Resubmissions

01-11-2020 15:20

201101-6gnva6fyd2 10

01-11-2020 15:16

201101-dvbselbzxx 10

Analysis

  • max time kernel
    210s
  • max time network
    275s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    01-11-2020 15:20

General

  • Target

    2020-11-01_21-26-29.bin.exe

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://etasuklavish.today/

http://mragyzmachnobesdi.today/

http://kimchinikuzims.today/

http://slacvostinrius.today/

http://straponuliusyn.today/

http://grammmdinss.today/

http://viprasputinsd.chimkent.su/

http://lupadypa.dagestan.su/

http://stoknolimchin.exnet.su/

http://musaroprovadnikov.live/

http://teemforyourexprensiti.life/

http://stolkgolmishutich.termez.su/

http://roompampamgandish.wtf/

rc4.i32
rc4.i32

Extracted

Family

zloader

Botnet

r1

Campaign

r1

C2

https://notsweets.net/LKhwojehDgwegSDG/gateJKjdsh.php

https://olpons.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://karamelliar.org/LKhwojehDgwegSDG/gateJKjdsh.php

https://dogrunn.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://azoraz.net/LKhwojehDgwegSDG/gateJKjdsh.php

rc4.plain
rsa_pubkey.plain

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

  • Executes dropped EXE 2 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 1066 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 27 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2020-11-01_21-26-29.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\2020-11-01_21-26-29.bin.exe"
    1⤵
    • Loads dropped DLL
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:1808
  • C:\Users\Admin\AppData\Local\Temp\D578.tmp.exe
    C:\Users\Admin\AppData\Local\Temp\D578.tmp.exe
    1⤵
    • Executes dropped EXE
    PID:596
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {70316B05-A676-4AB5-9C4E-D8DCC111FCF9} S-1-5-21-3825035466-2522850611-591511364-1000:EIDQHRRL\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1076
    • C:\Users\Admin\AppData\Roaming\wssujtt
      C:\Users\Admin\AppData\Roaming\wssujtt
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1816
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 128
        3⤵
        • Loads dropped DLL
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:668

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\2F6.tmp
    MD5

    d124f55b9393c976963407dff51ffa79

    SHA1

    2c7bbedd79791bfb866898c85b504186db610b5d

    SHA256

    ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

    SHA512

    278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

  • C:\Users\Admin\AppData\Local\Temp\D578.tmp.exe
    MD5

    6f92feaff2623303f213d30945371729

    SHA1

    e674d4acc578784b62e07a6700f3e69429c14116

    SHA256

    81bc4e155b83348097407cd8f766b137ca0ad0d86175f8c2d9f456e87322b613

    SHA512

    803ea4e462eff8c12e4654a97745821497e60ad63e1e406e7aa17ab5139621691986059cd6349cdcb8356d5bd1ebbd0aacb5ddf9142a36485c17112a110af03d

  • C:\Users\Admin\AppData\Local\Temp\D578.tmp.exe
    MD5

    379a349d07c3868fdaadc8e3ec12b599

    SHA1

    8d2baed856232fc0f52a3ba30109aeac50034ed7

    SHA256

    1546dcf0f1d4721adc53ddeb7b66dbe800f21050621972afb975577f49e7bff4

    SHA512

    954840bfbb391e6f7f3f672a723b335124c73eb93fe4cf738866175bfd6e5167e3206a6cb5a0039a1ccca9e6a2519b3e1eb761dcc85ffccf6e20864e6385159a

  • C:\Users\Admin\AppData\Roaming\Ivyr
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • C:\Users\Admin\AppData\Roaming\wssujtt
    MD5

    dd22d3a34781601ebbe3020b7cd33356

    SHA1

    567dd97232f0cf9ecec13f82ff894d9c9ee0d013

    SHA256

    33fe9bbda8cc1dbaa70e85a203fb6a0ec2a82ce2edb0c5ac585be620e8b8a1b0

    SHA512

    c6c4d353a76b1a0c35791c58935ec426d3d67c2133cffb5332c5ab71c5424f5ba1acf398fd210285676f5b838646192791f67a8edceddfa7e4b0722cbef39316

  • C:\Users\Admin\AppData\Roaming\wssujtt
    MD5

    dd22d3a34781601ebbe3020b7cd33356

    SHA1

    567dd97232f0cf9ecec13f82ff894d9c9ee0d013

    SHA256

    33fe9bbda8cc1dbaa70e85a203fb6a0ec2a82ce2edb0c5ac585be620e8b8a1b0

    SHA512

    c6c4d353a76b1a0c35791c58935ec426d3d67c2133cffb5332c5ab71c5424f5ba1acf398fd210285676f5b838646192791f67a8edceddfa7e4b0722cbef39316

  • \Users\Admin\AppData\Local\Temp\2F6.tmp
    MD5

    d124f55b9393c976963407dff51ffa79

    SHA1

    2c7bbedd79791bfb866898c85b504186db610b5d

    SHA256

    ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

    SHA512

    278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

  • \Users\Admin\AppData\Roaming\wssujtt
    MD5

    dd22d3a34781601ebbe3020b7cd33356

    SHA1

    567dd97232f0cf9ecec13f82ff894d9c9ee0d013

    SHA256

    33fe9bbda8cc1dbaa70e85a203fb6a0ec2a82ce2edb0c5ac585be620e8b8a1b0

    SHA512

    c6c4d353a76b1a0c35791c58935ec426d3d67c2133cffb5332c5ab71c5424f5ba1acf398fd210285676f5b838646192791f67a8edceddfa7e4b0722cbef39316

  • \Users\Admin\AppData\Roaming\wssujtt
    MD5

    dd22d3a34781601ebbe3020b7cd33356

    SHA1

    567dd97232f0cf9ecec13f82ff894d9c9ee0d013

    SHA256

    33fe9bbda8cc1dbaa70e85a203fb6a0ec2a82ce2edb0c5ac585be620e8b8a1b0

    SHA512

    c6c4d353a76b1a0c35791c58935ec426d3d67c2133cffb5332c5ab71c5424f5ba1acf398fd210285676f5b838646192791f67a8edceddfa7e4b0722cbef39316

  • \Users\Admin\AppData\Roaming\wssujtt
    MD5

    dd22d3a34781601ebbe3020b7cd33356

    SHA1

    567dd97232f0cf9ecec13f82ff894d9c9ee0d013

    SHA256

    33fe9bbda8cc1dbaa70e85a203fb6a0ec2a82ce2edb0c5ac585be620e8b8a1b0

    SHA512

    c6c4d353a76b1a0c35791c58935ec426d3d67c2133cffb5332c5ab71c5424f5ba1acf398fd210285676f5b838646192791f67a8edceddfa7e4b0722cbef39316

  • \Users\Admin\AppData\Roaming\wssujtt
    MD5

    dd22d3a34781601ebbe3020b7cd33356

    SHA1

    567dd97232f0cf9ecec13f82ff894d9c9ee0d013

    SHA256

    33fe9bbda8cc1dbaa70e85a203fb6a0ec2a82ce2edb0c5ac585be620e8b8a1b0

    SHA512

    c6c4d353a76b1a0c35791c58935ec426d3d67c2133cffb5332c5ab71c5424f5ba1acf398fd210285676f5b838646192791f67a8edceddfa7e4b0722cbef39316

  • \Users\Admin\AppData\Roaming\wssujtt
    MD5

    dd22d3a34781601ebbe3020b7cd33356

    SHA1

    567dd97232f0cf9ecec13f82ff894d9c9ee0d013

    SHA256

    33fe9bbda8cc1dbaa70e85a203fb6a0ec2a82ce2edb0c5ac585be620e8b8a1b0

    SHA512

    c6c4d353a76b1a0c35791c58935ec426d3d67c2133cffb5332c5ab71c5424f5ba1acf398fd210285676f5b838646192791f67a8edceddfa7e4b0722cbef39316

  • memory/340-36-0x0000000000000000-mapping.dmp
  • memory/548-38-0x0000000000000000-mapping.dmp
  • memory/560-43-0x0000000005950000-0x0000000005B2B000-memory.dmp
    Filesize

    1.9MB

  • memory/560-30-0x00000000000C0000-0x00000000000C1000-memory.dmp
    Filesize

    4KB

  • memory/560-31-0x0000000000090000-0x00000000000B8000-memory.dmp
    Filesize

    160KB

  • memory/560-32-0x0000000000000000-mapping.dmp
  • memory/560-29-0x0000000000090000-0x00000000000B8000-memory.dmp
    Filesize

    160KB

  • memory/596-7-0x0000000003D00000-0x0000000003D11000-memory.dmp
    Filesize

    68KB

  • memory/596-4-0x0000000000000000-mapping.dmp
  • memory/596-6-0x00000000023C9000-0x00000000023CA000-memory.dmp
    Filesize

    4KB

  • memory/668-15-0x0000000000000000-mapping.dmp
  • memory/668-16-0x0000000001FE0000-0x0000000001FF1000-memory.dmp
    Filesize

    68KB

  • memory/668-18-0x0000000001FE0000-0x0000000001FF1000-memory.dmp
    Filesize

    68KB

  • memory/668-24-0x0000000002500000-0x0000000002511000-memory.dmp
    Filesize

    68KB

  • memory/836-44-0x0000000000000000-mapping.dmp
  • memory/940-37-0x0000000000000000-mapping.dmp
  • memory/1084-35-0x000007FEF5D50000-0x000007FEF5FCA000-memory.dmp
    Filesize

    2.5MB

  • memory/1196-45-0x0000000000000000-mapping.dmp
  • memory/1208-41-0x0000000000000000-mapping.dmp
  • memory/1244-3-0x0000000002BB0000-0x0000000002BC6000-memory.dmp
    Filesize

    88KB

  • memory/1632-42-0x0000000000000000-mapping.dmp
  • memory/1648-40-0x0000000000000000-mapping.dmp
  • memory/1808-1-0x0000000003C40000-0x0000000003C51000-memory.dmp
    Filesize

    68KB

  • memory/1808-0-0x0000000002769000-0x000000000276A000-memory.dmp
    Filesize

    4KB

  • memory/1816-11-0x0000000000279000-0x000000000027A000-memory.dmp
    Filesize

    4KB

  • memory/1816-12-0x0000000003CF0000-0x0000000003D01000-memory.dmp
    Filesize

    68KB

  • memory/1816-23-0x0000000000000000-mapping.dmp
  • memory/1816-9-0x0000000000000000-mapping.dmp
  • memory/1816-14-0x0000000003CF0000-0x0000000003D01000-memory.dmp
    Filesize

    68KB

  • memory/1944-39-0x0000000000000000-mapping.dmp