Analysis
- max time kernel
44s - max time network
118s - platform
windows10_x64 - resource
win10v20201028 - submitted
17/12/2020, 08:41
General
- Target PO_54023SD_20ft.scr
- Size 483KB
- Sample201217-pxnefla652
- SHA256 1f07d335c0242607b0cd44d673f49e09dc586d20ded980edac3da5d288dc0463
Malware Config
Extracted
-
smokeloader
-
2019
-
http://emona66.com.kz/nonso/
-
http://emona667.com.kz/nonso2/
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO_54023SD_20ft.scr"C:\Users\Admin\AppData\Local\Temp\PO_54023SD_20ft.scr" /S1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO_54023SD_20ft.scr"{path}"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PO_54023SD_20ft.scr"{path}"2⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1336-11-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1336-14-0x0000000000DD0000-0x0000000000DE6000-memory.dmp
memory/2260-16-0x0000000000640000-0x0000000000641000-memory.dmp
memory/3936-6-0x0000000004BC0000-0x0000000004BC1000-memory.dmp
memory/3936-9-0x00000000070E0000-0x0000000007152000-memory.dmp
memory/3936-10-0x00000000083A0000-0x00000000083A1000-memory.dmp
memory/3936-8-0x0000000006680000-0x0000000006684000-memory.dmp
memory/3936-7-0x0000000004B20000-0x0000000004B21000-memory.dmp
memory/3936-2-0x0000000073300000-0x00000000739EE000-memory.dmp
memory/3936-5-0x0000000005020000-0x0000000005021000-memory.dmp
memory/3936-3-0x0000000000250000-0x0000000000251000-memory.dmp