Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    11/11/2020, 16:41

General

  • Target
    1bc0c00d54843bd715b54f020835a02f.exe
  • Size 326KB
  • Sample201111-vbma5t7jhn
  • SHA256 a99dfa4b60347edac3d2083c96df817bc3dfdc3c206be400723abb594cdb510b
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • smokeloader

Version
  • 2020

C2
  • http://we11wdsgd.com/

rc4.i32
rc4.i32

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Executes dropped EXE 2 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2892 IoCs
  • Suspicious behavior: MapViewOfSection 31 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 70 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1bc0c00d54843bd715b54f020835a02f.exe
    "C:\Users\Admin\AppData\Local\Temp\1bc0c00d54843bd715b54f020835a02f.exe"
    1⤵
    • Loads dropped DLL
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:4768
  • C:\Users\Admin\AppData\Local\Temp\B4CF.exe
    C:\Users\Admin\AppData\Local\Temp\B4CF.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3176
    • C:\Users\Admin\AppData\Local\Temp\B4CF.exe
      C:\Users\Admin\AppData\Local\Temp\B4CF.exe
      2⤵
      • Executes dropped EXE
      PID:3896
  • C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    1⤵
      PID:500
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe
      1⤵
        PID:908
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        1⤵
          PID:1532
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\SysWOW64\explorer.exe
          1⤵
            PID:4492
          • C:\Windows\SysWOW64\explorer.exe
            C:\Windows\SysWOW64\explorer.exe
            1⤵
              PID:4272
            • C:\Windows\explorer.exe
              C:\Windows\explorer.exe
              1⤵
                PID:1540
              • C:\Windows\SysWOW64\explorer.exe
                C:\Windows\SysWOW64\explorer.exe
                1⤵
                  PID:744
                • C:\Windows\explorer.exe
                  C:\Windows\explorer.exe
                  1⤵
                    PID:4156
                  • C:\Windows\SysWOW64\explorer.exe
                    C:\Windows\SysWOW64\explorer.exe
                    1⤵
                      PID:1052
                    • C:\Windows\explorer.exe
                      C:\Windows\explorer.exe
                      1⤵
                        PID:4428
                      • C:\Windows\SysWOW64\explorer.exe
                        C:\Windows\SysWOW64\explorer.exe
                        1⤵
                          PID:4388
                        • C:\Windows\SysWOW64\explorer.exe
                          C:\Windows\SysWOW64\explorer.exe
                          1⤵
                            PID:4732
                          • C:\Windows\SysWOW64\explorer.exe
                            C:\Windows\SysWOW64\explorer.exe
                            1⤵
                              PID:4708
                            • C:\Windows\explorer.exe
                              C:\Windows\explorer.exe
                              1⤵
                                PID:3848
                              • C:\Windows\SysWOW64\explorer.exe
                                C:\Windows\SysWOW64\explorer.exe
                                1⤵
                                  PID:804

                                Network

                                      MITRE ATT&CK Enterprise v6

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      memory/500-10-0x0000000002F20000-0x0000000002F8B000-memory.dmp

                                      memory/500-11-0x0000000002F90000-0x0000000003005000-memory.dmp

                                      memory/744-279-0x00000000032E0000-0x00000000032E5000-memory.dmp

                                      memory/744-276-0x00000000032D0000-0x00000000032D9000-memory.dmp

                                      memory/804-713-0x00000000008D0000-0x00000000008D8000-memory.dmp

                                      memory/804-705-0x00000000008C0000-0x00000000008CB000-memory.dmp

                                      memory/908-17-0x0000000000CC0000-0x0000000000CC7000-memory.dmp

                                      memory/908-15-0x0000000000CB0000-0x0000000000CBC000-memory.dmp

                                      memory/1052-374-0x00000000004D0000-0x00000000004D9000-memory.dmp

                                      memory/1052-379-0x00000000004E0000-0x00000000004E4000-memory.dmp

                                      memory/1532-49-0x0000000002FE0000-0x0000000002FE9000-memory.dmp

                                      memory/1532-51-0x0000000002FF0000-0x0000000002FF4000-memory.dmp

                                      memory/1540-226-0x00000000007B0000-0x00000000007B9000-memory.dmp

                                      memory/1540-222-0x00000000007A0000-0x00000000007AE000-memory.dmp

                                      memory/2576-599-0x0000000000980000-0x000000000098A000-memory.dmp

                                      memory/2576-607-0x0000000000980000-0x000000000098A000-memory.dmp

                                      memory/2576-164-0x0000000000990000-0x000000000099A000-memory.dmp

                                      memory/2576-3-0x00000000007D0000-0x00000000007E5000-memory.dmp

                                      memory/2576-696-0x0000000000980000-0x000000000098A000-memory.dmp

                                      memory/2576-674-0x0000000000980000-0x000000000098A000-memory.dmp

                                      memory/2576-210-0x0000000000990000-0x000000000099A000-memory.dmp

                                      memory/2576-761-0x0000000000980000-0x000000000098A000-memory.dmp

                                      memory/2576-688-0x0000000000980000-0x000000000098A000-memory.dmp

                                      memory/2576-679-0x0000000000980000-0x000000000098A000-memory.dmp

                                      memory/2576-668-0x0000000000980000-0x000000000098A000-memory.dmp

                                      memory/2576-659-0x0000000000980000-0x000000000098A000-memory.dmp

                                      memory/2576-7-0x00000000028D0000-0x000000000293B000-memory.dmp

                                      memory/2576-303-0x0000000000990000-0x000000000099A000-memory.dmp

                                      memory/2576-643-0x0000000000980000-0x000000000098A000-memory.dmp

                                      memory/2576-651-0x0000000000980000-0x000000000098A000-memory.dmp

                                      memory/2576-556-0x0000000000980000-0x000000000098A000-memory.dmp

                                      memory/2576-12-0x0000000000980000-0x000000000098A000-memory.dmp

                                      memory/2576-712-0x0000000000980000-0x000000000098A000-memory.dmp

                                      memory/2576-723-0x0000000000980000-0x000000000098A000-memory.dmp

                                      memory/2576-770-0x0000000000980000-0x000000000098A000-memory.dmp

                                      memory/2576-704-0x0000000000980000-0x000000000098A000-memory.dmp

                                      memory/2576-754-0x0000000000980000-0x000000000098A000-memory.dmp

                                      memory/2576-449-0x0000000002800000-0x0000000002827000-memory.dmp

                                      memory/2576-616-0x0000000000980000-0x000000000098A000-memory.dmp

                                      memory/2576-635-0x0000000000980000-0x000000000098A000-memory.dmp

                                      memory/2576-625-0x0000000000980000-0x000000000098A000-memory.dmp

                                      memory/2576-508-0x0000000000980000-0x000000000098A000-memory.dmp

                                      memory/2576-729-0x0000000000980000-0x000000000098A000-memory.dmp

                                      memory/2576-524-0x0000000000980000-0x000000000098A000-memory.dmp

                                      memory/2576-517-0x0000000000980000-0x000000000098A000-memory.dmp

                                      memory/2576-532-0x0000000000980000-0x000000000098A000-memory.dmp

                                      memory/2576-745-0x0000000000980000-0x000000000098A000-memory.dmp

                                      memory/2576-540-0x0000000000980000-0x000000000098A000-memory.dmp

                                      memory/2576-548-0x0000000000980000-0x000000000098A000-memory.dmp

                                      memory/2576-737-0x0000000000980000-0x000000000098A000-memory.dmp

                                      memory/2576-575-0x0000000000980000-0x000000000098A000-memory.dmp

                                      memory/2576-582-0x0000000000980000-0x000000000098A000-memory.dmp

                                      memory/2576-566-0x0000000000980000-0x000000000098A000-memory.dmp

                                      memory/2576-591-0x0000000000980000-0x000000000098A000-memory.dmp

                                      memory/2576-611-0x0000000000990000-0x000000000099A000-memory.dmp

                                      memory/2576-8-0x00000000028D0000-0x000000000293B000-memory.dmp

                                      memory/3176-71-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

                                      memory/3848-644-0x0000000000BC0000-0x0000000000BCD000-memory.dmp

                                      memory/3848-653-0x0000000000BD0000-0x0000000000BD7000-memory.dmp

                                      memory/3896-88-0x0000000000970000-0x00000000009A3000-memory.dmp

                                      memory/3896-85-0x0000000000400000-0x000000000044B000-memory.dmp

                                      memory/3896-77-0x0000000000400000-0x000000000044B000-memory.dmp

                                      memory/4156-326-0x00000000007F0000-0x00000000007FC000-memory.dmp

                                      memory/4156-331-0x0000000000A80000-0x0000000000A86000-memory.dmp

                                      memory/4272-178-0x0000000002F40000-0x0000000002F47000-memory.dmp

                                      memory/4272-175-0x0000000002F30000-0x0000000002F3B000-memory.dmp

                                      memory/4388-487-0x0000000000630000-0x0000000000652000-memory.dmp

                                      memory/4388-479-0x0000000000600000-0x0000000000627000-memory.dmp

                                      memory/4428-426-0x0000000000C10000-0x0000000000C19000-memory.dmp

                                      memory/4428-433-0x0000000000C20000-0x0000000000C25000-memory.dmp

                                      memory/4492-91-0x0000000002FE0000-0x0000000002FEB000-memory.dmp

                                      memory/4492-93-0x0000000002FF0000-0x0000000002FFA000-memory.dmp

                                      memory/4708-589-0x0000000000950000-0x000000000095B000-memory.dmp

                                      memory/4708-596-0x0000000000960000-0x0000000000966000-memory.dmp

                                      memory/4732-539-0x0000000002FF0000-0x0000000002FF5000-memory.dmp

                                      memory/4732-531-0x0000000002FE0000-0x0000000002FE9000-memory.dmp

                                      memory/4768-0-0x0000000000960000-0x0000000000961000-memory.dmp