Overview

overview

10

Static

static

7c9eba57cb...91.exe

windows7_x64

10

7c9eba57cb...91.exe

windows10_x64

10

Resubmissions

27-08-2020 15:47

200827-m1jren2nas 10

Analysis

  • max time kernel
    129s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    27-08-2020 15:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7c9eba57cb8262a908dc10929cf38b8e4e0af9f5a3f69bdf226b151761580e91.exe

  • Size

    181KB

  • MD5

    80d3605d4b180cdd2fef6cb6312942bd

  • SHA1

    12386eee0db55c3c612c92b7912d6f5eceaaffdc

  • SHA256

    7c9eba57cb8262a908dc10929cf38b8e4e0af9f5a3f69bdf226b151761580e91

  • SHA512

    cfb0f5785978586aeaec6a832f0dfae13039c07f977f0afb63fcdbb27981b7bc95ecaf202c7a5ddfec9b47bbf1c5c00c2cfdbc471035311b2458dec6a2e65fd9

Score
10/10
ransomwaretrojanbackdoorsmokeloaderdharmapersistence

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://rexstat35x.xyz/statweb955/

http://dexspot2x.xyz/statweb955/

http://atxspot20x.xyz/statweb955/

http://rexspot7x.xyz/statweb955/

http://fdmail85.club/statweb955/

http://servicem977x.xyz/statweb955/

http://advertxman7x.xyz/statweb955/

http://starxpush7x.xyz/statweb955/
rc4.i32
rc4.i32

Signatures

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Executes dropped EXE 5 IoCs
  • Deletes itself 1 IoCs
  • Drops startup file 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 256 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 636 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7c9eba57cb8262a908dc10929cf38b8e4e0af9f5a3f69bdf226b151761580e91.exe
    "C:\Users\Admin\AppData\Local\Temp\7c9eba57cb8262a908dc10929cf38b8e4e0af9f5a3f69bdf226b151761580e91.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1420
    • C:\Users\Admin\AppData\Local\Temp\7c9eba57cb8262a908dc10929cf38b8e4e0af9f5a3f69bdf226b151761580e91.exe
      "C:\Users\Admin\AppData\Local\Temp\7c9eba57cb8262a908dc10929cf38b8e4e0af9f5a3f69bdf226b151761580e91.exe"
      2⤵
      • Loads dropped DLL
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:1800
  • C:\Users\Admin\AppData\Local\Temp\A248.exe
    C:\Users\Admin\AppData\Local\Temp\A248.exe
    1⤵
    • Executes dropped EXE
    • Drops startup file
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:1548
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1912
      • C:\Windows\system32\mode.com
        mode con cp select=1251
        3⤵
          PID:572
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          3⤵
          • Interacts with shadow copies
          PID:1868
    • C:\Users\Admin\AppData\Local\Temp\A362.exe
      C:\Users\Admin\AppData\Local\Temp\A362.exe
      1⤵
      • Executes dropped EXE
      PID:1944
    • C:\Users\Admin\AppData\Local\Temp\A778.exe
      C:\Users\Admin\AppData\Local\Temp\A778.exe
      1⤵
      • Executes dropped EXE
      PID:1196
    • C:\Users\Admin\AppData\Local\Temp\AB11.exe
      C:\Users\Admin\AppData\Local\Temp\AB11.exe
      1⤵
      • Executes dropped EXE
      PID:932
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
        PID:692
      • C:\Users\Admin\AppData\Local\Temp\ACF6.exe
        C:\Users\Admin\AppData\Local\Temp\ACF6.exe
        1⤵
        • Executes dropped EXE
        PID:912

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1236-6-0x0000000002780000-0x0000000002796000-memory.dmp

        Filesize

        88KB

        Download

      • memory/1420-0-0x00000000034AF000-0x00000000034B0000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1420-1-0x0000000004E30000-0x0000000004E41000-memory.dmp

        Filesize

        68KB

        Download

      • memory/1420-2-0x0000000004E30000-0x0000000004E41000-memory.dmp

        Filesize

        68KB

        Download

      • memory/1548-12-0x00000000033D0000-0x00000000033E1000-memory.dmp

        Filesize

        68KB

        Download

      • memory/1548-11-0x000000000026A000-0x000000000026B000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1800-3-0x0000000000400000-0x000000000040A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/1944-17-0x0000000003660000-0x0000000003671000-memory.dmp

        Filesize

        68KB

        Download

      • memory/1944-15-0x000000000341A000-0x000000000341B000-memory.dmp

        Filesize

        4KB

        Download