Analysis

  • max time kernel
    85s
  • max time network
    149s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    24-11-2020 14:13

General

  • Target

    1qj5u.exe

  • Size

    112KB

  • MD5

    c989356bdc4ffc9b4752acecfddb551d

  • SHA1

    fff0e011c492e174a3175c3ddb2ee0d6ed9d7285

  • SHA256

    8afc2dd7267bbf83a46549f4e7731f6473610c33bc9ee41b4dd0b994c3a29473

  • SHA512

    f51769eed207b7b0e9387c9bc13d46502f0c25086c6f1ce8d16678bbe639f06efb799959efac10aefd6d92dd08310216d2929178ebee3f2c73ecad286c89da1f

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://etasuklavish.today/

http://mragyzmachnobesdi.today/

http://kimchinikuzims.today/

http://slacvostinrius.today/

http://straponuliusyn.today/

http://grammmdinss.today/

http://viprasputinsd.chimkent.su/

http://lupadypa.dagestan.su/

http://stoknolimchin.exnet.su/

http://musaroprovadnikov.live/

http://teemforyourexprensiti.life/

http://stolkgolmishutich.termez.su/

http://roompampamgandish.wtf/

rc4.i32
rc4.i32

Extracted

Family

zloader

Botnet

r1

Campaign

r1

C2

https://notsweets.net/LKhwojehDgwegSDG/gateJKjdsh.php

https://olpons.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://karamelliar.org/LKhwojehDgwegSDG/gateJKjdsh.php

https://dogrunn.com/LKhwojehDgwegSDG/gateJKjdsh.php

https://azoraz.net/LKhwojehDgwegSDG/gateJKjdsh.php

rc4.plain
rsa_pubkey.plain

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

  • Executes dropped EXE ⋅ 2 IoCs
  • Deletes itself ⋅ 1 IoCs
  • Loads dropped DLL ⋅ 1 IoCs
  • Checks SCSI registry key(s) ⋅ 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings ⋅ 1 TTPs 41 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 1364 IoCs
  • Suspicious behavior: GetForegroundWindowSpam ⋅ 1 IoCs
  • Suspicious behavior: MapViewOfSection ⋅ 1 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 56 IoCs
  • Suspicious use of FindShellTrayWindow ⋅ 2 IoCs
  • Suspicious use of SetWindowsHookEx ⋅ 8 IoCs
  • Suspicious use of UnmapMainImage ⋅ 1 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1qj5u.exe
    "C:\Users\Admin\AppData\Local\Temp\1qj5u.exe"
    Loads dropped DLL
    Checks SCSI registry key(s)
    Suspicious behavior: EnumeratesProcesses
    Suspicious behavior: MapViewOfSection
    PID:744
  • C:\Users\Admin\AppData\Local\Temp\95EC.tmp.exe
    C:\Users\Admin\AppData\Local\Temp\95EC.tmp.exe
    Executes dropped EXE
    PID:2600
  • C:\Users\Admin\AppData\Local\Temp\97A3.tmp.exe
    C:\Users\Admin\AppData\Local\Temp\97A3.tmp.exe
    Executes dropped EXE
    PID:940
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    Modifies Internet Explorer settings
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:4064
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4064 CREDAT:82945 /prefetch:2
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:3196
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    Modifies Internet Explorer settings
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:2468
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2468 CREDAT:82945 /prefetch:2
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:776

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Execution

          Exfiltration

            Impact

              Initial Access

                Lateral Movement

                  Persistence

                    Privilege Escalation

                      Replay Monitor

                      00:00 00:00

                      Downloads

                      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{0C2CB35F-2E60-11EB-BEBD-EAF55770C779}.dat
                        MD5

                        468c88241a7be8a0d2ded20c1cde7d2f

                        SHA1

                        23737a160594080383cf94a156e3c8d05e0089d0

                        SHA256

                        e7df54ad284ef4cac08589c73813c3536c3ac77928b1beffdd128508a34ca00d

                        SHA512

                        025188e4a8f69328585e00817648e28091e976aa180c3fa450430dc8a2d5dc661cd2e06208a3aba169152f85f9cce00642886b9917d113ec3aa653413308703b

                      • C:\Users\Admin\AppData\Local\Temp\95EC.tmp.exe
                        MD5

                        86fc9993f4fe92809513a02d907205cd

                        SHA1

                        a23217fa44754496be797902abe54aa661dc7774

                        SHA256

                        edbb56fe63e565c456de8153a6c6782dc6697b6dac509eeb19a99e462d9e717d

                        SHA512

                        0242225e1b5c2df539893cdc1fb873e8a7fcf30356d30474bb1ad68ed9f3126673c253d75141ef89b48953c8c11898d0d73d2aaa618b4f6e8b604a152a3a45e7

                      • C:\Users\Admin\AppData\Local\Temp\95EC.tmp.exe
                        MD5

                        86fc9993f4fe92809513a02d907205cd

                        SHA1

                        a23217fa44754496be797902abe54aa661dc7774

                        SHA256

                        edbb56fe63e565c456de8153a6c6782dc6697b6dac509eeb19a99e462d9e717d

                        SHA512

                        0242225e1b5c2df539893cdc1fb873e8a7fcf30356d30474bb1ad68ed9f3126673c253d75141ef89b48953c8c11898d0d73d2aaa618b4f6e8b604a152a3a45e7

                      • C:\Users\Admin\AppData\Local\Temp\97A3.tmp.exe
                        MD5

                        dd27ae12604dd29819d082e8140f4100

                        SHA1

                        6d36e154d8db8ef33ce3b3d0fa7bbaf57fb3c8ac

                        SHA256

                        c046cb43c97a7a25a97ac98951688286c57e4b987743729320b647949e68a0dd

                        SHA512

                        5a56a4ddc73816d0769a5a54e98dced1f4de3edf1807e718e5616e1bd0b8033c4defa7005d4d8134e2ed0137c41b1c7b583884195faff0287792be495d950a85

                      • C:\Users\Admin\AppData\Local\Temp\97A3.tmp.exe
                        MD5

                        dd27ae12604dd29819d082e8140f4100

                        SHA1

                        6d36e154d8db8ef33ce3b3d0fa7bbaf57fb3c8ac

                        SHA256

                        c046cb43c97a7a25a97ac98951688286c57e4b987743729320b647949e68a0dd

                        SHA512

                        5a56a4ddc73816d0769a5a54e98dced1f4de3edf1807e718e5616e1bd0b8033c4defa7005d4d8134e2ed0137c41b1c7b583884195faff0287792be495d950a85

                      • C:\Users\Admin\AppData\Local\Temp\data.txt
                        MD5

                        419ea3d83944d98b84c1bad1a5a9c045

                        SHA1

                        ffc160266050395c930a54cfb70165839888ded6

                        SHA256

                        c5fd8c8e51261170140553191bfb0cb0a791480934b234965d6cc075990b70f4

                        SHA512

                        20846af210b422de782cc7928a7d1a3e0fbb291b0cfeb65dab76f82dcc7a567962175f0d9c607d9ad19f29f24d54d777bee80b19c6bb8274684431e63c9227e6

                      • C:\Users\Admin\AppData\Roaming\Ipodt
                        MD5

                        d41d8cd98f00b204e9800998ecf8427e

                        SHA1

                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                        SHA256

                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                        SHA512

                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                      • \Users\Admin\AppData\Local\Temp\2F6.tmp
                        MD5

                        50741b3f2d7debf5d2bed63d88404029

                        SHA1

                        56210388a627b926162b36967045be06ffb1aad3

                        SHA256

                        f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c

                        SHA512

                        fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3

                      • memory/744-0-0x00000000030C9000-0x00000000030CA000-memory.dmp
                      • memory/744-1-0x0000000004DE0000-0x0000000004DE1000-memory.dmp
                      • memory/776-15-0x0000000000000000-mapping.dmp
                      • memory/940-12-0x0000000003308000-0x0000000003309000-memory.dmp
                      • memory/940-13-0x0000000004C90000-0x0000000004C91000-memory.dmp
                      • memory/940-7-0x0000000000000000-mapping.dmp
                      • memory/1532-18-0x0000000000000000-mapping.dmp
                      • memory/1816-20-0x0000000000DB0000-0x0000000000DD8000-memory.dmp
                      • memory/1816-21-0x0000000000000000-mapping.dmp
                      • memory/2092-3-0x0000000000F00000-0x0000000000F16000-memory.dmp
                      • memory/2600-11-0x0000000004E80000-0x0000000004E81000-memory.dmp
                      • memory/2600-10-0x0000000003338000-0x0000000003339000-memory.dmp
                      • memory/2600-4-0x0000000000000000-mapping.dmp
                      • memory/3196-14-0x0000000000000000-mapping.dmp
                      • memory/3932-16-0x0000000000000000-mapping.dmp