Analysis
-
max time kernel
124s -
max time network
145s -
platform
windows7_x64 -
resource
win7 -
submitted
27-08-2020 15:46
Static task
static1
Behavioral task
behavioral1
Sample
2020-08-16_12-33-29.bin.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
2020-08-16_12-33-29.bin.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
-
Target
2020-08-16_12-33-29.bin.exe
-
Size
182KB
-
MD5
31293dfcacc8dc2e1e0daca8ad83ffe4
-
SHA1
49d99d21ee7070f9923e53247dff9359cef66e56
-
SHA256
8d6a931a8e8a65cf3a98fc2ee69ded2bd91ee03ef6677c6f653561dd4742ce17
-
SHA512
962605b126e84500a0039b6ddcc2dd6686c942e2aa762d09ab49f97200812721c837770e116f5cb0477ce6ce145529830ef6cfafadb311944c28d388a3ee68dc
Malware Config
Extracted
Family
smokeloader
Version
2020
C2
http://rexstat35x.xyz/statweb955/
http://dexspot2x.xyz/statweb955/
http://atxspot20x.xyz/statweb955/
http://rexspot7x.xyz/statweb955/
http://fdmail85.club/statweb955/
http://servicem977x.xyz/statweb955/
http://advertxman7x.xyz/statweb955/
http://starxpush7x.xyz/statweb955/
rc4.i32
rc4.i32
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 5 IoCs
pid Process 1964 7E.exe 1968 1E5.exe 832 2F0.exe 1368 4A5.exe 1496 5DE.exe -
Deletes itself 1 IoCs
pid Process 1208 Process not Found -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7E.exe 7E.exe -
Loads dropped DLL 2 IoCs
pid Process 1876 2020-08-16_12-33-29.bin.exe 1208 Process not Found -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7E.exe = "C:\\Windows\\System32\\7E.exe" 7E.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-1131729243-447456001-3632642222-1000\desktop.ini 7E.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\System32\7E.exe 7E.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 240 set thread context of 1876 240 2020-08-16_12-33-29.bin.exe 26 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2020-08-16_12-33-29.bin.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2020-08-16_12-33-29.bin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2020-08-16_12-33-29.bin.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 836 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1876 2020-08-16_12-33-29.bin.exe 1876 2020-08-16_12-33-29.bin.exe 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1208 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1876 2020-08-16_12-33-29.bin.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 240 wrote to memory of 1876 240 2020-08-16_12-33-29.bin.exe 26 PID 240 wrote to memory of 1876 240 2020-08-16_12-33-29.bin.exe 26 PID 240 wrote to memory of 1876 240 2020-08-16_12-33-29.bin.exe 26 PID 240 wrote to memory of 1876 240 2020-08-16_12-33-29.bin.exe 26 PID 240 wrote to memory of 1876 240 2020-08-16_12-33-29.bin.exe 26 PID 240 wrote to memory of 1876 240 2020-08-16_12-33-29.bin.exe 26 PID 240 wrote to memory of 1876 240 2020-08-16_12-33-29.bin.exe 26 PID 1208 wrote to memory of 1964 1208 Process not Found 29 PID 1208 wrote to memory of 1964 1208 Process not Found 29 PID 1208 wrote to memory of 1964 1208 Process not Found 29 PID 1208 wrote to memory of 1964 1208 Process not Found 29 PID 1208 wrote to memory of 1968 1208 Process not Found 30 PID 1208 wrote to memory of 1968 1208 Process not Found 30 PID 1208 wrote to memory of 1968 1208 Process not Found 30 PID 1208 wrote to memory of 1968 1208 Process not Found 30 PID 1208 wrote to memory of 832 1208 Process not Found 31 PID 1208 wrote to memory of 832 1208 Process not Found 31 PID 1208 wrote to memory of 832 1208 Process not Found 31 PID 1964 wrote to memory of 2016 1964 7E.exe 32 PID 1964 wrote to memory of 2016 1964 7E.exe 32 PID 1964 wrote to memory of 2016 1964 7E.exe 32 PID 1964 wrote to memory of 2016 1964 7E.exe 32 PID 1208 wrote to memory of 1368 1208 Process not Found 34 PID 1208 wrote to memory of 1368 1208 Process not Found 34 PID 1208 wrote to memory of 1368 1208 Process not Found 34 PID 1208 wrote to memory of 1368 1208 Process not Found 34 PID 2016 wrote to memory of 804 2016 cmd.exe 35 PID 2016 wrote to memory of 804 2016 cmd.exe 35 PID 2016 wrote to memory of 804 2016 cmd.exe 35 PID 2016 wrote to memory of 836 2016 cmd.exe 36 PID 2016 wrote to memory of 836 2016 cmd.exe 36 PID 2016 wrote to memory of 836 2016 cmd.exe 36 PID 1208 wrote to memory of 1496 1208 Process not Found 37 PID 1208 wrote to memory of 1496 1208 Process not Found 37 PID 1208 wrote to memory of 1496 1208 Process not Found 37 PID 1208 wrote to memory of 1496 1208 Process not Found 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\2020-08-16_12-33-29.bin.exe"C:\Users\Admin\AppData\Local\Temp\2020-08-16_12-33-29.bin.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Users\Admin\AppData\Local\Temp\2020-08-16_12-33-29.bin.exe"C:\Users\Admin\AppData\Local\Temp\2020-08-16_12-33-29.bin.exe"2⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1876
-
-
C:\Users\Admin\AppData\Local\Temp\7E.exeC:\Users\Admin\AppData\Local\Temp\7E.exe1⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:804
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:836
-
-
-
C:\Users\Admin\AppData\Local\Temp\1E5.exeC:\Users\Admin\AppData\Local\Temp\1E5.exe1⤵
- Executes dropped EXE
PID:1968
-
C:\Users\Admin\AppData\Local\Temp\2F0.exeC:\Users\Admin\AppData\Local\Temp\2F0.exe1⤵
- Executes dropped EXE
PID:832
-
C:\Users\Admin\AppData\Local\Temp\4A5.exeC:\Users\Admin\AppData\Local\Temp\4A5.exe1⤵
- Executes dropped EXE
PID:1368
-
C:\Users\Admin\AppData\Local\Temp\5DE.exeC:\Users\Admin\AppData\Local\Temp\5DE.exe1⤵
- Executes dropped EXE
PID:1496