Overview
overview
10Static
static
30bd57c625c...1b.exe
windows10-2004-x64
100e85c02906...31.exe
windows10-2004-x64
101ad22f7c20...da.exe
windows10-2004-x64
102f0934382a...84.exe
windows7-x64
102f0934382a...84.exe
windows10-2004-x64
10421c712a06...0d.exe
windows10-2004-x64
104958361c2a...c0.exe
windows10-2004-x64
104ee34ec273...69.exe
windows10-2004-x64
1054ae781e47...0d.exe
windows10-2004-x64
10597fd86cf2...51.exe
windows10-2004-x64
105af8e5b632...c7.exe
windows10-2004-x64
105edd2b7f66...17.exe
windows10-2004-x64
105eee268a87...c9.exe
windows10-2004-x64
1065a4c04d9e...25.exe
windows10-2004-x64
106d2e6d5049...21.exe
windows10-2004-x64
1077dcf40927...b4.exe
windows10-2004-x64
108c279e4e62...12.exe
windows10-2004-x64
108ee3fa55ce...d5.exe
windows10-2004-x64
108efb2f072c...7a.exe
windows10-2004-x64
10a717651d7f...a0.exe
windows10-2004-x64
10cecc5213e2...a1.exe
windows10-2004-x64
10Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 19:03
Static task
static1
Behavioral task
behavioral1
Sample
0bd57c625c8696f13dca81e807695648802ac535fabc2f383ee13c655c34c21b.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
0e85c029067c6b16235fdcf9b3b93f0b3aef80462a8991420b61166786a76d31.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
1ad22f7c20ecd9c3f25fef51c4432f8d6609d2a5f951e6a29ab4a3a9b7d2ebda.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
2f0934382aee1d9b657ffa98a2699fe864ed0a5bf8e1fc03bdcd479244e27b84.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral5
Sample
2f0934382aee1d9b657ffa98a2699fe864ed0a5bf8e1fc03bdcd479244e27b84.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
421c712a06e641733de7dc086abdc66469eef71d8cf926aa756f0f6910cd6a0d.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
4958361c2a42ff04e4d71bc10a59d5ce9b6fae6d86deb588a01b229caeadf1c0.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
4ee34ec273a7f43b89678eff087bf31e1b510415dcbb3ef6c8fcf0c06f036669.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
54ae781e479d4e60bdd8734270b33ab0db93c1543e6f477a3dcc2c93b42f7e0d.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
597fd86cf22402c976ac13f554867cf010ab3d5c9bdcf8d817c66e620dce4751.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
5af8e5b632a39ba2220e0edd14997e390e73614f2bbcd55986f62325da0e16c7.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
5edd2b7f663bf0a7b691bb6245a12b15994b2b4ad9c92c369111de2c68731917.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
5eee268a879c07625d7394a82b7c1c9212c1bd08e2f22fd5b294cc02b2f31cc9.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
65a4c04d9eef0d0db884e244647345959a2f576dab0d856bc052140c13b17025.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
6d2e6d5049e4da686813824edc4aa0a843fff13079a0a9399739fe64efcfd021.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
77dcf409276e0e91ce08daea19f8477d18c5dba52a0ecbb55c40bc98744973b4.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
8c279e4e627a1cf50482f625b1ee518eae0ac11a42f443c27e6f6ee04c180212.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
8ee3fa55ceed18988822ea9dd7e193a1c7e306b0010f172aee42ec3ddd3b2cd5.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
8efb2f072c814649d82dcf129f78158d28b7ec827dd8deeccf8e21e23771ae7a.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
a717651d7fa6766bf2853b11671e7a5465fd6b8d88661bb92df08a819e765da0.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
cecc5213e25a8a2dfe40b0f517d513ce319f2cdf28bcc26df3130a53a46d79a1.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
General
-
Target
2f0934382aee1d9b657ffa98a2699fe864ed0a5bf8e1fc03bdcd479244e27b84.exe
-
Size
269KB
-
MD5
ac88a92b64ce3501e09fb1871eb76dc9
-
SHA1
539a8f7a674aba1fa8c4022bdb5210c9d2ce37a3
-
SHA256
2f0934382aee1d9b657ffa98a2699fe864ed0a5bf8e1fc03bdcd479244e27b84
-
SHA512
fc328382e8b544a43c404d2824784609322b1e2f2b84e5bce58c572793c4fb040d82632ab89527c816e4feb170025bf3cf59d904a85c378e11d6751abe4a599a
-
SSDEEP
6144:a6SctlMQMY6Vo++E0R6gFAOwIOYIL+g35:a65tiQMYlXuIE35
Malware Config
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1968 set thread context of 1988 1968 2f0934382aee1d9b657ffa98a2699fe864ed0a5bf8e1fc03bdcd479244e27b84.exe 28 -
Program crash 1 IoCs
pid pid_target Process procid_target 2752 1968 WerFault.exe 27 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1988 AppLaunch.exe 1988 AppLaunch.exe 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1988 AppLaunch.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1968 wrote to memory of 1988 1968 2f0934382aee1d9b657ffa98a2699fe864ed0a5bf8e1fc03bdcd479244e27b84.exe 28 PID 1968 wrote to memory of 1988 1968 2f0934382aee1d9b657ffa98a2699fe864ed0a5bf8e1fc03bdcd479244e27b84.exe 28 PID 1968 wrote to memory of 1988 1968 2f0934382aee1d9b657ffa98a2699fe864ed0a5bf8e1fc03bdcd479244e27b84.exe 28 PID 1968 wrote to memory of 1988 1968 2f0934382aee1d9b657ffa98a2699fe864ed0a5bf8e1fc03bdcd479244e27b84.exe 28 PID 1968 wrote to memory of 1988 1968 2f0934382aee1d9b657ffa98a2699fe864ed0a5bf8e1fc03bdcd479244e27b84.exe 28 PID 1968 wrote to memory of 1988 1968 2f0934382aee1d9b657ffa98a2699fe864ed0a5bf8e1fc03bdcd479244e27b84.exe 28 PID 1968 wrote to memory of 1988 1968 2f0934382aee1d9b657ffa98a2699fe864ed0a5bf8e1fc03bdcd479244e27b84.exe 28 PID 1968 wrote to memory of 1988 1968 2f0934382aee1d9b657ffa98a2699fe864ed0a5bf8e1fc03bdcd479244e27b84.exe 28 PID 1968 wrote to memory of 1988 1968 2f0934382aee1d9b657ffa98a2699fe864ed0a5bf8e1fc03bdcd479244e27b84.exe 28 PID 1968 wrote to memory of 1988 1968 2f0934382aee1d9b657ffa98a2699fe864ed0a5bf8e1fc03bdcd479244e27b84.exe 28 PID 1968 wrote to memory of 2752 1968 2f0934382aee1d9b657ffa98a2699fe864ed0a5bf8e1fc03bdcd479244e27b84.exe 29 PID 1968 wrote to memory of 2752 1968 2f0934382aee1d9b657ffa98a2699fe864ed0a5bf8e1fc03bdcd479244e27b84.exe 29 PID 1968 wrote to memory of 2752 1968 2f0934382aee1d9b657ffa98a2699fe864ed0a5bf8e1fc03bdcd479244e27b84.exe 29 PID 1968 wrote to memory of 2752 1968 2f0934382aee1d9b657ffa98a2699fe864ed0a5bf8e1fc03bdcd479244e27b84.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f0934382aee1d9b657ffa98a2699fe864ed0a5bf8e1fc03bdcd479244e27b84.exe"C:\Users\Admin\AppData\Local\Temp\2f0934382aee1d9b657ffa98a2699fe864ed0a5bf8e1fc03bdcd479244e27b84.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1988
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 922⤵
- Program crash
PID:2752
-