Overview

overview

10

Static

static

galadriel

windows7_x64

10

Resubmissions

16-11-2020 11:26

201116-96rt48lgr2 10

16-11-2020 11:22

201116-da9ygl58js 10

Analysis

  • max time kernel
    194s
  • max time network
    302s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    16-11-2020 11:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0di3x.bin.exe

  • Size

    111KB

  • MD5

    bd97f762750d0e38e38d5e8f7363f66a

  • SHA1

    9ae3d7053246289ff908758f9d60d79586f7fc9f

  • SHA256

    d4b767b57f453d599559532d7351feeecd4027b89b0b117552b7a3432ed4a158

  • SHA512

    d0f00c07563aab832b181a7ab93413a93f913f813c83d63c25f4473b7fa2003b4b2a83c97bd9766f9f45a7f2de9e922139a010612f21b15407c9f2bb58a53e39

Score
10/10
smokeloaderzloaderr1r1backdoorbotnettrojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://etasuklavish.today/

http://mragyzmachnobesdi.today/

http://kimchinikuzims.today/

http://slacvostinrius.today/

http://straponuliusyn.today/

http://grammmdinss.today/

http://viprasputinsd.chimkent.su/

http://lupadypa.dagestan.su/

http://stoknolimchin.exnet.su/

http://musaroprovadnikov.live/

http://teemforyourexprensiti.life/

http://stolkgolmishutich.termez.su/

http://roompampamgandish.wtf/
rc4.i32
rc4.i32

Extracted

Family

zloader

Botnet

r1

Campaign

r1

C2

https://notsweets.net/LKhwojehDgwegSDG/gateJKjdsh.php

https://olpons.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://karamelliar.org/LKhwojehDgwegSDG/gateJKjdsh.php

https://dogrunn.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://azoraz.net/LKhwojehDgwegSDG/gateJKjdsh.php
rc4.plain
rsa_pubkey.plain

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

    trojanbotnetzloader
  • Executes dropped EXE 2 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 78 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 989 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0di3x.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\0di3x.bin.exe"
    1⤵
    • Loads dropped DLL
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:1056
  • C:\Users\Admin\AppData\Local\Temp\AB8B.tmp.exe
    C:\Users\Admin\AppData\Local\Temp\AB8B.tmp.exe
    1⤵
    • Executes dropped EXE
    PID:1216
  • C:\Users\Admin\AppData\Local\Temp\AD7F.tmp.exe
    C:\Users\Admin\AppData\Local\Temp\AD7F.tmp.exe
    1⤵
    • Executes dropped EXE
    PID:968
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1064
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1064 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:680
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1560
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1560 CREDAT:275457 /prefetch:2
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:1628
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1492
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1492 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:332

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/524-12-0x000007FEF6930000-0x000007FEF6BAA000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/680-14-0x0000000005F60000-0x0000000005F83000-memory.dmp

    Filesize

    140KB

    Download

  • memory/968-9-0x0000000004940000-0x0000000004951000-memory.dmp

    Filesize

    68KB

    Download

  • memory/968-8-0x000000000313B000-0x000000000313C000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1056-0-0x000000000340B000-0x000000000340C000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1056-1-0x00000000048F0000-0x0000000004901000-memory.dmp

    Filesize

    68KB

    Download

  • memory/1216-11-0x0000000004A90000-0x0000000004AA1000-memory.dmp

    Filesize

    68KB

    Download

  • memory/1216-19-0x0000000004A90000-0x0000000004AA1000-memory.dmp

    Filesize

    68KB

    Download

  • memory/1216-10-0x00000000030EB000-0x00000000030EC000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1256-3-0x0000000002F80000-0x0000000002F96000-memory.dmp

    Filesize

    88KB

    Download

  • memory/1672-23-0x00000000000C0000-0x00000000000C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1672-22-0x0000000000090000-0x00000000000B8000-memory.dmp

    Filesize

    160KB

    Download

  • memory/1672-24-0x0000000000090000-0x00000000000B8000-memory.dmp

    Filesize

    160KB

    Download