200617-sg254llg2s_pw_infected.zip

General
Target

37ea915af4b89c5697fd8647175dbc25.exe

Filesize

32KB

Completed

17-06-2020 16:18

Score
10 /10
MD5

37ea915af4b89c5697fd8647175dbc25

SHA1

b0b41abda47839c37c007f4c9e03dfad55084f70

SHA256

383dede6a6d363e97a2d34a002aca69378da4b6769b13976b0344a20272a7d9d

Malware Config

Extracted

Family smokeloader
Version 2018
C2

http://185.35.137.147/mlp/

rc4.i32
rc4.i32
Signatures 3

Filter: none

Discovery
  • Suspicious behavior: MapViewOfSection
    37ea915af4b89c5697fd8647175dbc25.exe

    Reported IOCs

    pidprocess
    89637ea915af4b89c5697fd8647175dbc25.exe
    89637ea915af4b89c5697fd8647175dbc25.exe
  • Maps connected drives based on registry
    37ea915af4b89c5697fd8647175dbc25.exe

    Description

    Disk information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistryPeripheral Device DiscoverySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum37ea915af4b89c5697fd8647175dbc25.exe
    Key value queried\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\037ea915af4b89c5697fd8647175dbc25.exe
  • SmokeLoader

    Description

    Modular backdoor trojan in use since 2014.

Processes 1
  • C:\Users\Admin\AppData\Local\Temp\37ea915af4b89c5697fd8647175dbc25.exe
    "C:\Users\Admin\AppData\Local\Temp\37ea915af4b89c5697fd8647175dbc25.exe"
    Suspicious behavior: MapViewOfSection
    Maps connected drives based on registry
    PID:896
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads
                        • memory/896-0-0x00000000002E0000-0x00000000002F5000-memory.dmp

                        • memory/1276-2-0x00000000060C0000-0x00000000060C1000-memory.dmp