Resubmissions
06/07/2024, 15:29
240706-sw8zvasgkl1006/07/2024, 15:26
240706-st7n1asfjk1006/07/2024, 12:41
240706-pwtndaycln1006/07/2024, 04:15
240706-et8dmsvgkq10Analysis
- max time kernel
52s - max time network
38s - platform
windows10-2004_x64 - resource
win10v2004-20240704-en - resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system - submitted
06/07/2024, 12:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target file.exe
- Size 230KB
- Sample240706-pwtndaycln
- SHA256 77ba6812b4e9223398d31476512a19ce12c60cf8c9d139e4578f3f19563e0d52
- MD5 0fc784b6c538e7c4a5a4f4bcd8068859
- SHA1 8340c0914ec651c3e4ffc7682162154505fc5f8a
- SHA512 eaeaf7633b5acc64d95d2691ef0952ea691634591dfe30e61ca2116268f007ef676507a5d67acf5265ed8308622915e1704452a59699f4be162ab9d49aa3818c
- SSDEEP 3072:IovqqnT/W562w1DOeZPK5gGw++afPQRMZIa/nobS0xmv/0X4KEHsy4iIT:IIqqnC56li/JfPQRmnoro33KEHW
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Botnet
-
pub1
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Program crash 1 IoCs
pid pid_target Process procid_target 672 5004 WerFault.exe 81 - Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings taskmgr.exe - Suspicious behavior: EnumeratesProcesses 47 IoCs
pid Process 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3852 taskmgr.exe Token: SeSystemProfilePrivilege 3852 taskmgr.exe Token: SeCreateGlobalPrivilege 3852 taskmgr.exe Token: 33 3852 taskmgr.exe Token: SeIncBasePriorityPrivilege 3852 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe 3852 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
PID:5004 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 4642⤵
- Program crash
PID:672
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5004 -ip 50041⤵PID:324
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3852
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4364
-
C:\Windows\System32\zdkjhg.exe"C:\Windows\System32\zdkjhg.exe"1⤵PID:4616
-
C:\Windows\System32\zdkjhg.exe"C:\Windows\System32\zdkjhg.exe"1⤵PID:712
-
C:\Windows\System32\zdkjhg.exe"C:\Windows\System32\zdkjhg.exe"1⤵PID:1716