Resubmissions

09/05/2025, 14:24

250509-rqz93svyhv 10

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250502-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/05/2025, 06:42

General

  • Target

    HYDRA.exe

  • Size

    2.6MB

  • MD5

    c52bc39684c52886712971a92f339b23

  • SHA1

    c5cb39850affb7ed322bfb0a4900e17c54f95a11

  • SHA256

    f8c17cb375e8ccad5b0e33dae65694a1bd628f91cac6cf65dd11f50e91130c2d

  • SHA512

    2d50c1aa6ca237b9dbe97f000a082a223618f2164c8ab42ace9f4e142c318b2fc53e91a476dbe9c2dd459942b61507df5c551bd5c692a2b2a2037e4f6bd2a12b

  • SSDEEP

    49152:HnUXzRe4cjAx+L/G/3JHQZutOnmSzZniyui0EJHezdcc/DK9kTO1S:HUD8djA0LOvJdtOmSlniyuiPFePmS61S

Malware Config

Extracted

Family

smokeloader

Version

2017

C2

http://92.53.105.14/

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Smokeloader family
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\HYDRA.exe
    "C:\Users\Admin\AppData\Local\Temp\HYDRA.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4736
    • C:\Users\Admin\AppData\Roaming\yaya.exe
      C:\Users\Admin\AppData\Roaming\yaya.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3660
      • C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\starter.exe
        "C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\starter.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4692
        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\knvzfzta.cmdline"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:680
          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9868.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9867.tmp"
            5⤵
              PID:2720
      • C:\Users\Admin\AppData\Roaming\va.exe
        C:\Users\Admin\AppData\Roaming\va.exe
        2⤵
        • Drops startup file
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:468
      • C:\Users\Admin\AppData\Roaming\ufx.exe
        C:\Users\Admin\AppData\Roaming\ufx.exe
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5340
        • C:\ProgramData\ucp\usc.exe
          "C:\ProgramData\ucp\usc.exe" /ucp/usc.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4872
          • C:\Windows\SysWOW64\SCHTASKS.exe
            SCHTASKS /Create /SC MINUTE /MO 10 /F /TN SystemOptimize /TR C:\ProgramData\ucp\usc.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:1396
      • C:\Users\Admin\AppData\Roaming\sant.exe
        C:\Users\Admin\AppData\Roaming\sant.exe
        2⤵
        • Executes dropped EXE
        • Maps connected drives based on registry
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:4120
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          PID:4792
      • C:\Users\Admin\AppData\Roaming\power.exe
        C:\Users\Admin\AppData\Roaming\power.exe
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:6132
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1792
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Microsoft\jwjhiruw\cessiwtf.exe
      1⤵
        PID:3612

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\ProgramData\ucp\usc.exe

              Filesize

              4.0MB

              MD5

              b100b373d645bf59b0487dbbda6c426d

              SHA1

              44a4ad2913f5f35408b8c16459dcce3f101bdcc7

              SHA256

              84d7fd0a93d963e9808212917f79fe2d485bb7fbc94ee374a141bbd15da725b7

              SHA512

              69483fed79f33da065b1cc65a2576ba268c78990545070f6f76fca8f48aaec8274faecdc9bcf92bf84a87809a318b159d1a3c835f848a6eea6c163f41612bf9b

            • C:\Users\Admin\AppData\Local\Temp\RES9868.tmp

              Filesize

              1KB

              MD5

              2f55a7897c5954865714513f0339a2ca

              SHA1

              6aecfffb499a7e1d320e20f10dc7bde9403b9bc5

              SHA256

              47280aa7e43e59f1f92000f68e34db285c3574a904d0175e06b8488b201a8903

              SHA512

              d5e2c23f20ede600424d8fc0874e52fb97dc8f69fef5bc2d41048e1a3091d765afe3007dbf41f0ea775ddd618428824373ec01dfe8ab4b3b4347b6415e924e45

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dqcvzc40.s5d.ps1

              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            • C:\Users\Admin\AppData\Local\Temp\knvzfzta.dll

              Filesize

              5KB

              MD5

              d6fe663f7f008fe07d1331f62d7336f8

              SHA1

              4ff97b90e8b31089a048ace10f76211da01cbe2c

              SHA256

              6d39e00ffd8c3b95100a4ff91d2fd90e75e05c7bda6fb98041717a4a818c7e5c

              SHA512

              575d84fb9fd115b6a22659f0d4934b9479ebee90935958138b1c72f5f94da2813f3c09da28afe2007e3a44e04a7888f2b4b3cb215c2e87a872e0154a92456571

            • C:\Users\Admin\AppData\Local\Temp\knvzfzta.pdb

              Filesize

              7KB

              MD5

              042ffd7dfc98a3093e138e53f38bbe5c

              SHA1

              6d8d8beff1438a222fb0cce6f5c880bad5090ceb

              SHA256

              0b4c672a5aeef8eed5a08717822f7b18686d524a858752dfb80ddf846dbeeb74

              SHA512

              f6951e31165ff3ff810714b31c1ab6d1210154a03884a1f0a88d9781de9b7ce3dc468261f9adddb85179b7c2b33d00f9275712b767f5ccf0ebb0d9401227b29e

            • C:\Users\Admin\AppData\Roaming\power.exe

              Filesize

              507KB

              MD5

              743f47ae7d09fce22d0a7c724461f7e3

              SHA1

              8e98dd1efb70749af72c57344aab409fb927394e

              SHA256

              1bee45423044b5a6bf0ad0dd2870117824b000784ce81c5f8a1b930bb8bc0465

              SHA512

              567993c3b798365efa07b7a46fda98494bfe540647f27654764e78b7f60f093d403b77b9abb889cfb09b44f13515ce3c041fc5db05882418313c3b3409dd77bf

            • C:\Users\Admin\AppData\Roaming\sant.exe

              Filesize

              12KB

              MD5

              5effca91c3f1e9c87d364460097f8048

              SHA1

              28387c043ab6857aaa51865346046cf5dc4c7b49

              SHA256

              3fd826fc0c032721466b94ab3ec7dcfe006cc284e16132af6b91dfbc064b0907

              SHA512

              b0dba30fde295d3f7858db9d1463239b30cd84921971032b2afb96f811a53ac12c1e6f72013d2eff397b0b89c371e7c023c951cd2102f94157cba9918cd2c3e0

            • C:\Users\Admin\AppData\Roaming\ufx.exe

              Filesize

              960KB

              MD5

              22e088012519e1013c39a3828bda7498

              SHA1

              3a8a87cce3f6aff415ee39cf21738663c0610016

              SHA256

              9e3826138bacac89845c26278f52854117db1652174c1c76dbb2bd24f00f4973

              SHA512

              5559e279dd3d72b2c9062d88e99212bbc67639fe5a42076efd24ae890cfce72cfe2235adb20bf5ed1f547b6da9e69effa4ccb80c0407b7524f134a24603ea5a8

            • C:\Users\Admin\AppData\Roaming\va.exe

              Filesize

              88KB

              MD5

              c084e736931c9e6656362b0ba971a628

              SHA1

              ef83b95fc645ad3a161a19ccef3224c72e5472bd

              SHA256

              3139bf3c4b958c3a019af512aecdb8161b9d6d7432d2c404abda3f42b63f34f1

              SHA512

              cbd6485840a117b52e24586da536cefa94ca087b41eb460d27bc2bd320217957c9e0e96b0daf74343efde2e23a5242e7a99075aabf5f9e18e03b52eb7151ae1f

            • C:\Users\Admin\AppData\Roaming\yaya.exe

              Filesize

              1.7MB

              MD5

              7d05ab95cfe93d84bc5db006c789a47f

              SHA1

              aa4aa0189140670c618348f1baad877b8eca04a4

              SHA256

              5c32e0d2a69fd77e85f2eecaabeb677b6f816de0d82bf7c29c9d124a818f424f

              SHA512

              40d1461e68994df56f19d9f7b2d96ffdc5300ca933e10dc53f7953471df8dea3aabeb178c3432c6819175475cadcbdb698384e3df57b3606c6fce3173a31fe84

            • C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\starter.exe

              Filesize

              80KB

              MD5

              51bf85f3bf56e628b52d61614192359d

              SHA1

              c1bc90be6a4beb67fb7b195707798106114ec332

              SHA256

              990dffdc0694858514d6d7ff7fff5dc9f48fab3aa35a4d9301d94fc57e346446

              SHA512

              131173f3aabcfba484e972424c54201ec4b1facfb2df1efe08df0d43a816d4df03908b006884564c56a6245badd4f9ed442a295f1db2c0c970a8f80985d35474

            • \??\c:\Users\Admin\AppData\Local\Temp\CSC9867.tmp

              Filesize

              652B

              MD5

              963baf55d34f3b70e235235ca097902a

              SHA1

              daae3839751d0dbf1febad9750a308d6b6512ea8

              SHA256

              9e26b41b7c571f555e3cfeee368d717ed9ff9b2653756e46329e8a047aea2af4

              SHA512

              10291ce92d9985bffde1eff57927781e3fdbd1954f9482e36b032df62fd7238d1e1059ad585534e7ff789d9e25c4169c05599be9412f5ca326d55064ed8c19c6

            • \??\c:\Users\Admin\AppData\Local\Temp\knvzfzta.0.cs

              Filesize

              4KB

              MD5

              a0d1b6f34f315b4d81d384b8ebcdeaa5

              SHA1

              794c1ff4f2a28e0c631a783846ecfffdd4c7ae09

              SHA256

              0b3a3f8f11eb6f50fe67943f2b73c5824614f31c2e0352cc234927d7cb1a52e0

              SHA512

              0a89293d731c5bca05e73148f85a740b324fc877f2fb05cde1f68e2098329fbca552d78249a46f4a1da15a450c8e754c73be20c652f7089d5cfec445ce950a0e

            • \??\c:\Users\Admin\AppData\Local\Temp\knvzfzta.cmdline

              Filesize

              309B

              MD5

              06db046193229ca1582ab3da9ad7c680

              SHA1

              4086ec06b14bc7cbea99ff277aa7e84498002d2b

              SHA256

              0349d5def945cf010180ff39efca9a5e652bbc73d88d94d7934f4e0cfb49f133

              SHA512

              45300afd987abadc2c42d735fadd13197fbff9a82e48d18044d50f37e014b7b7bee1709bd486c42320f8482a0dc4c1dd7f6c29b603404c37c72caedeb5bac0d4

            • memory/468-19-0x0000000000400000-0x000000000041C000-memory.dmp

              Filesize

              112KB

            • memory/1792-101-0x0000000004CB0000-0x00000000052D8000-memory.dmp

              Filesize

              6.2MB

            • memory/1792-100-0x00000000044F0000-0x0000000004526000-memory.dmp

              Filesize

              216KB

            • memory/1792-121-0x0000000006E50000-0x0000000006E6A000-memory.dmp

              Filesize

              104KB

            • memory/1792-120-0x00000000074B0000-0x0000000007B2A000-memory.dmp

              Filesize

              6.5MB

            • memory/1792-119-0x0000000006DB0000-0x0000000006E26000-memory.dmp

              Filesize

              472KB

            • memory/1792-118-0x0000000006050000-0x0000000006094000-memory.dmp

              Filesize

              272KB

            • memory/1792-116-0x0000000005AE0000-0x0000000005B2C000-memory.dmp

              Filesize

              304KB

            • memory/1792-115-0x0000000005AA0000-0x0000000005ABE000-memory.dmp

              Filesize

              120KB

            • memory/1792-114-0x00000000054E0000-0x0000000005834000-memory.dmp

              Filesize

              3.3MB

            • memory/1792-104-0x0000000005470000-0x00000000054D6000-memory.dmp

              Filesize

              408KB

            • memory/1792-103-0x0000000005390000-0x00000000053F6000-memory.dmp

              Filesize

              408KB

            • memory/1792-102-0x0000000004C00000-0x0000000004C22000-memory.dmp

              Filesize

              136KB

            • memory/3660-52-0x0000000000400000-0x000000000047B000-memory.dmp

              Filesize

              492KB

            • memory/4120-22-0x00000000001E0000-0x00000000001EA000-memory.dmp

              Filesize

              40KB

            • memory/4120-17-0x0000000000400000-0x0000000000404000-memory.dmp

              Filesize

              16KB

            • memory/4120-94-0x0000000000400000-0x0000000000404000-memory.dmp

              Filesize

              16KB

            • memory/4120-95-0x00000000001E0000-0x00000000001EA000-memory.dmp

              Filesize

              40KB

            • memory/4120-79-0x00000000001E0000-0x00000000001EA000-memory.dmp

              Filesize

              40KB

            • memory/4120-23-0x00000000001E0000-0x00000000001EA000-memory.dmp

              Filesize

              40KB

            • memory/4692-60-0x0000000001450000-0x0000000001458000-memory.dmp

              Filesize

              32KB

            • memory/4692-74-0x000000001BAE0000-0x000000001BAE8000-memory.dmp

              Filesize

              32KB

            • memory/4692-58-0x000000001BFF0000-0x000000001C4BE000-memory.dmp

              Filesize

              4.8MB

            • memory/4692-59-0x000000001C4C0000-0x000000001C55C000-memory.dmp

              Filesize

              624KB

            • memory/4792-89-0x0000000000510000-0x000000000051A000-memory.dmp

              Filesize

              40KB

            • memory/4792-82-0x0000000000510000-0x000000000051A000-memory.dmp

              Filesize

              40KB

            • memory/4792-81-0x0000000000CB0000-0x00000000010E3000-memory.dmp

              Filesize

              4.2MB

            • memory/4792-80-0x0000000000CB0000-0x00000000010E3000-memory.dmp

              Filesize

              4.2MB

            • memory/4792-91-0x0000000000510000-0x000000000051A000-memory.dmp

              Filesize

              40KB

            • memory/6132-78-0x0000000000400000-0x0000000000485000-memory.dmp

              Filesize

              532KB

            • memory/6132-99-0x0000000000400000-0x0000000000485000-memory.dmp

              Filesize

              532KB