Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17-04-2024 14:52
Static task
static1
Behavioral task
behavioral1
Sample
dd02b4f83462302b06278dea2591a9d32ab4534743f96b44b24d642e55b721fb.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dd02b4f83462302b06278dea2591a9d32ab4534743f96b44b24d642e55b721fb.exe
Resource
win10v2004-20240412-en
General
-
Target
dd02b4f83462302b06278dea2591a9d32ab4534743f96b44b24d642e55b721fb.exe
-
Size
312KB
-
MD5
3ed9f2c6339d6513940c15d4a58378af
-
SHA1
bd75e9514537bb38e9ba648c92a837e7d8d7b66d
-
SHA256
dd02b4f83462302b06278dea2591a9d32ab4534743f96b44b24d642e55b721fb
-
SHA512
530d1c04fd3acc0a35b54221ae5e25b4ab02fdf656bfda516bab009e94f292cffec83a8480cf95c3bacddc295a845206e6409658c837c3c78f0d1aca5cdf8036
-
SSDEEP
6144:V6xELH+Ym/eqLhvhXfRWK4Pg343g77ji:cxEL+HeqLh2K45QX
Malware Config
Extracted
smokeloader
pub1
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1228 -
Executes dropped EXE 2 IoCs
Processes:
E917.exeEF01.exepid process 2488 E917.exe 2464 EF01.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
dd02b4f83462302b06278dea2591a9d32ab4534743f96b44b24d642e55b721fb.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dd02b4f83462302b06278dea2591a9d32ab4534743f96b44b24d642e55b721fb.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dd02b4f83462302b06278dea2591a9d32ab4534743f96b44b24d642e55b721fb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dd02b4f83462302b06278dea2591a9d32ab4534743f96b44b24d642e55b721fb.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
dd02b4f83462302b06278dea2591a9d32ab4534743f96b44b24d642e55b721fb.exepid process 2856 dd02b4f83462302b06278dea2591a9d32ab4534743f96b44b24d642e55b721fb.exe 2856 dd02b4f83462302b06278dea2591a9d32ab4534743f96b44b24d642e55b721fb.exe 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 1228 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
dd02b4f83462302b06278dea2591a9d32ab4534743f96b44b24d642e55b721fb.exepid process 2856 dd02b4f83462302b06278dea2591a9d32ab4534743f96b44b24d642e55b721fb.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 1228 1228 -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
pid process 1228 1228 -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
description pid process target process PID 1228 wrote to memory of 2488 1228 E917.exe PID 1228 wrote to memory of 2488 1228 E917.exe PID 1228 wrote to memory of 2488 1228 E917.exe PID 1228 wrote to memory of 2488 1228 E917.exe PID 1228 wrote to memory of 2488 1228 E917.exe PID 1228 wrote to memory of 2488 1228 E917.exe PID 1228 wrote to memory of 2488 1228 E917.exe PID 1228 wrote to memory of 2464 1228 EF01.exe PID 1228 wrote to memory of 2464 1228 EF01.exe PID 1228 wrote to memory of 2464 1228 EF01.exe PID 1228 wrote to memory of 2464 1228 EF01.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd02b4f83462302b06278dea2591a9d32ab4534743f96b44b24d642e55b721fb.exe"C:\Users\Admin\AppData\Local\Temp\dd02b4f83462302b06278dea2591a9d32ab4534743f96b44b24d642e55b721fb.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\E917.exeC:\Users\Admin\AppData\Local\Temp\E917.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\EF01.exeC:\Users\Admin\AppData\Local\Temp\EF01.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\E917.exeFilesize
5.0MB
MD510ef283264e5050eb40f465feabeea60
SHA15c2b60ad7c2089db827532fed6069bdf74b505f8
SHA2566d45d61463e3521aa6d3d31bd7e953d38c6381c0e1b526dcb28c7f2786669eb6
SHA512c4e4080840991a829b05c76a55f6da6bffc9f618c7a1214d4d0b84e6e714d7b0e5646a99a5d92188f71801e6b7269069728f328d3a3b3fda577191372f399080
-
C:\Users\Admin\AppData\Local\Temp\EF01.exeFilesize
385KB
MD5bdbfccc2b71c0d7f9de70aba81597b52
SHA1ebb97f2a7fe51ff607a1d1b7557c995dd1cc275a
SHA256082e8792e48e6ae0b16330f6bde833c42158ba2c9b75fad31ebc3d939f8a0042
SHA512fba755745e82b6acd1e74e15ce9bc729a9b0e85bbb1975959c1b5d7ab1e6859efc715de87c3f4b6ef4bb21a25d9246142e96323cfc5d732ae6007b4690dcd417
-
memory/1228-5-0x0000000002B50000-0x0000000002B66000-memory.dmpFilesize
88KB
-
memory/2464-24-0x0000000000010000-0x0000000000076000-memory.dmpFilesize
408KB
-
memory/2464-27-0x0000000000010000-0x0000000000076000-memory.dmpFilesize
408KB
-
memory/2856-1-0x0000000000940000-0x0000000000A40000-memory.dmpFilesize
1024KB
-
memory/2856-2-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/2856-3-0x0000000000400000-0x000000000086F000-memory.dmpFilesize
4.4MB
-
memory/2856-6-0x0000000000400000-0x000000000086F000-memory.dmpFilesize
4.4MB
-
memory/2856-9-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB