200617-waj7s33qj2_pw_infected.zip

General
Target

2c99759a02ca32d1a7e8afa09130633f.exe

Filesize

237KB

Completed

17-06-2020 16:19

Score
10 /10
MD5

2c99759a02ca32d1a7e8afa09130633f

SHA1

ddf98971664eb7b554c86b4ab2e2ba7d469f893c

SHA256

b65806521aa662bff2c655c8a7a3b6c8e598d709e35f3390df880a70c3fded40

Malware Config

Extracted

Family smokeloader
Version 2018
C2

http://ukcompany.me/

http://ukcompany.pw/

http://ukcompany.top/

rc4.i32
rc4.i32
Signatures 3

Filter: none

Discovery
  • Suspicious behavior: MapViewOfSection
    2c99759a02ca32d1a7e8afa09130633f.exe

    Reported IOCs

    pidprocess
    2402c99759a02ca32d1a7e8afa09130633f.exe
    2402c99759a02ca32d1a7e8afa09130633f.exe
  • Maps connected drives based on registry
    2c99759a02ca32d1a7e8afa09130633f.exe

    Description

    Disk information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistryPeripheral Device DiscoverySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum2c99759a02ca32d1a7e8afa09130633f.exe
    Key value queried\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\02c99759a02ca32d1a7e8afa09130633f.exe
  • SmokeLoader

    Description

    Modular backdoor trojan in use since 2014.

Processes 1
  • C:\Users\Admin\AppData\Local\Temp\2c99759a02ca32d1a7e8afa09130633f.exe
    "C:\Users\Admin\AppData\Local\Temp\2c99759a02ca32d1a7e8afa09130633f.exe"
    Suspicious behavior: MapViewOfSection
    Maps connected drives based on registry
    PID:240
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads
                        • memory/240-0-0x0000000000290000-0x00000000002A5000-memory.dmp

                        • memory/1208-2-0x0000000004D60000-0x0000000004D61000-memory.dmp