Overview

overview

10

Static

static

7c9eba57cb...91.exe

windows7_x64

10

7c9eba57cb...91.exe

windows10_x64

10

Resubmissions

27-08-2020 15:47

200827-m1jren2nas 10

Analysis

  • max time kernel
    26s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    27-08-2020 15:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7c9eba57cb8262a908dc10929cf38b8e4e0af9f5a3f69bdf226b151761580e91.exe

  • Size

    181KB

  • MD5

    80d3605d4b180cdd2fef6cb6312942bd

  • SHA1

    12386eee0db55c3c612c92b7912d6f5eceaaffdc

  • SHA256

    7c9eba57cb8262a908dc10929cf38b8e4e0af9f5a3f69bdf226b151761580e91

  • SHA512

    cfb0f5785978586aeaec6a832f0dfae13039c07f977f0afb63fcdbb27981b7bc95ecaf202c7a5ddfec9b47bbf1c5c00c2cfdbc471035311b2458dec6a2e65fd9

Score
10/10
trojanbackdoorsmokeloaderransomwaredharmapersistence

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://rexstat35x.xyz/statweb955/

http://dexspot2x.xyz/statweb955/

http://atxspot20x.xyz/statweb955/

http://rexspot7x.xyz/statweb955/

http://fdmail85.club/statweb955/

http://servicem977x.xyz/statweb955/

http://advertxman7x.xyz/statweb955/

http://starxpush7x.xyz/statweb955/
rc4.i32
rc4.i32

Signatures

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Executes dropped EXE 4 IoCs
  • Deletes itself 1 IoCs
  • Drops startup file 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 3 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 2686 IoCs
  • Drops file in Windows directory 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 352 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7c9eba57cb8262a908dc10929cf38b8e4e0af9f5a3f69bdf226b151761580e91.exe
    "C:\Users\Admin\AppData\Local\Temp\7c9eba57cb8262a908dc10929cf38b8e4e0af9f5a3f69bdf226b151761580e91.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3020
    • C:\Users\Admin\AppData\Local\Temp\7c9eba57cb8262a908dc10929cf38b8e4e0af9f5a3f69bdf226b151761580e91.exe
      "C:\Users\Admin\AppData\Local\Temp\7c9eba57cb8262a908dc10929cf38b8e4e0af9f5a3f69bdf226b151761580e91.exe"
      2⤵
      • Loads dropped DLL
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:1576
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
    1⤵
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:996
  • C:\Users\Admin\AppData\Local\Temp\6E31.exe
    C:\Users\Admin\AppData\Local\Temp\6E31.exe
    1⤵
    • Executes dropped EXE
    • Drops startup file
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2132
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2544
      • C:\Windows\system32\mode.com
        mode con cp select=1251
        3⤵
          PID:8
    • C:\Users\Admin\AppData\Local\Temp\6EFD.exe
      C:\Users\Admin\AppData\Local\Temp\6EFD.exe
      1⤵
      • Executes dropped EXE
      PID:2452
    • C:\Users\Admin\AppData\Local\Temp\715F.exe
      C:\Users\Admin\AppData\Local\Temp\715F.exe
      1⤵
      • Executes dropped EXE
      PID:2184
    • C:\Users\Admin\AppData\Local\Temp\76FE.exe
      C:\Users\Admin\AppData\Local\Temp\76FE.exe
      1⤵
      • Executes dropped EXE
      PID:3024

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1576-2-0x0000000000400000-0x000000000040A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/2132-12-0x0000000003383000-0x0000000003384000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2132-13-0x0000000003920000-0x0000000003921000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2452-14-0x0000000003563000-0x0000000003564000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2452-20-0x0000000003910000-0x0000000003911000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3000-5-0x0000000000C70000-0x0000000000C86000-memory.dmp

      Filesize

      88KB

      Download

    • memory/3020-0-0x000000000334C000-0x000000000334D000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3020-1-0x0000000005010000-0x0000000005011000-memory.dmp

      Filesize

      4KB

      Download