Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

01/11/2020, 15:20

201101-6gnva6fyd2 10

01/11/2020, 15:16

201101-dvbselbzxx 10

Analysis

  • max time kernel
    77s
  • max time network
    136s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    01/11/2020, 15:16

General

  • Target

    2020-11-01_21-26-29.bin.exe

  • Size

    234KB

  • MD5

    dd22d3a34781601ebbe3020b7cd33356

  • SHA1

    567dd97232f0cf9ecec13f82ff894d9c9ee0d013

  • SHA256

    33fe9bbda8cc1dbaa70e85a203fb6a0ec2a82ce2edb0c5ac585be620e8b8a1b0

  • SHA512

    c6c4d353a76b1a0c35791c58935ec426d3d67c2133cffb5332c5ab71c5424f5ba1acf398fd210285676f5b838646192791f67a8edceddfa7e4b0722cbef39316

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://etasuklavish.today/

http://mragyzmachnobesdi.today/

http://kimchinikuzims.today/

http://slacvostinrius.today/

http://straponuliusyn.today/

http://grammmdinss.today/

http://viprasputinsd.chimkent.su/

http://lupadypa.dagestan.su/

http://stoknolimchin.exnet.su/

http://musaroprovadnikov.live/

http://teemforyourexprensiti.life/

http://stolkgolmishutich.termez.su/

http://roompampamgandish.wtf/

rc4.i32
rc4.i32

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Executes dropped EXE 1 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 1256 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2020-11-01_21-26-29.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\2020-11-01_21-26-29.bin.exe"
    1⤵
    • Loads dropped DLL
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:492
  • C:\Users\Admin\AppData\Local\Temp\C4CC.tmp.exe
    C:\Users\Admin\AppData\Local\Temp\C4CC.tmp.exe
    1⤵
    • Executes dropped EXE
    PID:2012

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/492-0-0x00000000025B4000-0x00000000025B5000-memory.dmp

    Filesize

    4KB

  • memory/492-1-0x0000000004080000-0x0000000004081000-memory.dmp

    Filesize

    4KB

  • memory/2012-7-0x0000000002404000-0x0000000002405000-memory.dmp

    Filesize

    4KB

  • memory/2012-8-0x0000000004020000-0x0000000004021000-memory.dmp

    Filesize

    4KB

  • memory/3016-3-0x0000000000E30000-0x0000000000E46000-memory.dmp

    Filesize

    88KB