Analysis
-
max time kernel
157s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
25-06-2024 20:11
Static task
static1
Behavioral task
behavioral1
Sample
cded5b7ba6b257bcbea829cd06dbab1d97ca9f72b41f82526cfbcf8b99ba68f0.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
cded5b7ba6b257bcbea829cd06dbab1d97ca9f72b41f82526cfbcf8b99ba68f0.exe
Resource
win11-20240611-en
General
-
Target
cded5b7ba6b257bcbea829cd06dbab1d97ca9f72b41f82526cfbcf8b99ba68f0.exe
-
Size
316KB
-
MD5
97175eb8e852354cefb670f6863bb703
-
SHA1
efecc11d00781ed16891a3564223aa543698c3aa
-
SHA256
cded5b7ba6b257bcbea829cd06dbab1d97ca9f72b41f82526cfbcf8b99ba68f0
-
SHA512
ae36ea89767b4690c909b4c1c16840749653e53356316a877030e17b529d575946793521ef151b4fa637525bcd46f62785df4ed14da3fbee7071fd5d4c3a9631
-
SSDEEP
3072:a6SLDd01WNOGMb1T1tsy05Zt4Lt3oS1Ek1EfxTEqS:8L50kWpYym83ZNt
Malware Config
Extracted
smokeloader
pub1
Extracted
smokeloader
2022
http://movlat.com/tmp/
http://llcbc.org/tmp/
http://lindex24.ru/tmp/
http://qeqei.xyz/tmp/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3156 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
cded5b7ba6b257bcbea829cd06dbab1d97ca9f72b41f82526cfbcf8b99ba68f0.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cded5b7ba6b257bcbea829cd06dbab1d97ca9f72b41f82526cfbcf8b99ba68f0.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cded5b7ba6b257bcbea829cd06dbab1d97ca9f72b41f82526cfbcf8b99ba68f0.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cded5b7ba6b257bcbea829cd06dbab1d97ca9f72b41f82526cfbcf8b99ba68f0.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
cded5b7ba6b257bcbea829cd06dbab1d97ca9f72b41f82526cfbcf8b99ba68f0.exepid process 3232 cded5b7ba6b257bcbea829cd06dbab1d97ca9f72b41f82526cfbcf8b99ba68f0.exe 3232 cded5b7ba6b257bcbea829cd06dbab1d97ca9f72b41f82526cfbcf8b99ba68f0.exe 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 3156 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
cded5b7ba6b257bcbea829cd06dbab1d97ca9f72b41f82526cfbcf8b99ba68f0.exepid process 3232 cded5b7ba6b257bcbea829cd06dbab1d97ca9f72b41f82526cfbcf8b99ba68f0.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\cded5b7ba6b257bcbea829cd06dbab1d97ca9f72b41f82526cfbcf8b99ba68f0.exe"C:\Users\Admin\AppData\Local\Temp\cded5b7ba6b257bcbea829cd06dbab1d97ca9f72b41f82526cfbcf8b99ba68f0.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1036 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3156-4-0x0000000002F80000-0x0000000002F96000-memory.dmpFilesize
88KB
-
memory/3232-1-0x0000000002470000-0x0000000002570000-memory.dmpFilesize
1024KB
-
memory/3232-2-0x0000000002450000-0x000000000245B000-memory.dmpFilesize
44KB
-
memory/3232-3-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3232-9-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3232-8-0x0000000002450000-0x000000000245B000-memory.dmpFilesize
44KB
-
memory/3232-5-0x0000000000400000-0x000000000236A000-memory.dmpFilesize
31.4MB