Overview

overview

10

Static

static

7c9eba57cb...91.exe

windows7_x64

10

7c9eba57cb...91.exe

windows10_x64

10

Analysis

  • max time kernel
    26s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    27/08/2020, 15:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    7c9eba57cb8262a908dc10929cf38b8e4e0af9f5a3f69bdf226b151761580e91.exe
  • Size 181KB
  • Sample200827-m1jren2nas
  • SHA256 7c9eba57cb8262a908dc10929cf38b8e4e0af9f5a3f69bdf226b151761580e91
  • MD5 SHA1 SHA512
Score
10/10
trojanbackdoorsmokeloaderransomwaredharmapersistence

Malware Config

Extracted

Family

  • smokeloader

Version

  • 2020

C2

  • http://rexstat35x.xyz/statweb955/

  • http://dexspot2x.xyz/statweb955/

  • http://atxspot20x.xyz/statweb955/

  • http://rexspot7x.xyz/statweb955/

  • http://fdmail85.club/statweb955/

  • http://servicem977x.xyz/statweb955/

  • http://advertxman7x.xyz/statweb955/

  • http://starxpush7x.xyz/statweb955/

rc4.i32
rc4.i32

Signatures

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Executes dropped EXE 4 IoCs
  • Deletes itself 1 IoCs
  • Drops startup file 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 3 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 2686 IoCs
  • Drops file in Windows directory 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 352 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7c9eba57cb8262a908dc10929cf38b8e4e0af9f5a3f69bdf226b151761580e91.exe
    "C:\Users\Admin\AppData\Local\Temp\7c9eba57cb8262a908dc10929cf38b8e4e0af9f5a3f69bdf226b151761580e91.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3020
    • C:\Users\Admin\AppData\Local\Temp\7c9eba57cb8262a908dc10929cf38b8e4e0af9f5a3f69bdf226b151761580e91.exe
      "C:\Users\Admin\AppData\Local\Temp\7c9eba57cb8262a908dc10929cf38b8e4e0af9f5a3f69bdf226b151761580e91.exe"
      2⤵
      • Loads dropped DLL
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:1576
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
    1⤵
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:996
  • C:\Users\Admin\AppData\Local\Temp\6E31.exe
    C:\Users\Admin\AppData\Local\Temp\6E31.exe
    1⤵
    • Executes dropped EXE
    • Drops startup file
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2132
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2544
      • C:\Windows\system32\mode.com
        mode con cp select=1251
        3⤵
          PID:8
    • C:\Users\Admin\AppData\Local\Temp\6EFD.exe
      C:\Users\Admin\AppData\Local\Temp\6EFD.exe
      1⤵
      • Executes dropped EXE
      PID:2452
    • C:\Users\Admin\AppData\Local\Temp\715F.exe
      C:\Users\Admin\AppData\Local\Temp\715F.exe
      1⤵
      • Executes dropped EXE
      PID:2184
    • C:\Users\Admin\AppData\Local\Temp\76FE.exe
      C:\Users\Admin\AppData\Local\Temp\76FE.exe
      1⤵
      • Executes dropped EXE
      PID:3024

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/1576-2-0x0000000000400000-0x000000000040A000-memory.dmp
          Download

          memory/2132-12-0x0000000003383000-0x0000000003384000-memory.dmp
          Download

          memory/2132-13-0x0000000003920000-0x0000000003921000-memory.dmp
          Download

          memory/2452-14-0x0000000003563000-0x0000000003564000-memory.dmp
          Download

          memory/2452-20-0x0000000003910000-0x0000000003911000-memory.dmp
          Download

          memory/3000-5-0x0000000000C70000-0x0000000000C86000-memory.dmp
          Download

          memory/3020-0-0x000000000334C000-0x000000000334D000-memory.dmp
          Download

          memory/3020-1-0x0000000005010000-0x0000000005011000-memory.dmp
          Download