Overview

overview

10

Static

static

10

08751be484...2d.dll

windows7_x64

10

08751be484...2d.dll

windows10_x64

10

0a9f79abd4...51.exe

windows7_x64

3

0a9f79abd4...51.exe

windows10_x64

3

0di3x.bin.exe

windows7_x64

10

0di3x.bin.exe

windows10_x64

10

1.bin/1.exe

windows7_x64

10

1.bin/1.exe

windows10_x64

10

4a30275f14...ab.dll

windows7_x64

10

4a30275f14...ab.dll

windows10_x64

1

2019-09-02...10.exe

windows7_x64

10

2019-09-02...10.exe

windows10_x64

10

2b5e50bc30...ba.dll

windows7_x64

10

2b5e50bc30...ba.dll

windows10_x64

10

2c01b00772...eb.exe

windows7_x64

10

2c01b00772...eb.exe

windows10_x64

1

31.exe

windows7_x64

10

31.exe

windows10_x64

10

3DMark 11 ...on.exe

windows7_x64

1

3DMark 11 ...on.exe

windows10_x64

1

42f9729255...61.exe

windows7_x64

10

42f9729255...61.exe

windows10_x64

10

42f9729255...1).exe

windows7_x64

10

42f9729255...1).exe

windows10_x64

10

5da0116af4...18.exe

windows7_x64

8

5da0116af4...18.exe

windows10_x64

8

69c56d12ed...6b.exe

windows7_x64

10

69c56d12ed...6b.exe

windows10_x64

10

6a9e7107c9...91.exe

windows7_x64

10

6a9e7107c9...91.exe

windows10_x64

10

905d572f23...50.exe

windows7_x64

1

905d572f23...50.exe

windows10_x64

1

Resubmissions

22-11-2023 17:02

231122-vkac9adg64 10

19-01-2021 19:24

210119-s26yznnqsn 10

19-11-2020 13:14

201119-s41ec6lt86 10

Analysis

  • max time kernel
    151s
  • max time network
    112s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    19-01-2021 19:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0di3x.bin.exe

  • Size

    111KB

  • MD5

    bd97f762750d0e38e38d5e8f7363f66a

  • SHA1

    9ae3d7053246289ff908758f9d60d79586f7fc9f

  • SHA256

    d4b767b57f453d599559532d7351feeecd4027b89b0b117552b7a3432ed4a158

  • SHA512

    d0f00c07563aab832b181a7ab93413a93f913f813c83d63c25f4473b7fa2003b4b2a83c97bd9766f9f45a7f2de9e922139a010612f21b15407c9f2bb58a53e39

Score
10/10
smokeloaderbackdoortrojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://etasuklavish.today/

http://mragyzmachnobesdi.today/

http://kimchinikuzims.today/

http://slacvostinrius.today/

http://straponuliusyn.today/

http://grammmdinss.today/

http://viprasputinsd.chimkent.su/

http://lupadypa.dagestan.su/

http://stoknolimchin.exnet.su/

http://musaroprovadnikov.live/

http://teemforyourexprensiti.life/

http://stolkgolmishutich.termez.su/

http://roompampamgandish.wtf/
rc4.i32
rc4.i32

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2574 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0di3x.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\0di3x.bin.exe"
    1⤵
    • Loads dropped DLL
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:1160

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\2F6.tmp
    MD5

    50741b3f2d7debf5d2bed63d88404029

    SHA1

    56210388a627b926162b36967045be06ffb1aad3

    SHA256

    f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c

    SHA512

    fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3

    Download Submit
  • memory/1160-2-0x0000000004E50000-0x0000000004E51000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1160-3-0x00000000030D0000-0x00000000030DA000-memory.dmp
    Filesize

    40KB

    Download
  • memory/1160-4-0x0000000000400000-0x000000000040A000-memory.dmp
    Filesize

    40KB

    Download
  • memory/3040-6-0x0000000001030000-0x0000000001046000-memory.dmp
    Filesize

    88KB

    Download