Analysis

  • max time kernel
    129s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-08-2024 01:54

General

  • Target

    80f14f5249c49d21ea607b34fa793d523e03acda8298b1ab1ae8a3d55428c6ce.exe

  • Size

    469KB

  • MD5

    793a58e683a54d24d3c6bae96df29d65

  • SHA1

    09e7bdc6a52fa3290fa7e9ee0471c0d1e445a2ce

  • SHA256

    80f14f5249c49d21ea607b34fa793d523e03acda8298b1ab1ae8a3d55428c6ce

  • SHA512

    f9d6a7d6bdcdfcc3507c55de2e2273e8681f5e8002cffd543bd664064c7e96c35137323f21a742bb00a6cadfc66e06084ddab3ba68207e97cbfa55fc7ec83e42

  • SSDEEP

    12288:QvIGc227fgEH/ZnTzlyi3EV/189JhnuYfW9akuz:Ax27Jf9Txye6CJRGDu

Malware Config

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\80f14f5249c49d21ea607b34fa793d523e03acda8298b1ab1ae8a3d55428c6ce.exe
    "C:\Users\Admin\AppData\Local\Temp\80f14f5249c49d21ea607b34fa793d523e03acda8298b1ab1ae8a3d55428c6ce.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1768
    • C:\Users\Admin\AppData\Local\Temp\80f14f5249c49d21ea607b34fa793d523e03acda8298b1ab1ae8a3d55428c6ce.exe
      "C:\Users\Admin\AppData\Local\Temp\80f14f5249c49d21ea607b34fa793d523e03acda8298b1ab1ae8a3d55428c6ce.exe"
      2⤵
        PID:3676
      • C:\Users\Admin\AppData\Local\Temp\80f14f5249c49d21ea607b34fa793d523e03acda8298b1ab1ae8a3d55428c6ce.exe
        "C:\Users\Admin\AppData\Local\Temp\80f14f5249c49d21ea607b34fa793d523e03acda8298b1ab1ae8a3d55428c6ce.exe"
        2⤵
        • Checks SCSI registry key(s)
        PID:3748

    Network

    • flag-us
      DNS
      8.8.8.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.8.8.8.in-addr.arpa
      IN PTR
      Response
      8.8.8.8.in-addr.arpa
      IN PTR
      dnsgoogle
    • flag-us
      DNS
      8.8.8.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.8.8.8.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      8.8.8.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.8.8.8.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      g.bing.com
      Remote address:
      8.8.8.8:53
      Request
      g.bing.com
      IN A
      Response
      g.bing.com
      IN CNAME
      g-bing-com.ax-0001.ax-msedge.net
      g-bing-com.ax-0001.ax-msedge.net
      IN CNAME
      ax-0001.ax-msedge.net
      ax-0001.ax-msedge.net
      IN A
      150.171.28.10
      ax-0001.ax-msedge.net
      IN A
      150.171.27.10
    • flag-us
      DNS
      g.bing.com
      Remote address:
      8.8.8.8:53
      Request
      g.bing.com
      IN A
    • flag-us
      DNS
      g.bing.com
      Remote address:
      8.8.8.8:53
      Request
      g.bing.com
      IN A
    • flag-us
      DNS
      217.106.137.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      217.106.137.52.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      217.106.137.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      217.106.137.52.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      217.106.137.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      217.106.137.52.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      217.106.137.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      217.106.137.52.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      217.106.137.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      217.106.137.52.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      10.28.171.150.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      10.28.171.150.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      10.28.171.150.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      10.28.171.150.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      10.28.171.150.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      10.28.171.150.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      10.28.171.150.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      10.28.171.150.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      10.28.171.150.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      10.28.171.150.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      8.8.8.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.8.8.8.in-addr.arpa
      IN PTR
      Response
      8.8.8.8.in-addr.arpa
      IN PTR
      dnsgoogle
    • flag-us
      DNS
      8.8.8.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.8.8.8.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      8.8.8.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.8.8.8.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      13.86.106.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      13.86.106.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      13.86.106.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      13.86.106.20.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      26.35.223.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      26.35.223.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      26.35.223.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      26.35.223.20.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      81.144.22.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      81.144.22.2.in-addr.arpa
      IN PTR
      Response
      81.144.22.2.in-addr.arpa
      IN PTR
      a2-22-144-81deploystaticakamaitechnologiescom
    • flag-us
      DNS
      81.144.22.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      81.144.22.2.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      157.123.68.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      157.123.68.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      68.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      68.159.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      198.187.3.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      198.187.3.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      71.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      71.159.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      71.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      71.159.190.20.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      71.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      71.159.190.20.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      71.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      71.159.190.20.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      0.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      0.159.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      0.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      0.159.190.20.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      0.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      0.159.190.20.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      0.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      0.159.190.20.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      0.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      0.159.190.20.in-addr.arpa
      IN PTR
    • 150.171.28.10:443
      g.bing.com
      tls
      2.0kB
      92 B
      10
      2
    • 150.171.28.10:443
      g.bing.com
      156 B
      3
    • 150.171.27.10:443
      g.bing.com
      156 B
      3
    • 150.171.28.10:443
      g.bing.com
      tls
      261 B
      132 B
      3
      3
    • 150.171.28.10:443
      g.bing.com
      196 B
      132 B
      4
      3
    • 8.8.8.8:53
      8.8.8.8.in-addr.arpa
      dns
      198 B
      90 B
      3
      1

      DNS Request

      8.8.8.8.in-addr.arpa

      DNS Request

      8.8.8.8.in-addr.arpa

      DNS Request

      8.8.8.8.in-addr.arpa

    • 8.8.8.8:53
      g.bing.com
      dns
      168 B
      148 B
      3
      1

      DNS Request

      g.bing.com

      DNS Request

      g.bing.com

      DNS Request

      g.bing.com

      DNS Response

      150.171.28.10
      150.171.27.10

    • 8.8.8.8:53
      217.106.137.52.in-addr.arpa
      dns
      365 B
      5

      DNS Request

      217.106.137.52.in-addr.arpa

      DNS Request

      217.106.137.52.in-addr.arpa

      DNS Request

      217.106.137.52.in-addr.arpa

      DNS Request

      217.106.137.52.in-addr.arpa

      DNS Request

      217.106.137.52.in-addr.arpa

    • 8.8.8.8:53
      10.28.171.150.in-addr.arpa
      dns
      360 B
      5

      DNS Request

      10.28.171.150.in-addr.arpa

      DNS Request

      10.28.171.150.in-addr.arpa

      DNS Request

      10.28.171.150.in-addr.arpa

      DNS Request

      10.28.171.150.in-addr.arpa

      DNS Request

      10.28.171.150.in-addr.arpa

    • 8.8.8.8:53
      8.8.8.8.in-addr.arpa
      dns
      198 B
      90 B
      3
      1

      DNS Request

      8.8.8.8.in-addr.arpa

      DNS Request

      8.8.8.8.in-addr.arpa

      DNS Request

      8.8.8.8.in-addr.arpa

    • 8.8.8.8:53
      13.86.106.20.in-addr.arpa
      dns
      142 B
      157 B
      2
      1

      DNS Request

      13.86.106.20.in-addr.arpa

      DNS Request

      13.86.106.20.in-addr.arpa

    • 8.8.8.8:53
      26.35.223.20.in-addr.arpa
      dns
      142 B
      157 B
      2
      1

      DNS Request

      26.35.223.20.in-addr.arpa

      DNS Request

      26.35.223.20.in-addr.arpa

    • 8.8.8.8:53
      81.144.22.2.in-addr.arpa
      dns
      140 B
      133 B
      2
      1

      DNS Request

      81.144.22.2.in-addr.arpa

      DNS Request

      81.144.22.2.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      146 B
      144 B
      2
      1

      DNS Request

      95.221.229.192.in-addr.arpa

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      157.123.68.40.in-addr.arpa
      dns
      72 B
      146 B
      1
      1

      DNS Request

      157.123.68.40.in-addr.arpa

    • 8.8.8.8:53
      68.159.190.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      68.159.190.20.in-addr.arpa

    • 8.8.8.8:53
      198.187.3.20.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      198.187.3.20.in-addr.arpa

    • 8.8.8.8:53
      71.159.190.20.in-addr.arpa
      dns
      288 B
      158 B
      4
      1

      DNS Request

      71.159.190.20.in-addr.arpa

      DNS Request

      71.159.190.20.in-addr.arpa

      DNS Request

      71.159.190.20.in-addr.arpa

      DNS Request

      71.159.190.20.in-addr.arpa

    • 8.8.8.8:53
      0.159.190.20.in-addr.arpa
      dns
      355 B
      157 B
      5
      1

      DNS Request

      0.159.190.20.in-addr.arpa

      DNS Request

      0.159.190.20.in-addr.arpa

      DNS Request

      0.159.190.20.in-addr.arpa

      DNS Request

      0.159.190.20.in-addr.arpa

      DNS Request

      0.159.190.20.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1768-6-0x00000000057E0000-0x000000000587C000-memory.dmp

      Filesize

      624KB

    • memory/1768-8-0x000000007487E000-0x000000007487F000-memory.dmp

      Filesize

      4KB

    • memory/1768-2-0x0000000005CF0000-0x0000000006294000-memory.dmp

      Filesize

      5.6MB

    • memory/1768-3-0x0000000005740000-0x00000000057D2000-memory.dmp

      Filesize

      584KB

    • memory/1768-4-0x0000000005670000-0x000000000567A000-memory.dmp

      Filesize

      40KB

    • memory/1768-5-0x0000000074870000-0x0000000075020000-memory.dmp

      Filesize

      7.7MB

    • memory/1768-1-0x0000000000C00000-0x0000000000C7C000-memory.dmp

      Filesize

      496KB

    • memory/1768-7-0x0000000005CC0000-0x0000000005CDA000-memory.dmp

      Filesize

      104KB

    • memory/1768-0-0x000000007487E000-0x000000007487F000-memory.dmp

      Filesize

      4KB

    • memory/1768-9-0x0000000074870000-0x0000000075020000-memory.dmp

      Filesize

      7.7MB

    • memory/1768-10-0x0000000005CE0000-0x0000000005CF0000-memory.dmp

      Filesize

      64KB

    • memory/1768-11-0x0000000009130000-0x0000000009182000-memory.dmp

      Filesize

      328KB

    • memory/1768-15-0x0000000074870000-0x0000000075020000-memory.dmp

      Filesize

      7.7MB

    • memory/3748-14-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/3748-12-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.