Analysis
- max time kernel
52s - max time network
17s - platform
windows7_x64 - resource
win7v20201028 - submitted
17/12/2020, 08:41
General
- Target PO_54023SD_20ft.scr
- Size 483KB
- Sample201217-pxnefla652
- SHA256 1f07d335c0242607b0cd44d673f49e09dc586d20ded980edac3da5d288dc0463
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2019
C2
-
http://emona66.com.kz/nonso/
-
http://emona667.com.kz/nonso2/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO_54023SD_20ft.scr"C:\Users\Admin\AppData\Local\Temp\PO_54023SD_20ft.scr" /S1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO_54023SD_20ft.scr"{path}"2⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/884-2-0x0000000074DD0000-0x00000000754BE000-memory.dmp
memory/884-3-0x0000000000B70000-0x0000000000B71000-memory.dmp
memory/884-5-0x0000000000830000-0x0000000000834000-memory.dmp
memory/884-6-0x0000000005B80000-0x0000000005BF2000-memory.dmp
memory/1460-7-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1460-10-0x0000000000170000-0x0000000000186000-memory.dmp
memory/1460-11-0x00000000000B0000-0x00000000000B1000-memory.dmp