Analysis

  • max time kernel
    194s
  • max time network
    302s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    16-11-2020 11:26

General

  • Target

    0di3x.bin.exe

  • Size

    111KB

  • MD5

    bd97f762750d0e38e38d5e8f7363f66a

  • SHA1

    9ae3d7053246289ff908758f9d60d79586f7fc9f

  • SHA256

    d4b767b57f453d599559532d7351feeecd4027b89b0b117552b7a3432ed4a158

  • SHA512

    d0f00c07563aab832b181a7ab93413a93f913f813c83d63c25f4473b7fa2003b4b2a83c97bd9766f9f45a7f2de9e922139a010612f21b15407c9f2bb58a53e39

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://etasuklavish.today/

http://mragyzmachnobesdi.today/

http://kimchinikuzims.today/

http://slacvostinrius.today/

http://straponuliusyn.today/

http://grammmdinss.today/

http://viprasputinsd.chimkent.su/

http://lupadypa.dagestan.su/

http://stoknolimchin.exnet.su/

http://musaroprovadnikov.live/

http://teemforyourexprensiti.life/

http://stolkgolmishutich.termez.su/

http://roompampamgandish.wtf/

rc4.i32
rc4.i32

Extracted

Family

zloader

Botnet

r1

Campaign

r1

C2

https://notsweets.net/LKhwojehDgwegSDG/gateJKjdsh.php

https://olpons.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://karamelliar.org/LKhwojehDgwegSDG/gateJKjdsh.php

https://dogrunn.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://azoraz.net/LKhwojehDgwegSDG/gateJKjdsh.php

rc4.plain
rsa_pubkey.plain

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

  • Executes dropped EXE ⋅ 2 IoCs
  • Deletes itself ⋅ 1 IoCs
  • Loads dropped DLL ⋅ 1 IoCs
  • Checks SCSI registry key(s) ⋅ 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings ⋅ 1 TTPs 78 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 989 IoCs
  • Suspicious behavior: GetForegroundWindowSpam ⋅ 1 IoCs
  • Suspicious behavior: MapViewOfSection ⋅ 1 IoCs
  • Suspicious use of FindShellTrayWindow ⋅ 7 IoCs
  • Suspicious use of SendNotifyMessage ⋅ 4 IoCs
  • Suspicious use of SetWindowsHookEx ⋅ 12 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0di3x.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\0di3x.bin.exe"
    Loads dropped DLL
    Checks SCSI registry key(s)
    Suspicious behavior: EnumeratesProcesses
    Suspicious behavior: MapViewOfSection
    PID:1056
  • C:\Users\Admin\AppData\Local\Temp\AB8B.tmp.exe
    C:\Users\Admin\AppData\Local\Temp\AB8B.tmp.exe
    Executes dropped EXE
    PID:1216
  • C:\Users\Admin\AppData\Local\Temp\AD7F.tmp.exe
    C:\Users\Admin\AppData\Local\Temp\AD7F.tmp.exe
    Executes dropped EXE
    PID:968
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    Modifies Internet Explorer settings
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:1064
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1064 CREDAT:275457 /prefetch:2
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:680
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    Modifies Internet Explorer settings
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:1560
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1560 CREDAT:275457 /prefetch:2
      Suspicious use of SetWindowsHookEx
      PID:1628
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    Modifies Internet Explorer settings
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:1492
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1492 CREDAT:275457 /prefetch:2
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:332

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Execution

          Exfiltration

            Impact

              Initial Access

                Lateral Movement

                  Persistence

                    Privilege Escalation

                      Replay Monitor

                      00:00 00:00

                      Downloads

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D73194RS\errorPageStrings[1]
                        MD5

                        e3e4a98353f119b80b323302f26b78fa

                        SHA1

                        20ee35a370cdd3a8a7d04b506410300fd0a6a864

                        SHA256

                        9466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66

                        SHA512

                        d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee

                      • C:\Users\Admin\AppData\Local\Temp\AB8B.tmp.exe
                        MD5

                        136d0596ac6bdb2113346dbc421cbb0c

                        SHA1

                        e92e8011e84a45062953f0cef35cec8226c326d2

                        SHA256

                        4149be90e559b914cb168d82c732089c3792a23b7c85d1c470d1616dc1598cc3

                        SHA512

                        6cf974030ca451e0bff8aef5f7a65745a923b7b0718b21530c0f969dfcb6bc5c283cbde126884cb6959b1b9cfc969c71e87f76d659c3d39afe5283484681b9ba

                      • C:\Users\Admin\AppData\Local\Temp\AB8B.tmp.exe
                        MD5

                        b3ef69a050bf821cabe2bd39b24a7e6c

                        SHA1

                        1462324750e0657704806dbb84946a0ec4fbc49c

                        SHA256

                        302145b6f26034c16b5d317c457e1ddf3d24f057ccd25ba5ffc8465527e0ed02

                        SHA512

                        d9bb96f338badce73979be6c930809324357517b1b28cca725dd53d0a0b142ffba822f514e60e2110d116581f5cae8b57127ede635f1f7356fdd757cd9c3d4ac

                      • C:\Users\Admin\AppData\Local\Temp\AD7F.tmp.exe
                        MD5

                        63087380f529f33bd6174c18484e4e1d

                        SHA1

                        9a372d462aa3ed5014b6e5358f6955de93e7aca0

                        SHA256

                        2fb369c93cb736b07da8bf8ba7024edf0ba4c910f4a347fa02128e5702516022

                        SHA512

                        c717063748fc571d63de2bf34db67d74f3aa7c53beddd65489f7f476dcc0b75334f7ff5cf1b9f17483ed02d2d95aa92ba5d02c9172846528d2bef4a73c7df371

                      • C:\Users\Admin\AppData\Roaming\Xiidyk
                        MD5

                        d41d8cd98f00b204e9800998ecf8427e

                        SHA1

                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                        SHA256

                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                        SHA512

                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                      • \Users\Admin\AppData\Local\Temp\2F6.tmp
                        MD5

                        d124f55b9393c976963407dff51ffa79

                        SHA1

                        2c7bbedd79791bfb866898c85b504186db610b5d

                        SHA256

                        ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

                        SHA512

                        278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

                      • memory/332-16-0x0000000000000000-mapping.dmp
                      • memory/524-12-0x000007FEF6930000-0x000007FEF6BAA000-memory.dmp
                      • memory/680-14-0x0000000005F60000-0x0000000005F83000-memory.dmp
                      • memory/680-13-0x0000000000000000-mapping.dmp
                      • memory/968-6-0x0000000000000000-mapping.dmp
                      • memory/968-9-0x0000000004940000-0x0000000004951000-memory.dmp
                      • memory/968-8-0x000000000313B000-0x000000000313C000-memory.dmp
                      • memory/980-18-0x0000000000000000-mapping.dmp
                      • memory/1056-0-0x000000000340B000-0x000000000340C000-memory.dmp
                      • memory/1056-1-0x00000000048F0000-0x0000000004901000-memory.dmp
                      • memory/1216-4-0x0000000000000000-mapping.dmp
                      • memory/1216-11-0x0000000004A90000-0x0000000004AA1000-memory.dmp
                      • memory/1216-19-0x0000000004A90000-0x0000000004AA1000-memory.dmp
                      • memory/1216-10-0x00000000030EB000-0x00000000030EC000-memory.dmp
                      • memory/1256-3-0x0000000002F80000-0x0000000002F96000-memory.dmp
                      • memory/1628-15-0x0000000000000000-mapping.dmp
                      • memory/1672-23-0x00000000000C0000-0x00000000000C1000-memory.dmp
                      • memory/1672-22-0x0000000000090000-0x00000000000B8000-memory.dmp
                      • memory/1672-24-0x0000000000090000-0x00000000000B8000-memory.dmp
                      • memory/1672-25-0x0000000000000000-mapping.dmp