Windows
Analysis Report
svc2.exe
Overview
General Information
Detection
SmokeLoader
Score: | 100 |
Range: | 0 - 100 |
Confidence: | 100% |
Signatures
Benign windows process drops PE files
Detected unpacking (changes PE section rights)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected SmokeLoader
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Hides that the sample has been downloaded from the Internet (zone.identifier)
Joe Sandbox ML detected suspicious sample
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Switches to a custom stack to bypass stack traces
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Abnormal high CPU Usage
Checks if the current process is being debugged
Contains functionality to call native functions
Contains functionality to read the PEB
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Sigma detected: Execution of Suspicious File Type Extension
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara signature match
Classification
- System is w10x64
svc2.exe (PID: 7724 cmdline:
"C:\Users\ user\Deskt op\svc2.ex e" MD5: 8B85497783857BCBC16BC7F0A24A7AEC) explorer.exe (PID: 3504 cmdline:
C:\Windows \Explorer. EXE MD5: 662F4F92FDE3557E86D110526BB578D5)
hbasjiu (PID: 8000 cmdline:
C:\Users\u ser\AppDat a\Roaming\ hbasjiu MD5: 8B85497783857BCBC16BC7F0A24A7AEC)
hbasjiu (PID: 8128 cmdline:
C:\Users\u ser\AppDat a\Roaming\ hbasjiu MD5: 8B85497783857BCBC16BC7F0A24A7AEC)
- cleanup
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
SmokeLoader | The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body. |
{"Version": 2022, "C2 list": ["http://constractionscity1991.lat/", "http://restructurisationservice.ru/", "http://connecticutproperty.ru/"]}
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_SmokeLoader_2 | Yara detected SmokeLoader | Joe Security | ||
Windows_Trojan_Smokeloader_4e31426e | unknown | unknown |
| |
JoeSecurity_SmokeLoader_2 | Yara detected SmokeLoader | Joe Security | ||
Windows_Trojan_Smokeloader_3687686f | unknown | unknown |
| |
JoeSecurity_SmokeLoader_2 | Yara detected SmokeLoader | Joe Security | ||
Click to see the 16 entries |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_SmokeLoader_2 | Yara detected SmokeLoader | Joe Security | ||
JoeSecurity_SmokeLoader_2 | Yara detected SmokeLoader | Joe Security | ||
JoeSecurity_SmokeLoader_2 | Yara detected SmokeLoader | Joe Security | ||
JoeSecurity_SmokeLoader_2 | Yara detected SmokeLoader | Joe Security | ||
JoeSecurity_SmokeLoader_2 | Yara detected SmokeLoader | Joe Security | ||
Click to see the 4 entries |
System Summary |
---|
Source: | Author: Max Altgelt (Nextron Systems): |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2025-02-04T22:39:31.896148+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 49847 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:39:32.818005+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 49853 | 2.59.163.71 | 80 | TCP |
2025-02-04T22:40:39.192871+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 49975 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:40:40.052230+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 49976 | 2.59.163.71 | 80 | TCP |
2025-02-04T22:40:40.927294+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 49977 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:40:41.786599+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 49978 | 2.59.163.71 | 80 | TCP |
2025-02-04T22:40:42.786598+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 49979 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:40:43.489739+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 49980 | 2.59.163.71 | 80 | TCP |
2025-02-04T22:40:44.286692+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 49981 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:40:44.989761+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 49982 | 2.59.163.71 | 80 | TCP |
2025-02-04T22:40:46.177287+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 49983 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:40:46.965299+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 49984 | 2.59.163.71 | 80 | TCP |
2025-02-04T22:40:47.677220+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 49985 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:40:48.380335+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 49986 | 2.59.163.71 | 80 | TCP |
2025-02-04T22:40:49.286637+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 49987 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:40:49.989744+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 49988 | 2.59.163.71 | 80 | TCP |
2025-02-04T22:40:50.786610+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 49989 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:40:51.598902+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 49990 | 2.59.163.71 | 80 | TCP |
2025-02-04T22:40:52.677241+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 49991 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:40:53.427192+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 49992 | 2.59.163.71 | 80 | TCP |
2025-02-04T22:40:54.724079+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 49993 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:40:55.427189+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 49994 | 2.59.163.71 | 80 | TCP |
2025-02-04T22:40:57.427214+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 49995 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:40:58.213004+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 49996 | 2.59.163.71 | 80 | TCP |
2025-02-04T22:41:00.115227+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 49997 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:41:00.724096+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 49998 | 2.59.163.71 | 80 | TCP |
2025-02-04T22:41:01.724053+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 49999 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:41:02.468640+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 50000 | 2.59.163.71 | 80 | TCP |
2025-02-04T22:41:03.677185+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 50001 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:41:04.773247+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 50002 | 2.59.163.71 | 80 | TCP |
2025-02-04T22:41:05.781265+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 50003 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:41:06.489670+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 50004 | 2.59.163.71 | 80 | TCP |
2025-02-04T22:41:07.677175+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 50005 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:41:08.380320+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 50006 | 2.59.163.71 | 80 | TCP |
2025-02-04T22:41:10.177177+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 50007 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:41:10.927186+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 50008 | 2.59.163.71 | 80 | TCP |
2025-02-04T22:41:13.105008+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 50009 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:41:13.724063+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 50010 | 2.59.163.71 | 80 | TCP |
2025-02-04T22:41:21.520964+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 50011 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:41:22.117641+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 50012 | 2.59.163.71 | 80 | TCP |
2025-02-04T22:41:30.427127+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 50013 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:41:31.224023+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 50014 | 2.59.163.71 | 80 | TCP |
2025-02-04T22:41:39.427110+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 50015 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:41:40.212935+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 50016 | 2.59.163.71 | 80 | TCP |
2025-02-04T22:41:49.927124+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 50017 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:41:50.723979+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 50018 | 2.59.163.71 | 80 | TCP |
2025-02-04T22:42:00.614725+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 50019 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:42:01.325822+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 50020 | 2.59.163.71 | 80 | TCP |
2025-02-04T22:42:11.927108+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 50021 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:42:12.520828+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 50022 | 2.59.163.71 | 80 | TCP |
2025-02-04T22:42:22.130321+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 50023 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:42:22.968379+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 50024 | 2.59.163.71 | 80 | TCP |
2025-02-04T22:42:32.286435+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 50025 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:42:32.989595+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 50026 | 2.59.163.71 | 80 | TCP |
2025-02-04T22:42:42.677070+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 50027 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:42:43.481996+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 50028 | 2.59.163.71 | 80 | TCP |
2025-02-04T22:42:52.989543+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 50029 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:42:53.677037+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 50030 | 2.59.163.71 | 80 | TCP |
2025-02-04T22:43:03.973118+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 50031 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:43:04.520777+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 50032 | 2.59.163.71 | 80 | TCP |
2025-02-04T22:43:15.614600+0100 | 2039103 | 1 | A Network Trojan was detected | 192.168.2.9 | 50033 | 94.156.177.72 | 80 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2025-02-04T22:39:31.896148+0100 | 2859846 | 1 | Malware Command and Control Activity Detected | 192.168.2.9 | 49847 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:39:32.818005+0100 | 2859846 | 1 | Malware Command and Control Activity Detected | 192.168.2.9 | 49853 | 2.59.163.71 | 80 | TCP |
2025-02-04T22:40:39.192871+0100 | 2859846 | 1 | Malware Command and Control Activity Detected | 192.168.2.9 | 49975 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:40:40.052230+0100 | 2859846 | 1 | Malware Command and Control Activity Detected | 192.168.2.9 | 49976 | 2.59.163.71 | 80 | TCP |
2025-02-04T22:40:40.927294+0100 | 2859846 | 1 | Malware Command and Control Activity Detected | 192.168.2.9 | 49977 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:40:41.786599+0100 | 2859846 | 1 | Malware Command and Control Activity Detected | 192.168.2.9 | 49978 | 2.59.163.71 | 80 | TCP |
2025-02-04T22:40:42.786598+0100 | 2859846 | 1 | Malware Command and Control Activity Detected | 192.168.2.9 | 49979 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:40:43.489739+0100 | 2859846 | 1 | Malware Command and Control Activity Detected | 192.168.2.9 | 49980 | 2.59.163.71 | 80 | TCP |
2025-02-04T22:40:44.286692+0100 | 2859846 | 1 | Malware Command and Control Activity Detected | 192.168.2.9 | 49981 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:40:44.989761+0100 | 2859846 | 1 | Malware Command and Control Activity Detected | 192.168.2.9 | 49982 | 2.59.163.71 | 80 | TCP |
2025-02-04T22:40:46.177287+0100 | 2859846 | 1 | Malware Command and Control Activity Detected | 192.168.2.9 | 49983 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:40:46.965299+0100 | 2859846 | 1 | Malware Command and Control Activity Detected | 192.168.2.9 | 49984 | 2.59.163.71 | 80 | TCP |
2025-02-04T22:40:47.677220+0100 | 2859846 | 1 | Malware Command and Control Activity Detected | 192.168.2.9 | 49985 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:40:48.380335+0100 | 2859846 | 1 | Malware Command and Control Activity Detected | 192.168.2.9 | 49986 | 2.59.163.71 | 80 | TCP |
2025-02-04T22:40:49.286637+0100 | 2859846 | 1 | Malware Command and Control Activity Detected | 192.168.2.9 | 49987 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:40:49.989744+0100 | 2859846 | 1 | Malware Command and Control Activity Detected | 192.168.2.9 | 49988 | 2.59.163.71 | 80 | TCP |
2025-02-04T22:40:50.786610+0100 | 2859846 | 1 | Malware Command and Control Activity Detected | 192.168.2.9 | 49989 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:40:51.598902+0100 | 2859846 | 1 | Malware Command and Control Activity Detected | 192.168.2.9 | 49990 | 2.59.163.71 | 80 | TCP |
2025-02-04T22:40:52.677241+0100 | 2859846 | 1 | Malware Command and Control Activity Detected | 192.168.2.9 | 49991 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:40:53.427192+0100 | 2859846 | 1 | Malware Command and Control Activity Detected | 192.168.2.9 | 49992 | 2.59.163.71 | 80 | TCP |
2025-02-04T22:40:54.724079+0100 | 2859846 | 1 | Malware Command and Control Activity Detected | 192.168.2.9 | 49993 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:40:55.427189+0100 | 2859846 | 1 | Malware Command and Control Activity Detected | 192.168.2.9 | 49994 | 2.59.163.71 | 80 | TCP |
2025-02-04T22:40:57.427214+0100 | 2859846 | 1 | Malware Command and Control Activity Detected | 192.168.2.9 | 49995 | 94.156.177.72 | 80 | TCP |
2025-02-04T22:40:58.213004+0100 | 2859846 | 1 | Malware Command and Control Activity Detected | 192.168.2.9 | 49996 | 2.59.163.71 | 80 |