Overview
overview
10Static
static
1008751be484...2d.dll
windows7-x64
1008751be484...2d.dll
windows10-2004-x64
100a9f79abd4...51.exe
windows7-x64
30a9f79abd4...51.exe
windows10-2004-x64
31.bin/1.exe
windows7-x64
101.bin/1.exe
windows10-2004-x64
102019-09-02...10.exe
windows7-x64
102019-09-02...10.exe
windows10-2004-x64
102b5e50bc30...ba.dll
windows7-x64
102b5e50bc30...ba.dll
windows10-2004-x64
102c01b00772...eb.exe
windows7-x64
92c01b00772...eb.exe
windows10-2004-x64
931.exe
windows7-x64
1031.exe
windows10-2004-x64
103DMark 11 ...on.exe
windows7-x64
13DMark 11 ...on.exe
windows10-2004-x64
142f9729255...61.exe
windows7-x64
1042f9729255...61.exe
windows10-2004-x64
1042f9729255...1).exe
windows7-x64
1042f9729255...1).exe
windows10-2004-x64
105da0116af4...18.exe
windows7-x64
75da0116af4...18.exe
windows10-2004-x64
1069c56d12ed...6b.exe
windows7-x64
1069c56d12ed...6b.exe
windows10-2004-x64
106a9e7107c9...91.exe
windows7-x64
106a9e7107c9...91.exe
windows10-2004-x64
10905d572f23...50.exe
windows7-x64
10905d572f23...50.exe
windows10-2004-x64
10948340be97...54.exe
windows7-x64
10948340be97...54.exe
windows10-2004-x64
1095560f1a46...f9.dll
windows7-x64
195560f1a46...f9.dll
windows10-2004-x64
1Resubmissions
03-07-2024 16:04
240703-thygmaycpc 1001-07-2024 18:12
240701-ws6xvswbkj 1001-07-2024 18:03
240701-wm5sls1gka 1001-07-2024 18:03
240701-wm39sa1gjf 1001-07-2024 18:03
240701-wm2e7avhkj 1001-07-2024 18:03
240701-wmzxcs1fre 1001-07-2024 18:02
240701-wmzats1frc 1001-07-2024 18:02
240701-wmvbwa1fqh 1022-11-2023 17:02
231122-vkac9adg64 10Analysis
-
max time kernel
141s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 18:02
Static task
static1
Behavioral task
behavioral1
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
1.bin/1.exe
Resource
win7-20240419-en
Behavioral task
behavioral6
Sample
1.bin/1.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
2019-09-02_22-41-10.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
2019-09-02_22-41-10.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba.dll
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win7-20240611-en
Behavioral task
behavioral12
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
31.exe
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
31.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
3DMark 11 Advanced Edition.exe
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
42f972925508a82236e8533567487761.exe
Resource
win7-20240611-en
Behavioral task
behavioral18
Sample
42f972925508a82236e8533567487761.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
42f972925508a82236e8533567487761(1).exe
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
42f972925508a82236e8533567487761(1).exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win7-20240611-en
Behavioral task
behavioral24
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
6a9e7107c97762eb1196a64baeadb291.exe
Resource
win7-20240611-en
Behavioral task
behavioral26
Sample
6a9e7107c97762eb1196a64baeadb291.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win7-20231129-en
Behavioral task
behavioral28
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral31
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win7-20240419-en
Behavioral task
behavioral32
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win10v2004-20240508-en
General
-
Target
2019-09-02_22-41-10.exe
-
Size
251KB
-
MD5
924aa6c26f6f43e0893a40728eac3b32
-
SHA1
baa9b4c895b09d315ed747b3bd087f4583aa84fc
-
SHA256
30f9db1f5838abb6c1580fdfb7f5dcfd7c2ac8cfac50c2edd0c8415d66212c95
-
SHA512
3cb6fd659aff46eaa62b0e647ccebeecb070ba0bb27e1cc037b33caf23c417e75f476e1c08e1b5f3b232c4640995ae5afa43bfd09252d318fe5eec0d18de830a
-
SSDEEP
6144:2E5sHpScP2xeQhp4wGoqPKNDF50AsurB:PsHIiQv4gBNDFiTuF
Malware Config
Extracted
smokeloader
2019
http://advertserv25.world/logstatx77/
http://mailstatm74.club/logstatx77/
http://kxservx7zx.club/logstatx77/
http://dsmail977sx.xyz/logstatx77/
http://fdmail709.club/logstatx77/
http://servicestar751.club/logstatx77/
http://staradvert9075.club/logstatx77/
http://staradvert1883.club/logstatx77/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Loads dropped DLL 1 IoCs
Processes:
2019-09-02_22-41-10.exepid process 1760 2019-09-02_22-41-10.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2019-09-02_22-41-10.exedescription pid process target process PID 2032 set thread context of 1760 2032 2019-09-02_22-41-10.exe 2019-09-02_22-41-10.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
2019-09-02_22-41-10.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2019-09-02_22-41-10.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2019-09-02_22-41-10.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2019-09-02_22-41-10.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
2019-09-02_22-41-10.exepid process 1760 2019-09-02_22-41-10.exe 1760 2019-09-02_22-41-10.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
2019-09-02_22-41-10.exedescription pid process target process PID 2032 wrote to memory of 1760 2032 2019-09-02_22-41-10.exe 2019-09-02_22-41-10.exe PID 2032 wrote to memory of 1760 2032 2019-09-02_22-41-10.exe 2019-09-02_22-41-10.exe PID 2032 wrote to memory of 1760 2032 2019-09-02_22-41-10.exe 2019-09-02_22-41-10.exe PID 2032 wrote to memory of 1760 2032 2019-09-02_22-41-10.exe 2019-09-02_22-41-10.exe PID 2032 wrote to memory of 1760 2032 2019-09-02_22-41-10.exe 2019-09-02_22-41-10.exe PID 2032 wrote to memory of 1760 2032 2019-09-02_22-41-10.exe 2019-09-02_22-41-10.exe PID 2032 wrote to memory of 1760 2032 2019-09-02_22-41-10.exe 2019-09-02_22-41-10.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2019-09-02_22-41-10.exe"C:\Users\Admin\AppData\Local\Temp\2019-09-02_22-41-10.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\2019-09-02_22-41-10.exe"C:\Users\Admin\AppData\Local\Temp\2019-09-02_22-41-10.exe"2⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1760
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5d124f55b9393c976963407dff51ffa79
SHA12c7bbedd79791bfb866898c85b504186db610b5d
SHA256ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef
SHA512278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06