Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
25-06-2024 10:58
Static task
static1
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
1.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
1.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
1.exe
Resource
win11-20240508-en
General
-
Target
1.exe
-
Size
227KB
-
MD5
4c2fac8f9227cdb10b5b8056f396629b
-
SHA1
3e84121bee19dd64d74ef41196a09894a6017d73
-
SHA256
496f578f68fcef476f7c8d92322a3536f507e45704b8e1c87c56056e19c1e391
-
SHA512
10297336f66bb57fd6d1d8a563dd507d05b79d63cec50e3069593055b1b21f41c8de10284f7d6d2ece981e68bd3970252f3e7700d0fa3f602867f5f5b95ed3b6
-
SSDEEP
3072:1Jr6zgrn0rzKl3g5hxsrtYvyjIo3T8NAf68hu0nPsZciXcYW43hK:1hnezKl3UstVIo3T8ONhZPKVs
Malware Config
Extracted
smokeloader
pub1
Extracted
smokeloader
2022
http://movlat.com/tmp/
http://llcbc.org/tmp/
http://lindex24.ru/tmp/
http://qeqei.xyz/tmp/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1200 -
Executes dropped EXE 1 IoCs
Processes:
gteerwgpid process 2548 gteerwg -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
1.exegteerwgdescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI gteerwg Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI gteerwg Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI gteerwg Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
1.exepid process 1688 1.exe 1688 1.exe 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1200 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
1.exegteerwgpid process 1688 1.exe 2548 gteerwg -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
taskeng.exedescription pid process target process PID 2840 wrote to memory of 2548 2840 taskeng.exe gteerwg PID 2840 wrote to memory of 2548 2840 taskeng.exe gteerwg PID 2840 wrote to memory of 2548 2840 taskeng.exe gteerwg PID 2840 wrote to memory of 2548 2840 taskeng.exe gteerwg -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\taskeng.exetaskeng.exe {821BB93F-F37B-48E4-8617-59BCB3D02C71} S-1-5-21-2721934792-624042501-2768869379-1000:BISMIZHX\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\gteerwgC:\Users\Admin\AppData\Roaming\gteerwg2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\gteerwgFilesize
227KB
MD54c2fac8f9227cdb10b5b8056f396629b
SHA13e84121bee19dd64d74ef41196a09894a6017d73
SHA256496f578f68fcef476f7c8d92322a3536f507e45704b8e1c87c56056e19c1e391
SHA51210297336f66bb57fd6d1d8a563dd507d05b79d63cec50e3069593055b1b21f41c8de10284f7d6d2ece981e68bd3970252f3e7700d0fa3f602867f5f5b95ed3b6
-
memory/1200-4-0x0000000002D30000-0x0000000002D46000-memory.dmpFilesize
88KB
-
memory/1200-16-0x0000000002490000-0x00000000024A6000-memory.dmpFilesize
88KB
-
memory/1688-1-0x0000000000570000-0x0000000000670000-memory.dmpFilesize
1024KB
-
memory/1688-3-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1688-2-0x0000000000220000-0x000000000022B000-memory.dmpFilesize
44KB
-
memory/1688-5-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/1688-6-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2548-15-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/2548-18-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB