Analysis
- max time kernel
151s - max time network
151s - platform
windows7_x64 - resource
win7v20201028 - submitted
14/02/2021, 16:33
Static task
static1
Behavioral task
behavioral1
Sample
f083955b9819bd51d2a27efab3193a3d.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral2
Sample
f083955b9819bd51d2a27efab3193a3d.exe
Resource
win10v20201028
windows10_x64
General
- Target f083955b9819bd51d2a27efab3193a3d.exe
- Size 128KB
- Sample210214-pp4dh7ltjs
- SHA256 0cac1630f56f25462bfc12aeeeb52d4eb515783c5cba8fd74d715e2e46adaca6
- MD5 f083955b9819bd51d2a27efab3193a3d
- SHA1 b7585c6134264a8543b44f4567478ff43430079c
- SHA512 793c49aa5bb19dd4541d6608dc67a1d832809300c349ca3e664f3aaed596003ed7035769b801c84e96d263679e6777116ae322a031784934574403a164e80e3b
- MD5 SHA1 SHA512
Malware Config
Extracted
-
smokeloader
-
2019
-
http://10022020newfolder1002002131-service1002.space/
-
http://10022020newfolder1002002231-service1002.space/
-
http://10022020newfolder3100231-service1002.space/
-
http://10022020newfolder1002002431-service1002.space/
-
http://10022020newfolder1002002531-service1002.space/
-
http://10022020newfolder33417-01242510022020.space/
-
http://10022020test125831-service1002012510022020.space/
-
http://10022020test136831-service1002012510022020.space/
-
http://10022020test147831-service1002012510022020.space/
-
http://10022020test146831-service1002012510022020.space/
-
http://10022020test134831-service1002012510022020.space/
-
http://10022020est213531-service100201242510022020.ru/
-
http://10022020yes1t3481-service1002012510022020.ru/
-
http://10022020test13561-service1002012510022020.su/
-
http://10022020test14781-service1002012510022020.info/
-
http://10022020test13461-service1002012510022020.net/
-
http://10022020test15671-service1002012510022020.tech/
-
http://10022020test12671-service1002012510022020.online/
-
http://10022020utest1341-service1002012510022020.ru/
-
http://10022020uest71-service100201dom2510022020.ru/
-
http://10022020test61-service1002012510022020.website/
-
http://10022020test51-service1002012510022020.xyz/
-
http://10022020test41-service100201pro2510022020.ru/
-
http://10022020yest31-service100201rus2510022020.ru/
-
http://10022020rest21-service1002012510022020.eu/
-
http://10022020test11-service1002012510022020.press/
-
http://10022020newfolder4561-service1002012510022020.ru/
-
http://10022020rustest213-service1002012510022020.ru/
-
http://10022020test281-service1002012510022020.ru/
-
http://10022020test261-service1002012510022020.space/
-
http://10022020yomtest251-service1002012510022020.ru/
-
http://10022020yirtest231-service1002012510022020.ru/
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Deletes itself 1 IoCs
pid Process 1196 Process not Found - Loads dropped DLL 1 IoCs
pid Process 1364 f083955b9819bd51d2a27efab3193a3d.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1832 set thread context of 1364 1832 f083955b9819bd51d2a27efab3193a3d.exe 26 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f083955b9819bd51d2a27efab3193a3d.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f083955b9819bd51d2a27efab3193a3d.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f083955b9819bd51d2a27efab3193a3d.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1364 f083955b9819bd51d2a27efab3193a3d.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1832 wrote to memory of 1364 1832 f083955b9819bd51d2a27efab3193a3d.exe 26 PID 1832 wrote to memory of 1364 1832 f083955b9819bd51d2a27efab3193a3d.exe 26 PID 1832 wrote to memory of 1364 1832 f083955b9819bd51d2a27efab3193a3d.exe 26 PID 1832 wrote to memory of 1364 1832 f083955b9819bd51d2a27efab3193a3d.exe 26 PID 1832 wrote to memory of 1364 1832 f083955b9819bd51d2a27efab3193a3d.exe 26 PID 1832 wrote to memory of 1364 1832 f083955b9819bd51d2a27efab3193a3d.exe 26 PID 1832 wrote to memory of 1364 1832 f083955b9819bd51d2a27efab3193a3d.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\f083955b9819bd51d2a27efab3193a3d.exe"C:\Users\Admin\AppData\Local\Temp\f083955b9819bd51d2a27efab3193a3d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\f083955b9819bd51d2a27efab3193a3d.exe"C:\Users\Admin\AppData\Local\Temp\f083955b9819bd51d2a27efab3193a3d.exe"2⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1364
-