Analysis

  • max time kernel
    129s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    24-11-2020 14:13

General

  • Target

    1qj5u.exe

  • Size

    112KB

  • MD5

    c989356bdc4ffc9b4752acecfddb551d

  • SHA1

    fff0e011c492e174a3175c3ddb2ee0d6ed9d7285

  • SHA256

    8afc2dd7267bbf83a46549f4e7731f6473610c33bc9ee41b4dd0b994c3a29473

  • SHA512

    f51769eed207b7b0e9387c9bc13d46502f0c25086c6f1ce8d16678bbe639f06efb799959efac10aefd6d92dd08310216d2929178ebee3f2c73ecad286c89da1f

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://etasuklavish.today/

http://mragyzmachnobesdi.today/

http://kimchinikuzims.today/

http://slacvostinrius.today/

http://straponuliusyn.today/

http://grammmdinss.today/

http://viprasputinsd.chimkent.su/

http://lupadypa.dagestan.su/

http://stoknolimchin.exnet.su/

http://musaroprovadnikov.live/

http://teemforyourexprensiti.life/

http://stolkgolmishutich.termez.su/

http://roompampamgandish.wtf/

rc4.i32
rc4.i32

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Executes dropped EXE ⋅ 2 IoCs
  • Deletes itself ⋅ 1 IoCs
  • Loads dropped DLL ⋅ 1 IoCs
  • Checks SCSI registry key(s) ⋅ 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings ⋅ 1 TTPs 22 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 611 IoCs
  • Suspicious behavior: MapViewOfSection ⋅ 1 IoCs
  • Suspicious use of FindShellTrayWindow ⋅ 5 IoCs
  • Suspicious use of SendNotifyMessage ⋅ 4 IoCs
  • Suspicious use of SetWindowsHookEx ⋅ 4 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1qj5u.exe
    "C:\Users\Admin\AppData\Local\Temp\1qj5u.exe"
    Loads dropped DLL
    Checks SCSI registry key(s)
    Suspicious behavior: EnumeratesProcesses
    Suspicious behavior: MapViewOfSection
    PID:536
  • C:\Users\Admin\AppData\Local\Temp\205C.tmp.exe
    C:\Users\Admin\AppData\Local\Temp\205C.tmp.exe
    Executes dropped EXE
    PID:744
  • C:\Users\Admin\AppData\Local\Temp\2203.tmp.exe
    C:\Users\Admin\AppData\Local\Temp\2203.tmp.exe
    Executes dropped EXE
    PID:864
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    Modifies Internet Explorer settings
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:1076
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1076 CREDAT:275457 /prefetch:2
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1740

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Execution

          Exfiltration

            Impact

              Initial Access

                Lateral Movement

                  Persistence

                    Privilege Escalation

                      Replay Monitor

                      00:00 00:00

                      Downloads

                      • C:\Users\Admin\AppData\Local\Temp\205C.tmp.exe
                        MD5

                        86fc9993f4fe92809513a02d907205cd

                        SHA1

                        a23217fa44754496be797902abe54aa661dc7774

                        SHA256

                        edbb56fe63e565c456de8153a6c6782dc6697b6dac509eeb19a99e462d9e717d

                        SHA512

                        0242225e1b5c2df539893cdc1fb873e8a7fcf30356d30474bb1ad68ed9f3126673c253d75141ef89b48953c8c11898d0d73d2aaa618b4f6e8b604a152a3a45e7

                      • C:\Users\Admin\AppData\Local\Temp\2203.tmp.exe
                        MD5

                        dd27ae12604dd29819d082e8140f4100

                        SHA1

                        6d36e154d8db8ef33ce3b3d0fa7bbaf57fb3c8ac

                        SHA256

                        c046cb43c97a7a25a97ac98951688286c57e4b987743729320b647949e68a0dd

                        SHA512

                        5a56a4ddc73816d0769a5a54e98dced1f4de3edf1807e718e5616e1bd0b8033c4defa7005d4d8134e2ed0137c41b1c7b583884195faff0287792be495d950a85

                      • \Users\Admin\AppData\Local\Temp\2F6.tmp
                        MD5

                        d124f55b9393c976963407dff51ffa79

                        SHA1

                        2c7bbedd79791bfb866898c85b504186db610b5d

                        SHA256

                        ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

                        SHA512

                        278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

                      • memory/536-1-0x0000000004860000-0x0000000004871000-memory.dmp
                      • memory/744-8-0x00000000030BB000-0x00000000030BC000-memory.dmp
                      • memory/744-9-0x0000000004A50000-0x0000000004A61000-memory.dmp
                      • memory/744-4-0x0000000000000000-mapping.dmp
                      • memory/864-6-0x0000000000000000-mapping.dmp
                      • memory/864-11-0x0000000004950000-0x0000000004961000-memory.dmp
                      • memory/864-10-0x000000000314B000-0x000000000314C000-memory.dmp
                      • memory/1004-12-0x000007FEF81B0000-0x000007FEF842A000-memory.dmp
                      • memory/1204-3-0x0000000003A10000-0x0000000003A26000-memory.dmp
                      • memory/1740-13-0x0000000000000000-mapping.dmp
                      • memory/1740-14-0x00000000060C0000-0x00000000060E3000-memory.dmp