Downloads.rar

General
Target

2019-09-02_22-41-10.exe

Filesize

139MB

Completed

19-11-2020 10:40

Score
10 /10
Malware Config

Extracted

Family smokeloader
Version 2019
C2

http://advertserv25.world/logstatx77/

http://mailstatm74.club/logstatx77/

http://kxservx7zx.club/logstatx77/

http://dsmail977sx.xyz/logstatx77/

http://fdmail709.club/logstatx77/

http://servicestar751.club/logstatx77/

http://staradvert9075.club/logstatx77/

http://staradvert1883.club/logstatx77/

rc4.i32
rc4.i32
Signatures 6

Filter: none

Discovery
  • SmokeLoader

    Description

    Modular backdoor trojan in use since 2014.

  • Loads dropped DLL
    2019-09-02_22-41-10.exe

    Reported IOCs

    pidprocess
    15002019-09-02_22-41-10.exe
  • Suspicious use of SetThreadContext
    2019-09-02_22-41-10.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 816 set thread context of 15008162019-09-02_22-41-10.exe2019-09-02_22-41-10.exe
  • Checks SCSI registry key(s)
    2019-09-02_22-41-10.exe

    Description

    SCSI information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistryPeripheral Device DiscoverySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI2019-09-02_22-41-10.exe
    Key queried\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI2019-09-02_22-41-10.exe
    Key enumerated\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI2019-09-02_22-41-10.exe
  • Suspicious behavior: MapViewOfSection
    2019-09-02_22-41-10.exe

    Reported IOCs

    pidprocess
    15002019-09-02_22-41-10.exe
    15002019-09-02_22-41-10.exe
  • Suspicious use of WriteProcessMemory
    2019-09-02_22-41-10.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 816 wrote to memory of 15008162019-09-02_22-41-10.exe2019-09-02_22-41-10.exe
    PID 816 wrote to memory of 15008162019-09-02_22-41-10.exe2019-09-02_22-41-10.exe
    PID 816 wrote to memory of 15008162019-09-02_22-41-10.exe2019-09-02_22-41-10.exe
    PID 816 wrote to memory of 15008162019-09-02_22-41-10.exe2019-09-02_22-41-10.exe
    PID 816 wrote to memory of 15008162019-09-02_22-41-10.exe2019-09-02_22-41-10.exe
    PID 816 wrote to memory of 15008162019-09-02_22-41-10.exe2019-09-02_22-41-10.exe
Processes 2
  • C:\Users\Admin\AppData\Local\Temp\2019-09-02_22-41-10.exe
    "C:\Users\Admin\AppData\Local\Temp\2019-09-02_22-41-10.exe"
    Suspicious use of SetThreadContext
    Suspicious use of WriteProcessMemory
    PID:816
    • C:\Users\Admin\AppData\Local\Temp\2019-09-02_22-41-10.exe
      "C:\Users\Admin\AppData\Local\Temp\2019-09-02_22-41-10.exe"
      Loads dropped DLL
      Checks SCSI registry key(s)
      Suspicious behavior: MapViewOfSection
      PID:1500
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads
                        • \Users\Admin\AppData\Local\Temp\D47F.tmp

                          MD5

                          50741b3f2d7debf5d2bed63d88404029

                          SHA1

                          56210388a627b926162b36967045be06ffb1aad3

                          SHA256

                          f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c

                          SHA512

                          fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3

                        • memory/816-0-0x0000000000B86000-0x0000000000B98000-memory.dmp

                        • memory/816-1-0x0000000000ED0000-0x0000000000ED1000-memory.dmp

                        • memory/1500-2-0x0000000000400000-0x000000000040A000-memory.dmp

                        • memory/1500-3-0x0000000000402CED-mapping.dmp

                        • memory/1500-5-0x0000000000560000-0x0000000000576000-memory.dmp

                        • memory/3048-7-0x0000000000600000-0x0000000000601000-memory.dmp