Overview
overview
10Static
static
315dbe47ffc...c2.exe
windows10-2004-x64
10259d304678...83.exe
windows10-2004-x64
102692caca2a...20.exe
windows10-2004-x64
1028a50ab6e2...10.exe
windows10-2004-x64
104c05a0a402...f4.exe
windows10-2004-x64
105a9aed6661...2d.exe
windows10-2004-x64
105f5fe0dfe7...ca.exe
windows10-2004-x64
106b5a910219...c6.exe
windows10-2004-x64
106d91ecfeed...9b.exe
windows7-x64
106d91ecfeed...9b.exe
windows10-2004-x64
106ffb586f67...d9.exe
windows10-2004-x64
1073c6d3d5d7...90.exe
windows10-2004-x64
1075b625c13b...07.exe
windows10-2004-x64
108a4cf22002...f5.exe
windows7-x64
108a4cf22002...f5.exe
windows10-2004-x64
10aa03da34a3...c3.exe
windows10-2004-x64
10c4259cbbbe...3b.exe
windows10-2004-x64
10c71d93f739...fb.exe
windows10-2004-x64
10c98c961b6f...67.exe
windows10-2004-x64
10d76ee17b4a...b8.exe
windows10-2004-x64
7ec3af3633a...54.exe
windows10-2004-x64
10fbb293bc8b...e5.exe
windows10-2004-x64
10Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 10:18
Static task
static1
Behavioral task
behavioral1
Sample
15dbe47ffc282036b5b74c9775a05b1985197b01705a5e5240936b02f6f8c2c2.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
259d304678a712b51f1187d33ecd946f12224f4900cad091b3a39900d04e9d83.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
2692caca2a880cb62bad959791f7e78945d5e600364901df7fc8de45a268a520.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
28a50ab6e2f0c1302196528ba89864cb218567116ae9f4a7ff25ad2517acf510.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
4c05a0a402e12dd4248772fa3577f38e1fc9b8b060c219cf8a4890bfce5439f4.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
5a9aed66614843df861e1716ffa1565f310d3f61f384e45ac0468be8b6bc162d.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
5f5fe0dfe7abbcda9826593f0816a3b72630e87a3d058a3382b48820dfc0f3ca.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
6b5a910219dbef3059255fe4700c0b661a248a20051c4624275c60fcb969a4c6.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
6d91ecfeedfc048e057ef390c0a9a12a14dd8dadc74b44e7d17e7d767fa6fb9b.exe
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral10
Sample
6d91ecfeedfc048e057ef390c0a9a12a14dd8dadc74b44e7d17e7d767fa6fb9b.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
6ffb586f674fda7588cfb5e9ebac49e43e607069c4c43597e624fc42ac70b8d9.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
73c6d3d5d789b4c1b22119cf829a0a27609d598ad9afb0d622c8abb66982bf90.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
75b625c13b24d7458adfc514723864292401468613eaedafdba252e90b3f5707.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
8a4cf2200249c16ad339a708d70a7a76427cc48fe52e324e22cb2b14c043a4f5.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral15
Sample
8a4cf2200249c16ad339a708d70a7a76427cc48fe52e324e22cb2b14c043a4f5.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
aa03da34a3df5ccd4a8378896e723e73365b3d7713664fcafe751f873108dcc3.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
c4259cbbbeecc45ba6b72e216489e0c0f668de9a18069a255c88f5440350243b.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
c71d93f73909af1aaed89e205cf18f3305701f5725a7f73bc47959ec2fe389fb.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
c98c961b6fafcd423b7f00c273b1de0344bce9a806fb75483a3ed9f8f686a467.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
d76ee17b4a6047aa98a5b0abc7a035b345706ef3087c8b527b238db6e24fdbb8.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
ec3af3633a52750aaf806f34de5b8fb483a77417b0a8182b5cd0f8fe892b0c54.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
fbb293bc8b089d284989e99bec9363092a97e4084b29e5eeb9d9ac35568bb7e5.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
General
-
Target
8a4cf2200249c16ad339a708d70a7a76427cc48fe52e324e22cb2b14c043a4f5.exe
-
Size
944KB
-
MD5
c6207a8cd7aab76783c2c6fd9be2a94d
-
SHA1
157b2a427951969ed6bd375451bd04d93d8f6ea1
-
SHA256
8a4cf2200249c16ad339a708d70a7a76427cc48fe52e324e22cb2b14c043a4f5
-
SHA512
a80609861bc0aa812f08ce6a06466fe54070a6da8fd8d349150ee5cc0a3d4b495b9c1122f90c4f84f31969791cfb28d8804d069a6da43199004e04e6f28197ce
-
SSDEEP
12288:ldsHXaWChEJ1kEEHM64Yz3cKIP+IkPVx4nQ0XyDF7uJk8gnboDIiJ:K2hEJdEHM64cmPFsL4nwDFkj06
Malware Config
Extracted
smokeloader
2022
http://194.49.94.210/fks/index.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2192 set thread context of 2864 2192 8a4cf2200249c16ad339a708d70a7a76427cc48fe52e324e22cb2b14c043a4f5.exe 29 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2864 AppLaunch.exe 2864 AppLaunch.exe 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found 1352 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2864 AppLaunch.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2192 wrote to memory of 2864 2192 8a4cf2200249c16ad339a708d70a7a76427cc48fe52e324e22cb2b14c043a4f5.exe 29 PID 2192 wrote to memory of 2864 2192 8a4cf2200249c16ad339a708d70a7a76427cc48fe52e324e22cb2b14c043a4f5.exe 29 PID 2192 wrote to memory of 2864 2192 8a4cf2200249c16ad339a708d70a7a76427cc48fe52e324e22cb2b14c043a4f5.exe 29 PID 2192 wrote to memory of 2864 2192 8a4cf2200249c16ad339a708d70a7a76427cc48fe52e324e22cb2b14c043a4f5.exe 29 PID 2192 wrote to memory of 2864 2192 8a4cf2200249c16ad339a708d70a7a76427cc48fe52e324e22cb2b14c043a4f5.exe 29 PID 2192 wrote to memory of 2864 2192 8a4cf2200249c16ad339a708d70a7a76427cc48fe52e324e22cb2b14c043a4f5.exe 29 PID 2192 wrote to memory of 2864 2192 8a4cf2200249c16ad339a708d70a7a76427cc48fe52e324e22cb2b14c043a4f5.exe 29 PID 2192 wrote to memory of 2864 2192 8a4cf2200249c16ad339a708d70a7a76427cc48fe52e324e22cb2b14c043a4f5.exe 29 PID 2192 wrote to memory of 2864 2192 8a4cf2200249c16ad339a708d70a7a76427cc48fe52e324e22cb2b14c043a4f5.exe 29 PID 2192 wrote to memory of 2864 2192 8a4cf2200249c16ad339a708d70a7a76427cc48fe52e324e22cb2b14c043a4f5.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a4cf2200249c16ad339a708d70a7a76427cc48fe52e324e22cb2b14c043a4f5.exe"C:\Users\Admin\AppData\Local\Temp\8a4cf2200249c16ad339a708d70a7a76427cc48fe52e324e22cb2b14c043a4f5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2864
-