Overview

overview

10

Static

static

7c9eba57cb...91.exe

windows7_x64

10

7c9eba57cb...91.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    7c9eba57cb8262a908dc10929cf38b8e4e0af9f5a3f69bdf226b151761580e91.exe
  • Size 181KB
  • Sample200827-m1jren2nas
  • SHA256 7c9eba57cb8262a908dc10929cf38b8e4e0af9f5a3f69bdf226b151761580e91
  • MD5 SHA1 SHA512
Score
10/10
dharmasmokeloaderbackdoorpersistenceransomwaretrojan

Malware Config

Extracted

Family

  • smokeloader

Version

  • 2020

C2

  • http://rexstat35x.xyz/statweb955/

  • http://dexspot2x.xyz/statweb955/

  • http://atxspot20x.xyz/statweb955/

  • http://rexspot7x.xyz/statweb955/

  • http://fdmail85.club/statweb955/

  • http://servicem977x.xyz/statweb955/

  • http://advertxman7x.xyz/statweb955/

  • http://starxpush7x.xyz/statweb955/

rc4.i32
rc4.i32

Targets

    • Target
      7c9eba57cb8262a908dc10929cf38b8e4e0af9f5a3f69bdf226b151761580e91.exe
    • Size 181KB
    • SHA256 7c9eba57cb8262a908dc10929cf38b8e4e0af9f5a3f69bdf226b151761580e91
    • MD5 SHA1 SHA512
    Score
    10/10
    ransomwaretrojanbackdoorsmokeloaderdharmapersistence

    • Dharma

      Dharma is a ransomware that uses security software installation to hide malicious activities.

      ransomwaredharma

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Executes dropped EXE

    • Deletes itself

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks