200617-9p3dsew1sj_pw_infected.zip

General
Target

3cb9e63f6f46eefcb7747a42117b2a28.exe

Filesize

32KB

Completed

17-06-2020 16:18

Score
10 /10
MD5

3cb9e63f6f46eefcb7747a42117b2a28

SHA1

a9c5a3cba0ed357520a27116e98986abacffd76b

SHA256

418c7c294982186c2315c6a78524a38a6901310366261342952eea826d55927e

Malware Config

Extracted

Family smokeloader
Version 2018
C2

http://185.35.137.147/mlp/

rc4.i32
rc4.i32
Signatures 3

Filter: none

Discovery
  • Suspicious behavior: MapViewOfSection
    3cb9e63f6f46eefcb7747a42117b2a28.exe

    Reported IOCs

    pidprocess
    14123cb9e63f6f46eefcb7747a42117b2a28.exe
    14123cb9e63f6f46eefcb7747a42117b2a28.exe
  • Maps connected drives based on registry
    3cb9e63f6f46eefcb7747a42117b2a28.exe

    Description

    Disk information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistryPeripheral Device DiscoverySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum3cb9e63f6f46eefcb7747a42117b2a28.exe
    Key value queried\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\03cb9e63f6f46eefcb7747a42117b2a28.exe
  • SmokeLoader

    Description

    Modular backdoor trojan in use since 2014.

Processes 1
  • C:\Users\Admin\AppData\Local\Temp\3cb9e63f6f46eefcb7747a42117b2a28.exe
    "C:\Users\Admin\AppData\Local\Temp\3cb9e63f6f46eefcb7747a42117b2a28.exe"
    Suspicious behavior: MapViewOfSection
    Maps connected drives based on registry
    PID:1412
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads
                        • memory/1212-2-0x0000000003DE0000-0x0000000003DE1000-memory.dmp

                        • memory/1412-0-0x00000000001A0000-0x00000000001B5000-memory.dmp