Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
25-11-2020 10:45
General
-
Target
0x000300000001ac9e-206.exe
-
Size
311KB
-
MD5
fdde60834af109d71f4c7d28b865c8a1
-
SHA1
4f721105161b74e07b5ccd762d32932989bfb03a
-
SHA256
b0296c0000c40d59a268b223015872d7e57c427358b5e95d1bd6e4ac40dd0f87
-
SHA512
fecd130a4431fa81a1cf9be8019464b55bfb173dde91ced3a5828516bd51db509fd547c12dd483c00cdf5ade878ab542ffb6371238ccf960622bb464187b5778
Malware Config
Extracted
smokeloader
2019
http://10022020newfolder1002002131-service1002.space/
http://10022020newfolder1002002231-service1002.space/
http://10022020newfolder3100231-service1002.space/
http://10022020newfolder1002002431-service1002.space/
http://10022020newfolder1002002531-service1002.space/
http://10022020newfolder33417-01242510022020.space/
http://10022020test125831-service1002012510022020.space/
http://10022020test136831-service1002012510022020.space/
http://10022020test147831-service1002012510022020.space/
http://10022020test146831-service1002012510022020.space/
http://10022020test134831-service1002012510022020.space/
http://10022020est213531-service100201242510022020.ru/
http://10022020yes1t3481-service1002012510022020.ru/
http://10022020test13561-service1002012510022020.su/
http://10022020test14781-service1002012510022020.info/
http://10022020test13461-service1002012510022020.net/
http://10022020test15671-service1002012510022020.tech/
http://10022020test12671-service1002012510022020.online/
http://10022020utest1341-service1002012510022020.ru/
http://10022020uest71-service100201dom2510022020.ru/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
-
AgentTesla Payload 2 IoCs
-
Executes dropped EXE 5 IoCs
-
Modifies Installed Components in the registry 2 TTPs
-
Deletes itself 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext 2 IoCs
-
Program crash 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 15 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 2 IoCs
-
Modifies Control Panel 5 IoCs
-
Modifies registry class 29 IoCs
-
Suspicious behavior: EnumeratesProcesses 1582 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 45 IoCs
-
Suspicious use of FindShellTrayWindow 44 IoCs
-
Suspicious use of SendNotifyMessage 23 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0x000300000001ac9e-206.exe"C:\Users\Admin\AppData\Local\Temp\0x000300000001ac9e-206.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0x000300000001ac9e-206.exe"C:\Users\Admin\AppData\Local\Temp\0x000300000001ac9e-206.exe"3⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\1837.tmp.exeC:\Users\Admin\AppData\Local\Temp\1837.tmp.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\1AF7.tmp.exeC:\Users\Admin\AppData\Local\Temp\1AF7.tmp.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1E82.tmp.exeC:\Users\Admin\AppData\Local\Temp\1E82.tmp.exe2⤵
- Executes dropped EXE
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3012 -s 81362⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\rhvdjwiC:\Users\Admin\AppData\Roaming\rhvdjwi1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\rhvdjwiC:\Users\Admin\AppData\Roaming\rhvdjwi2⤵
- Executes dropped EXE
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Control Panel
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
- Enumerates system info in registry
- Modifies Control Panel
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
- Modifies Control Panel
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1837.tmp.exeMD5
a69e12607d01237460808fa1709e5e86
SHA14a12f82aee1c90e70cdf6be863ce1a749c8ae411
SHA256188e05efb42c1f7fdb5c910a6614f710a87ae642b23ac9ffe3f75246744865bc
SHA5127533e6da6bac0405fc8b608da8020b54b6ee02592e6fd40ea342e130a8a876ae5ef4a1fd636d95e76339dbf8be45cecbd22ca2d0a4635b055ffafec3d7e15284
-
C:\Users\Admin\AppData\Local\Temp\1837.tmp.exeMD5
a69e12607d01237460808fa1709e5e86
SHA14a12f82aee1c90e70cdf6be863ce1a749c8ae411
SHA256188e05efb42c1f7fdb5c910a6614f710a87ae642b23ac9ffe3f75246744865bc
SHA5127533e6da6bac0405fc8b608da8020b54b6ee02592e6fd40ea342e130a8a876ae5ef4a1fd636d95e76339dbf8be45cecbd22ca2d0a4635b055ffafec3d7e15284
-
C:\Users\Admin\AppData\Local\Temp\1AF7.tmp.exeMD5
4d58af2acb8147d09c1d1874860755e6
SHA104d466ae9c5bc0a8d6720b21447f056420c92bde
SHA256e8012f7e8dcb980e8db82ac0158fb8f2be76388052ef74802e1bfae266d9b861
SHA512e7b77629ad8299353e7698011c1fa04de9623897ad3aa2cd60e9125c68da0adf14911517ecf39f6f5396bf40792fa0ca14feef80ab4c8c722ce97db07e9574ad
-
C:\Users\Admin\AppData\Local\Temp\1AF7.tmp.exeMD5
4d58af2acb8147d09c1d1874860755e6
SHA104d466ae9c5bc0a8d6720b21447f056420c92bde
SHA256e8012f7e8dcb980e8db82ac0158fb8f2be76388052ef74802e1bfae266d9b861
SHA512e7b77629ad8299353e7698011c1fa04de9623897ad3aa2cd60e9125c68da0adf14911517ecf39f6f5396bf40792fa0ca14feef80ab4c8c722ce97db07e9574ad
-
C:\Users\Admin\AppData\Local\Temp\1E82.tmp.exeMD5
f2b4b6c26a03a1be0c3b85c0482a8c30
SHA1b39eabd2d680440847baf150d4c9423515fea7d5
SHA256501614b9f1d98a5b2ca1b11b251c61e05f1225aa5a344788375df28812a6232f
SHA5120e5fe73e6c981986df1299cf0dfa88cc3b78532b83d6b93e671487de67c5dea16724a882dd61a6208b78b866250d0dc5f2cad872b1b39942bf9fd15cd8c4a5b4
-
C:\Users\Admin\AppData\Local\Temp\1E82.tmp.exeMD5
f2b4b6c26a03a1be0c3b85c0482a8c30
SHA1b39eabd2d680440847baf150d4c9423515fea7d5
SHA256501614b9f1d98a5b2ca1b11b251c61e05f1225aa5a344788375df28812a6232f
SHA5120e5fe73e6c981986df1299cf0dfa88cc3b78532b83d6b93e671487de67c5dea16724a882dd61a6208b78b866250d0dc5f2cad872b1b39942bf9fd15cd8c4a5b4
-
C:\Users\Admin\AppData\Local\Temp\4DD3.tmpMD5
50741b3f2d7debf5d2bed63d88404029
SHA156210388a627b926162b36967045be06ffb1aad3
SHA256f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c
SHA512fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3
-
C:\Users\Admin\AppData\Roaming\rhvdjwiMD5
fdde60834af109d71f4c7d28b865c8a1
SHA14f721105161b74e07b5ccd762d32932989bfb03a
SHA256b0296c0000c40d59a268b223015872d7e57c427358b5e95d1bd6e4ac40dd0f87
SHA512fecd130a4431fa81a1cf9be8019464b55bfb173dde91ced3a5828516bd51db509fd547c12dd483c00cdf5ade878ab542ffb6371238ccf960622bb464187b5778
-
C:\Users\Admin\AppData\Roaming\rhvdjwiMD5
fdde60834af109d71f4c7d28b865c8a1
SHA14f721105161b74e07b5ccd762d32932989bfb03a
SHA256b0296c0000c40d59a268b223015872d7e57c427358b5e95d1bd6e4ac40dd0f87
SHA512fecd130a4431fa81a1cf9be8019464b55bfb173dde91ced3a5828516bd51db509fd547c12dd483c00cdf5ade878ab542ffb6371238ccf960622bb464187b5778
-
C:\Users\Admin\AppData\Roaming\rhvdjwiMD5
fdde60834af109d71f4c7d28b865c8a1
SHA14f721105161b74e07b5ccd762d32932989bfb03a
SHA256b0296c0000c40d59a268b223015872d7e57c427358b5e95d1bd6e4ac40dd0f87
SHA512fecd130a4431fa81a1cf9be8019464b55bfb173dde91ced3a5828516bd51db509fd547c12dd483c00cdf5ade878ab542ffb6371238ccf960622bb464187b5778
-
\Users\Admin\AppData\Local\Temp\4DD3.tmpMD5
50741b3f2d7debf5d2bed63d88404029
SHA156210388a627b926162b36967045be06ffb1aad3
SHA256f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c
SHA512fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3
-
memory/416-24-0x000002A26B840000-0x000002A26B841000-memory.dmpFilesize
4KB
-
memory/416-29-0x000002A26C6B0000-0x000002A26C6B1000-memory.dmpFilesize
4KB
-
memory/416-28-0x000002A26C6B0000-0x000002A26C6B1000-memory.dmpFilesize
4KB
-
memory/416-27-0x000002A26C6B0000-0x000002A26C6B1000-memory.dmpFilesize
4KB
-
memory/416-25-0x000002A26B840000-0x000002A26B841000-memory.dmpFilesize
4KB
-
memory/972-0-0x0000000006470000-0x0000000006471000-memory.dmpFilesize
4KB
-
memory/1332-38-0x0000000073370000-0x0000000073A5E000-memory.dmpFilesize
6.9MB
-
memory/1332-42-0x0000000009470000-0x0000000009471000-memory.dmpFilesize
4KB
-
memory/1332-46-0x0000000009BB0000-0x0000000009BB1000-memory.dmpFilesize
4KB
-
memory/1332-21-0x0000000000000000-mapping.dmp
-
memory/1332-45-0x0000000008F10000-0x0000000008F11000-memory.dmpFilesize
4KB
-
memory/1332-44-0x0000000008EC0000-0x0000000008EC1000-memory.dmpFilesize
4KB
-
memory/1332-43-0x0000000008E80000-0x0000000008E81000-memory.dmpFilesize
4KB
-
memory/1332-41-0x0000000008DD0000-0x0000000008DF2000-memory.dmpFilesize
136KB
-
memory/1332-40-0x0000000008F70000-0x0000000008F71000-memory.dmpFilesize
4KB
-
memory/1332-35-0x0000000006390000-0x0000000006391000-memory.dmpFilesize
4KB
-
memory/1332-36-0x0000000006390000-0x00000000063C1000-memory.dmpFilesize
196KB
-
memory/1332-37-0x0000000006690000-0x0000000006691000-memory.dmpFilesize
4KB
-
memory/1332-39-0x0000000006620000-0x0000000006644000-memory.dmpFilesize
144KB
-
memory/2896-2-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2896-3-0x0000000000402A38-mapping.dmp
-
memory/2984-13-0x0000000000000000-mapping.dmp
-
memory/3012-5-0x0000000000E80000-0x0000000000E97000-memory.dmpFilesize
92KB
-
memory/3108-33-0x0000000006430000-0x0000000006431000-memory.dmpFilesize
4KB
-
memory/3108-18-0x0000000000000000-mapping.dmp
-
memory/3200-47-0x0000000009C40000-0x0000000009C41000-memory.dmpFilesize
4KB
-
memory/3336-10-0x0000000000402A38-mapping.dmp
-
memory/3440-8-0x00000000063C0000-0x00000000063C1000-memory.dmpFilesize
4KB