Analysis

  • max time kernel
    210s
  • max time network
    275s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    01-11-2020 15:20

General

  • Target

    2020-11-01_21-26-29.bin.exe

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://etasuklavish.today/

http://mragyzmachnobesdi.today/

http://kimchinikuzims.today/

http://slacvostinrius.today/

http://straponuliusyn.today/

http://grammmdinss.today/

http://viprasputinsd.chimkent.su/

http://lupadypa.dagestan.su/

http://stoknolimchin.exnet.su/

http://musaroprovadnikov.live/

http://teemforyourexprensiti.life/

http://stolkgolmishutich.termez.su/

http://roompampamgandish.wtf/

rc4.i32
rc4.i32

Extracted

Family

zloader

Botnet

r1

Campaign

r1

C2

https://notsweets.net/LKhwojehDgwegSDG/gateJKjdsh.php

https://olpons.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://karamelliar.org/LKhwojehDgwegSDG/gateJKjdsh.php

https://dogrunn.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://azoraz.net/LKhwojehDgwegSDG/gateJKjdsh.php

rc4.plain
rsa_pubkey.plain

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

  • Executes dropped EXE ⋅ 2 IoCs
  • Deletes itself ⋅ 1 IoCs
  • Loads dropped DLL ⋅ 6 IoCs
  • Program crash ⋅ 1 IoCs
  • Checks SCSI registry key(s) ⋅ 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses ⋅ 1066 IoCs
  • Suspicious behavior: GetForegroundWindowSpam ⋅ 1 IoCs
  • Suspicious behavior: MapViewOfSection ⋅ 1 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 3 IoCs
  • Suspicious use of FindShellTrayWindow ⋅ 6 IoCs
  • Suspicious use of SendNotifyMessage ⋅ 27 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2020-11-01_21-26-29.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\2020-11-01_21-26-29.bin.exe"
    Loads dropped DLL
    Checks SCSI registry key(s)
    Suspicious behavior: EnumeratesProcesses
    Suspicious behavior: MapViewOfSection
    PID:1808
  • C:\Users\Admin\AppData\Local\Temp\D578.tmp.exe
    C:\Users\Admin\AppData\Local\Temp\D578.tmp.exe
    Executes dropped EXE
    PID:596
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {70316B05-A676-4AB5-9C4E-D8DCC111FCF9} S-1-5-21-3825035466-2522850611-591511364-1000:EIDQHRRL\Admin:Interactive:[1]
    Suspicious use of WriteProcessMemory
    PID:1076
    • C:\Users\Admin\AppData\Roaming\wssujtt
      C:\Users\Admin\AppData\Roaming\wssujtt
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1816
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 128
        Loads dropped DLL
        Program crash
        Suspicious use of AdjustPrivilegeToken
        PID:668

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Execution

            Exfiltration

              Impact

                Initial Access

                  Lateral Movement

                    Persistence

                      Privilege Escalation

                        Replay Monitor

                        00:00 00:00

                        Downloads

                        • C:\Users\Admin\AppData\Local\Temp\2F6.tmp
                          MD5

                          d124f55b9393c976963407dff51ffa79

                          SHA1

                          2c7bbedd79791bfb866898c85b504186db610b5d

                          SHA256

                          ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

                          SHA512

                          278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

                        • C:\Users\Admin\AppData\Local\Temp\D578.tmp.exe
                          MD5

                          6f92feaff2623303f213d30945371729

                          SHA1

                          e674d4acc578784b62e07a6700f3e69429c14116

                          SHA256

                          81bc4e155b83348097407cd8f766b137ca0ad0d86175f8c2d9f456e87322b613

                          SHA512

                          803ea4e462eff8c12e4654a97745821497e60ad63e1e406e7aa17ab5139621691986059cd6349cdcb8356d5bd1ebbd0aacb5ddf9142a36485c17112a110af03d

                        • C:\Users\Admin\AppData\Local\Temp\D578.tmp.exe
                          MD5

                          379a349d07c3868fdaadc8e3ec12b599

                          SHA1

                          8d2baed856232fc0f52a3ba30109aeac50034ed7

                          SHA256

                          1546dcf0f1d4721adc53ddeb7b66dbe800f21050621972afb975577f49e7bff4

                          SHA512

                          954840bfbb391e6f7f3f672a723b335124c73eb93fe4cf738866175bfd6e5167e3206a6cb5a0039a1ccca9e6a2519b3e1eb761dcc85ffccf6e20864e6385159a

                        • C:\Users\Admin\AppData\Roaming\Ivyr
                          MD5

                          d41d8cd98f00b204e9800998ecf8427e

                          SHA1

                          da39a3ee5e6b4b0d3255bfef95601890afd80709

                          SHA256

                          e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                          SHA512

                          cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                        • C:\Users\Admin\AppData\Roaming\wssujtt
                          MD5

                          dd22d3a34781601ebbe3020b7cd33356

                          SHA1

                          567dd97232f0cf9ecec13f82ff894d9c9ee0d013

                          SHA256

                          33fe9bbda8cc1dbaa70e85a203fb6a0ec2a82ce2edb0c5ac585be620e8b8a1b0

                          SHA512

                          c6c4d353a76b1a0c35791c58935ec426d3d67c2133cffb5332c5ab71c5424f5ba1acf398fd210285676f5b838646192791f67a8edceddfa7e4b0722cbef39316

                        • C:\Users\Admin\AppData\Roaming\wssujtt
                          MD5

                          dd22d3a34781601ebbe3020b7cd33356

                          SHA1

                          567dd97232f0cf9ecec13f82ff894d9c9ee0d013

                          SHA256

                          33fe9bbda8cc1dbaa70e85a203fb6a0ec2a82ce2edb0c5ac585be620e8b8a1b0

                          SHA512

                          c6c4d353a76b1a0c35791c58935ec426d3d67c2133cffb5332c5ab71c5424f5ba1acf398fd210285676f5b838646192791f67a8edceddfa7e4b0722cbef39316

                        • \Users\Admin\AppData\Local\Temp\2F6.tmp
                          MD5

                          d124f55b9393c976963407dff51ffa79

                          SHA1

                          2c7bbedd79791bfb866898c85b504186db610b5d

                          SHA256

                          ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

                          SHA512

                          278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

                        • \Users\Admin\AppData\Roaming\wssujtt
                          MD5

                          dd22d3a34781601ebbe3020b7cd33356

                          SHA1

                          567dd97232f0cf9ecec13f82ff894d9c9ee0d013

                          SHA256

                          33fe9bbda8cc1dbaa70e85a203fb6a0ec2a82ce2edb0c5ac585be620e8b8a1b0

                          SHA512

                          c6c4d353a76b1a0c35791c58935ec426d3d67c2133cffb5332c5ab71c5424f5ba1acf398fd210285676f5b838646192791f67a8edceddfa7e4b0722cbef39316

                        • \Users\Admin\AppData\Roaming\wssujtt
                          MD5

                          dd22d3a34781601ebbe3020b7cd33356

                          SHA1

                          567dd97232f0cf9ecec13f82ff894d9c9ee0d013

                          SHA256

                          33fe9bbda8cc1dbaa70e85a203fb6a0ec2a82ce2edb0c5ac585be620e8b8a1b0

                          SHA512

                          c6c4d353a76b1a0c35791c58935ec426d3d67c2133cffb5332c5ab71c5424f5ba1acf398fd210285676f5b838646192791f67a8edceddfa7e4b0722cbef39316

                        • \Users\Admin\AppData\Roaming\wssujtt
                          MD5

                          dd22d3a34781601ebbe3020b7cd33356

                          SHA1

                          567dd97232f0cf9ecec13f82ff894d9c9ee0d013

                          SHA256

                          33fe9bbda8cc1dbaa70e85a203fb6a0ec2a82ce2edb0c5ac585be620e8b8a1b0

                          SHA512

                          c6c4d353a76b1a0c35791c58935ec426d3d67c2133cffb5332c5ab71c5424f5ba1acf398fd210285676f5b838646192791f67a8edceddfa7e4b0722cbef39316

                        • \Users\Admin\AppData\Roaming\wssujtt
                          MD5

                          dd22d3a34781601ebbe3020b7cd33356

                          SHA1

                          567dd97232f0cf9ecec13f82ff894d9c9ee0d013

                          SHA256

                          33fe9bbda8cc1dbaa70e85a203fb6a0ec2a82ce2edb0c5ac585be620e8b8a1b0

                          SHA512

                          c6c4d353a76b1a0c35791c58935ec426d3d67c2133cffb5332c5ab71c5424f5ba1acf398fd210285676f5b838646192791f67a8edceddfa7e4b0722cbef39316

                        • \Users\Admin\AppData\Roaming\wssujtt
                          MD5

                          dd22d3a34781601ebbe3020b7cd33356

                          SHA1

                          567dd97232f0cf9ecec13f82ff894d9c9ee0d013

                          SHA256

                          33fe9bbda8cc1dbaa70e85a203fb6a0ec2a82ce2edb0c5ac585be620e8b8a1b0

                          SHA512

                          c6c4d353a76b1a0c35791c58935ec426d3d67c2133cffb5332c5ab71c5424f5ba1acf398fd210285676f5b838646192791f67a8edceddfa7e4b0722cbef39316

                        • memory/340-36-0x0000000000000000-mapping.dmp
                        • memory/548-38-0x0000000000000000-mapping.dmp
                        • memory/560-43-0x0000000005950000-0x0000000005B2B000-memory.dmp
                        • memory/560-30-0x00000000000C0000-0x00000000000C1000-memory.dmp
                        • memory/560-31-0x0000000000090000-0x00000000000B8000-memory.dmp
                        • memory/560-32-0x0000000000000000-mapping.dmp
                        • memory/560-29-0x0000000000090000-0x00000000000B8000-memory.dmp
                        • memory/596-7-0x0000000003D00000-0x0000000003D11000-memory.dmp
                        • memory/596-4-0x0000000000000000-mapping.dmp
                        • memory/596-6-0x00000000023C9000-0x00000000023CA000-memory.dmp
                        • memory/668-15-0x0000000000000000-mapping.dmp
                        • memory/668-16-0x0000000001FE0000-0x0000000001FF1000-memory.dmp
                        • memory/668-18-0x0000000001FE0000-0x0000000001FF1000-memory.dmp
                        • memory/668-24-0x0000000002500000-0x0000000002511000-memory.dmp
                        • memory/836-44-0x0000000000000000-mapping.dmp
                        • memory/940-37-0x0000000000000000-mapping.dmp
                        • memory/1084-35-0x000007FEF5D50000-0x000007FEF5FCA000-memory.dmp
                        • memory/1196-45-0x0000000000000000-mapping.dmp
                        • memory/1208-41-0x0000000000000000-mapping.dmp
                        • memory/1244-3-0x0000000002BB0000-0x0000000002BC6000-memory.dmp
                        • memory/1632-42-0x0000000000000000-mapping.dmp
                        • memory/1648-40-0x0000000000000000-mapping.dmp
                        • memory/1808-1-0x0000000003C40000-0x0000000003C51000-memory.dmp
                        • memory/1808-0-0x0000000002769000-0x000000000276A000-memory.dmp
                        • memory/1816-11-0x0000000000279000-0x000000000027A000-memory.dmp
                        • memory/1816-12-0x0000000003CF0000-0x0000000003D01000-memory.dmp
                        • memory/1816-23-0x0000000000000000-mapping.dmp
                        • memory/1816-9-0x0000000000000000-mapping.dmp
                        • memory/1816-14-0x0000000003CF0000-0x0000000003D01000-memory.dmp
                        • memory/1944-39-0x0000000000000000-mapping.dmp