Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
svc2.exe

Overview

General Information

Sample name:svc2.exe
Analysis ID:1606868
MD5:8b85497783857bcbc16bc7f0a24a7aec
SHA1:53d6b7527846a4e8e3a35c583bfc82b4666fd279
SHA256:4b00565a29eeb0446393d0538e8f24de232339cf3ffb6a76a2bce3ba160c2066
Infos:

Detection

SmokeLoader
Score:100
Range:0 - 100
Confidence:100%

Signatures

Benign windows process drops PE files
Detected unpacking (changes PE section rights)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected SmokeLoader
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Hides that the sample has been downloaded from the Internet (zone.identifier)
Joe Sandbox ML detected suspicious sample
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Switches to a custom stack to bypass stack traces
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Abnormal high CPU Usage
Checks if the current process is being debugged
Contains functionality to call native functions
Contains functionality to read the PEB
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Sigma detected: Execution of Suspicious File Type Extension
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

  • System is w10x64
  • svc2.exe (PID: 7724 cmdline: "C:\Users\user\Desktop\svc2.exe" MD5: 8B85497783857BCBC16BC7F0A24A7AEC)
    • explorer.exe (PID: 3504 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)
  • hbasjiu (PID: 8000 cmdline: C:\Users\user\AppData\Roaming\hbasjiu MD5: 8B85497783857BCBC16BC7F0A24A7AEC)
  • hbasjiu (PID: 8128 cmdline: C:\Users\user\AppData\Roaming\hbasjiu MD5: 8B85497783857BCBC16BC7F0A24A7AEC)
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
SmokeLoaderThe SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.
  • SMOKY SPIDER
https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader
{"Version": 2022, "C2 list": ["http://constractionscity1991.lat/", "http://restructurisationservice.ru/", "http://connecticutproperty.ru/"]}
SourceRuleDescriptionAuthorStrings
00000004.00000002.1621398863.00000000005F0000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_SmokeLoader_2Yara detected SmokeLoaderJoe Security
    00000004.00000002.1621398863.00000000005F0000.00000004.00001000.00020000.00000000.sdmpWindows_Trojan_Smokeloader_4e31426eunknownunknown
    • 0x604:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
    00000004.00000003.1570237850.00000000005F0000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_SmokeLoader_2Yara detected SmokeLoaderJoe Security
      00000005.00000002.1926701326.0000000000610000.00000040.00001000.00020000.00000000.sdmpWindows_Trojan_Smokeloader_3687686funknownunknown
      • 0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
      00000005.00000002.1929574619.00000000020E0000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_SmokeLoader_2Yara detected SmokeLoaderJoe Security
        Click to see the 16 entries
        SourceRuleDescriptionAuthorStrings
        0.2.svc2.exe.400000.0.unpackJoeSecurity_SmokeLoader_2Yara detected SmokeLoaderJoe Security
          5.3.hbasjiu.20e0000.0.raw.unpackJoeSecurity_SmokeLoader_2Yara detected SmokeLoaderJoe Security
            4.2.hbasjiu.5e0e67.1.raw.unpackJoeSecurity_SmokeLoader_2Yara detected SmokeLoaderJoe Security
              0.3.svc2.exe.5f0000.0.raw.unpackJoeSecurity_SmokeLoader_2Yara detected SmokeLoaderJoe Security
                5.2.hbasjiu.610e67.1.raw.unpackJoeSecurity_SmokeLoader_2Yara detected SmokeLoaderJoe Security
                  Click to see the 4 entries

                  System Summary

                  barindex
                  Source: Process startedAuthor: Max Altgelt (Nextron Systems): Data: Command: C:\Users\user\AppData\Roaming\hbasjiu, CommandLine: C:\Users\user\AppData\Roaming\hbasjiu, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\hbasjiu, NewProcessName: C:\Users\user\AppData\Roaming\hbasjiu, OriginalFileName: C:\Users\user\AppData\Roaming\hbasjiu, ParentCommandLine: , ParentImage: , ParentProcessId: 1124, ProcessCommandLine: C:\Users\user\AppData\Roaming\hbasjiu, ProcessId: 8000, ProcessName: hbasjiu
                  TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                  2025-02-04T22:39:31.896148+010020391031A Network Trojan was detected192.168.2.94984794.156.177.7280TCP
                  2025-02-04T22:39:32.818005+010020391031A Network Trojan was detected192.168.2.9498532.59.163.7180TCP
                  2025-02-04T22:40:39.192871+010020391031A Network Trojan was detected192.168.2.94997594.156.177.7280TCP
                  2025-02-04T22:40:40.052230+010020391031A Network Trojan was detected192.168.2.9499762.59.163.7180TCP
                  2025-02-04T22:40:40.927294+010020391031A Network Trojan was detected192.168.2.94997794.156.177.7280TCP
                  2025-02-04T22:40:41.786599+010020391031A Network Trojan was detected192.168.2.9499782.59.163.7180TCP
                  2025-02-04T22:40:42.786598+010020391031A Network Trojan was detected192.168.2.94997994.156.177.7280TCP
                  2025-02-04T22:40:43.489739+010020391031A Network Trojan was detected192.168.2.9499802.59.163.7180TCP
                  2025-02-04T22:40:44.286692+010020391031A Network Trojan was detected192.168.2.94998194.156.177.7280TCP
                  2025-02-04T22:40:44.989761+010020391031A Network Trojan was detected192.168.2.9499822.59.163.7180TCP
                  2025-02-04T22:40:46.177287+010020391031A Network Trojan was detected192.168.2.94998394.156.177.7280TCP
                  2025-02-04T22:40:46.965299+010020391031A Network Trojan was detected192.168.2.9499842.59.163.7180TCP
                  2025-02-04T22:40:47.677220+010020391031A Network Trojan was detected192.168.2.94998594.156.177.7280TCP
                  2025-02-04T22:40:48.380335+010020391031A Network Trojan was detected192.168.2.9499862.59.163.7180TCP
                  2025-02-04T22:40:49.286637+010020391031A Network Trojan was detected192.168.2.94998794.156.177.7280TCP
                  2025-02-04T22:40:49.989744+010020391031A Network Trojan was detected192.168.2.9499882.59.163.7180TCP
                  2025-02-04T22:40:50.786610+010020391031A Network Trojan was detected192.168.2.94998994.156.177.7280TCP
                  2025-02-04T22:40:51.598902+010020391031A Network Trojan was detected192.168.2.9499902.59.163.7180TCP
                  2025-02-04T22:40:52.677241+010020391031A Network Trojan was detected192.168.2.94999194.156.177.7280TCP
                  2025-02-04T22:40:53.427192+010020391031A Network Trojan was detected192.168.2.9499922.59.163.7180TCP
                  2025-02-04T22:40:54.724079+010020391031A Network Trojan was detected192.168.2.94999394.156.177.7280TCP
                  2025-02-04T22:40:55.427189+010020391031A Network Trojan was detected192.168.2.9499942.59.163.7180TCP
                  2025-02-04T22:40:57.427214+010020391031A Network Trojan was detected192.168.2.94999594.156.177.7280TCP
                  2025-02-04T22:40:58.213004+010020391031A Network Trojan was detected192.168.2.9499962.59.163.7180TCP
                  2025-02-04T22:41:00.115227+010020391031A Network Trojan was detected192.168.2.94999794.156.177.7280TCP
                  2025-02-04T22:41:00.724096+010020391031A Network Trojan was detected192.168.2.9499982.59.163.7180TCP
                  2025-02-04T22:41:01.724053+010020391031A Network Trojan was detected192.168.2.94999994.156.177.7280TCP
                  2025-02-04T22:41:02.468640+010020391031A Network Trojan was detected192.168.2.9500002.59.163.7180TCP
                  2025-02-04T22:41:03.677185+010020391031A Network Trojan was detected192.168.2.95000194.156.177.7280TCP
                  2025-02-04T22:41:04.773247+010020391031A Network Trojan was detected192.168.2.9500022.59.163.7180TCP
                  2025-02-04T22:41:05.781265+010020391031A Network Trojan was detected192.168.2.95000394.156.177.7280TCP
                  2025-02-04T22:41:06.489670+010020391031A Network Trojan was detected192.168.2.9500042.59.163.7180TCP
                  2025-02-04T22:41:07.677175+010020391031A Network Trojan was detected192.168.2.95000594.156.177.7280TCP
                  2025-02-04T22:41:08.380320+010020391031A Network Trojan was detected192.168.2.9500062.59.163.7180TCP
                  2025-02-04T22:41:10.177177+010020391031A Network Trojan was detected192.168.2.95000794.156.177.7280TCP
                  2025-02-04T22:41:10.927186+010020391031A Network Trojan was detected192.168.2.9500082.59.163.7180TCP
                  2025-02-04T22:41:13.105008+010020391031A Network Trojan was detected192.168.2.95000994.156.177.7280TCP
                  2025-02-04T22:41:13.724063+010020391031A Network Trojan was detected192.168.2.9500102.59.163.7180TCP
                  2025-02-04T22:41:21.520964+010020391031A Network Trojan was detected192.168.2.95001194.156.177.7280TCP
                  2025-02-04T22:41:22.117641+010020391031A Network Trojan was detected192.168.2.9500122.59.163.7180TCP
                  2025-02-04T22:41:30.427127+010020391031A Network Trojan was detected192.168.2.95001394.156.177.7280TCP
                  2025-02-04T22:41:31.224023+010020391031A Network Trojan was detected192.168.2.9500142.59.163.7180TCP
                  2025-02-04T22:41:39.427110+010020391031A Network Trojan was detected192.168.2.95001594.156.177.7280TCP
                  2025-02-04T22:41:40.212935+010020391031A Network Trojan was detected192.168.2.9500162.59.163.7180TCP
                  2025-02-04T22:41:49.927124+010020391031A Network Trojan was detected192.168.2.95001794.156.177.7280TCP
                  2025-02-04T22:41:50.723979+010020391031A Network Trojan was detected192.168.2.9500182.59.163.7180TCP
                  2025-02-04T22:42:00.614725+010020391031A Network Trojan was detected192.168.2.95001994.156.177.7280TCP
                  2025-02-04T22:42:01.325822+010020391031A Network Trojan was detected192.168.2.9500202.59.163.7180TCP
                  2025-02-04T22:42:11.927108+010020391031A Network Trojan was detected192.168.2.95002194.156.177.7280TCP
                  2025-02-04T22:42:12.520828+010020391031A Network Trojan was detected192.168.2.9500222.59.163.7180TCP
                  2025-02-04T22:42:22.130321+010020391031A Network Trojan was detected192.168.2.95002394.156.177.7280TCP
                  2025-02-04T22:42:22.968379+010020391031A Network Trojan was detected192.168.2.9500242.59.163.7180TCP
                  2025-02-04T22:42:32.286435+010020391031A Network Trojan was detected192.168.2.95002594.156.177.7280TCP
                  2025-02-04T22:42:32.989595+010020391031A Network Trojan was detected192.168.2.9500262.59.163.7180TCP
                  2025-02-04T22:42:42.677070+010020391031A Network Trojan was detected192.168.2.95002794.156.177.7280TCP
                  2025-02-04T22:42:43.481996+010020391031A Network Trojan was detected192.168.2.9500282.59.163.7180TCP
                  2025-02-04T22:42:52.989543+010020391031A Network Trojan was detected192.168.2.95002994.156.177.7280TCP
                  2025-02-04T22:42:53.677037+010020391031A Network Trojan was detected192.168.2.9500302.59.163.7180TCP
                  2025-02-04T22:43:03.973118+010020391031A Network Trojan was detected192.168.2.95003194.156.177.7280TCP
                  2025-02-04T22:43:04.520777+010020391031A Network Trojan was detected192.168.2.9500322.59.163.7180TCP
                  2025-02-04T22:43:15.614600+010020391031A Network Trojan was detected192.168.2.95003394.156.177.7280TCP
                  TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                  2025-02-04T22:39:31.896148+010028598461Malware Command and Control Activity Detected192.168.2.94984794.156.177.7280TCP
                  2025-02-04T22:39:32.818005+010028598461Malware Command and Control Activity Detected192.168.2.9498532.59.163.7180TCP
                  2025-02-04T22:40:39.192871+010028598461Malware Command and Control Activity Detected192.168.2.94997594.156.177.7280TCP
                  2025-02-04T22:40:40.052230+010028598461Malware Command and Control Activity Detected192.168.2.9499762.59.163.7180TCP
                  2025-02-04T22:40:40.927294+010028598461Malware Command and Control Activity Detected192.168.2.94997794.156.177.7280TCP
                  2025-02-04T22:40:41.786599+010028598461Malware Command and Control Activity Detected192.168.2.9499782.59.163.7180TCP
                  2025-02-04T22:40:42.786598+010028598461Malware Command and Control Activity Detected192.168.2.94997994.156.177.7280TCP
                  2025-02-04T22:40:43.489739+010028598461Malware Command and Control Activity Detected192.168.2.9499802.59.163.7180TCP
                  2025-02-04T22:40:44.286692+010028598461Malware Command and Control Activity Detected192.168.2.94998194.156.177.7280TCP
                  2025-02-04T22:40:44.989761+010028598461Malware Command and Control Activity Detected192.168.2.9499822.59.163.7180TCP
                  2025-02-04T22:40:46.177287+010028598461Malware Command and Control Activity Detected192.168.2.94998394.156.177.7280TCP
                  2025-02-04T22:40:46.965299+010028598461Malware Command and Control Activity Detected192.168.2.9499842.59.163.7180TCP
                  2025-02-04T22:40:47.677220+010028598461Malware Command and Control Activity Detected192.168.2.94998594.156.177.7280TCP
                  2025-02-04T22:40:48.380335+010028598461Malware Command and Control Activity Detected192.168.2.9499862.59.163.7180TCP
                  2025-02-04T22:40:49.286637+010028598461Malware Command and Control Activity Detected192.168.2.94998794.156.177.7280TCP
                  2025-02-04T22:40:49.989744+010028598461Malware Command and Control Activity Detected192.168.2.9499882.59.163.7180TCP
                  2025-02-04T22:40:50.786610+010028598461Malware Command and Control Activity Detected192.168.2.94998994.156.177.7280TCP
                  2025-02-04T22:40:51.598902+010028598461Malware Command and Control Activity Detected192.168.2.9499902.59.163.7180TCP
                  2025-02-04T22:40:52.677241+010028598461Malware Command and Control Activity Detected192.168.2.94999194.156.177.7280TCP
                  2025-02-04T22:40:53.427192+010028598461Malware Command and Control Activity Detected192.168.2.9499922.59.163.7180TCP
                  2025-02-04T22:40:54.724079+010028598461Malware Command and Control Activity Detected192.168.2.94999394.156.177.7280TCP
                  2025-02-04T22:40:55.427189+010028598461Malware Command and Control Activity Detected192.168.2.9499942.59.163.7180TCP
                  2025-02-04T22:40:57.427214+010028598461Malware Command and Control Activity Detected192.168.2.94999594.156.177.7280TCP
                  2025-02-04T22:40:58.213004+010028598461Malware Command and Control Activity Detected192.168.2.9499962.59.163.7180