Analysis
-
max time kernel
150s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
05-01-2021 08:07
Static task
static1
Behavioral task
behavioral1
Sample
4abfa113c1177d7123f6e7974cb55824.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
4abfa113c1177d7123f6e7974cb55824.exe
Resource
win10v20201028
General
-
Target
4abfa113c1177d7123f6e7974cb55824.exe
-
Size
226KB
-
MD5
4abfa113c1177d7123f6e7974cb55824
-
SHA1
097862b7482d38857c5d7d481755603450ecc9d2
-
SHA256
824bb4f0ae66624021f9428d253f15f751653dfb059f9a2db4a6551b0a168a0b
-
SHA512
7549db9c201caf087b47b8ea6499e2502bf96015ac0b6946b2bcde1a243225fa1ae5a19046edea220df918763e5c2d18b1625e20ef20b4400c5704c762d94275
Malware Config
Extracted
smokeloader
2020
http://mpmanagertzz.ru/
http://gmbshop.ru/
http://umnsystms.ug/
http://facepropertyzone.com/
http://ovenlumansera.ru/
http://vinimaxcopy.ru/
http://septembexisecel.ru/
http://wevivomboss.com/
http://baksproperty.gov.ug/
http://mossvivoweb.ru/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3012 -
Loads dropped DLL 1 IoCs
Processes:
4abfa113c1177d7123f6e7974cb55824.exepid process 60 4abfa113c1177d7123f6e7974cb55824.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
4abfa113c1177d7123f6e7974cb55824.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4abfa113c1177d7123f6e7974cb55824.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4abfa113c1177d7123f6e7974cb55824.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4abfa113c1177d7123f6e7974cb55824.exe -
Suspicious behavior: EnumeratesProcesses 2618 IoCs
Processes:
4abfa113c1177d7123f6e7974cb55824.exepid process 60 4abfa113c1177d7123f6e7974cb55824.exe 60 4abfa113c1177d7123f6e7974cb55824.exe 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 3012 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
4abfa113c1177d7123f6e7974cb55824.exepid process 60 4abfa113c1177d7123f6e7974cb55824.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\9419.tmpMD5
50741b3f2d7debf5d2bed63d88404029
SHA156210388a627b926162b36967045be06ffb1aad3
SHA256f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c
SHA512fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3
-
memory/60-2-0x0000000004FD1000-0x0000000004FD2000-memory.dmpFilesize
4KB
-
memory/60-3-0x00000000050C0000-0x00000000050C1000-memory.dmpFilesize
4KB
-
memory/3012-5-0x0000000000BA0000-0x0000000000BB6000-memory.dmpFilesize
88KB