0688fc65498578d6fb53ea4154ece1d8d958e3b911f81835c8aa908dc
-
SHA512
419570d3ff5e58ef4d2fceaeb9ea2135d5b6e9835cc74bdedd0e9690fe7f5182db53fd5a0aad174ad2a8dd7a3a8bbd83e925fdae522cff8b89977818a04eab3d
-
SSDEEP
3072:bQTHC0ctZI6461YHBe6Itf1/iTY6ce6pn++RcNLkBHgDK6gpRnUuEeAg0FujDFzP:bQFctlMQMY6Vo++E0R6gFAOp9Z+g35
Malware Config
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2804 set thread context of 2036 2804 db77a8c0688fc65498578d6fb53ea4154ece1d8d958e3b911f81835c8aa908dc.exe 28 -
Program crash 1 IoCs
pid pid_target Process procid_target 2216 2804 WerFault.exe 27 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2036 AppLaunch.exe 2036 AppLaunch.exe 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found 1396 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2036 AppLaunch.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2804 wrote to memory of 2036 2804 db77a8c0688fc65498578d6fb53ea4154ece1d8d958e3b911f81835c8aa908dc.exe 28 PID 2804 wrote to memory of 2036 2804 db77a8c0688fc65498578d6fb53ea4154ece1d8d958e3b911f81835c8aa908dc.exe 28 PID 2804 wrote to memory of 2036 2804 db77a8c0688fc65498578d6fb53ea4154ece1d8d958e3b911f81835c8aa908dc.exe 28 PID 2804 wrote to memory of 2036 2804 db77a8c0688fc65498578d6fb53ea4154ece1d8d958e3b911f81835c8aa908dc.exe 28 PID 2804 wrote to memory of 2036 2804 db77a8c0688fc65498578d6fb53ea4154ece1d8d958e3b911f81835c8aa908dc.exe 28 PID 2804 wrote to memory of 2036 2804 db77a8c0688fc65498578d6fb53ea4154ece1d8d958e3b911f81835c8aa908dc.exe 28 PID 2804 wrote to memory of 2036 2804 db77a8c0688fc65498578d6fb53ea4154ece1d8d958e3b911f81835c8aa908dc.exe 28 PID 2804 wrote to memory of 2036 2804 db77a8c0688fc65498578d6fb53ea4154ece1d8d958e3b911f81835c8aa908dc.exe 28 PID 2804 wrote to memory of 2036 2804 db77a8c0688fc65498578d6fb53ea4154ece1d8d958e3b911f81835c8aa908dc.exe 28 PID 2804 wrote to memory of 2036 2804 db77a8c0688fc65498578d6fb53ea4154ece1d8d958e3b911f81835c8aa908dc.exe 28 PID 2804 wrote to memory of 2216 2804 db77a8c0688fc65498578d6fb53ea4154ece1d8d958e3b911f81835c8aa908dc.exe 29 PID 2804 wrote to memory of 2216 2804 db77a8c0688fc65498578d6fb53ea4154ece1d8d958e3b911f81835c8aa908dc.exe 29 PID 2804 wrote to memory of 2216 2804 db77a8c0688fc65498578d6fb53ea4154ece1d8d958e3b911f81835c8aa908dc.exe 29 PID 2804 wrote to memory of 2216 2804 db77a8c0688fc65498578d6fb53ea4154ece1d8d958e3b911f81835c8aa908dc.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\db77a8c0688fc65498578d6fb53ea4154ece1d8d958e3b911f81835c8aa908dc.exe"C:\Users\Admin\AppData\Local\Temp\db77a8c0688fc65498578d6fb53ea4154ece1d8d958e3b911f81835c8aa908dc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2036
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 922⤵
- Program crash
PID:2216
-