Analysis
-
max time kernel
150s -
max time network
110s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
05-03-2021 17:05
Behavioral task
behavioral1
Sample
25959cfe4619126ab554d3111b875218f1dbfadd79eed1ed0f6a8c1900fa36e0.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
25959cfe4619126ab554d3111b875218f1dbfadd79eed1ed0f6a8c1900fa36e0.exe
Resource
win10v20201028
General
-
Target
25959cfe4619126ab554d3111b875218f1dbfadd79eed1ed0f6a8c1900fa36e0.exe
-
Size
308KB
-
MD5
c067e0a2d7fc6092bb77abc7f7156b60
-
SHA1
52f68073caec0fd424c7cbaaed5f5221d7103d20
-
SHA256
25959cfe4619126ab554d3111b875218f1dbfadd79eed1ed0f6a8c1900fa36e0
-
SHA512
685145c679413f82101c328ce4264c5f84d0347db1c5170e16d8a459b9ad12a87bf5e718e049e5c9c639e22197ee26d4aa33fac8c133b9d86772dfe1a8068dfc
Malware Config
Extracted
smokeloader
2020
http://pukupoko.top/
http://halyavapridi.top/
http://holofrew.me/
Signatures
-
Detected Netwalker Ransomware 2 IoCs
Detected unpacked Netwalker executable.
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\jgcttjj netwalker_ransomware C:\Users\Admin\AppData\Roaming\jgcttjj netwalker_ransomware -
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\jgcttjj cryptone C:\Users\Admin\AppData\Roaming\jgcttjj cryptone -
Executes dropped EXE 1 IoCs
Processes:
jgcttjjpid process 2588 jgcttjj -
Deletes itself 1 IoCs
Processes:
pid process 3016 -
Loads dropped DLL 1 IoCs
Processes:
25959cfe4619126ab554d3111b875218f1dbfadd79eed1ed0f6a8c1900fa36e0.exepid process 740 25959cfe4619126ab554d3111b875218f1dbfadd79eed1ed0f6a8c1900fa36e0.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
25959cfe4619126ab554d3111b875218f1dbfadd79eed1ed0f6a8c1900fa36e0.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 25959cfe4619126ab554d3111b875218f1dbfadd79eed1ed0f6a8c1900fa36e0.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 25959cfe4619126ab554d3111b875218f1dbfadd79eed1ed0f6a8c1900fa36e0.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 25959cfe4619126ab554d3111b875218f1dbfadd79eed1ed0f6a8c1900fa36e0.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
pid process 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3016 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
25959cfe4619126ab554d3111b875218f1dbfadd79eed1ed0f6a8c1900fa36e0.exepid process 740 25959cfe4619126ab554d3111b875218f1dbfadd79eed1ed0f6a8c1900fa36e0.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
pid process 3016
Processes
-
C:\Users\Admin\AppData\Local\Temp\25959cfe4619126ab554d3111b875218f1dbfadd79eed1ed0f6a8c1900fa36e0.exe"C:\Users\Admin\AppData\Local\Temp\25959cfe4619126ab554d3111b875218f1dbfadd79eed1ed0f6a8c1900fa36e0.exe"1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\jgcttjjC:\Users\Admin\AppData\Roaming\jgcttjj1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7046.tmpMD5
50741b3f2d7debf5d2bed63d88404029
SHA156210388a627b926162b36967045be06ffb1aad3
SHA256f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c
SHA512fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3
-
C:\Users\Admin\AppData\Roaming\jgcttjjMD5
c067e0a2d7fc6092bb77abc7f7156b60
SHA152f68073caec0fd424c7cbaaed5f5221d7103d20
SHA25625959cfe4619126ab554d3111b875218f1dbfadd79eed1ed0f6a8c1900fa36e0
SHA512685145c679413f82101c328ce4264c5f84d0347db1c5170e16d8a459b9ad12a87bf5e718e049e5c9c639e22197ee26d4aa33fac8c133b9d86772dfe1a8068dfc
-
C:\Users\Admin\AppData\Roaming\jgcttjjMD5
c067e0a2d7fc6092bb77abc7f7156b60
SHA152f68073caec0fd424c7cbaaed5f5221d7103d20
SHA25625959cfe4619126ab554d3111b875218f1dbfadd79eed1ed0f6a8c1900fa36e0
SHA512685145c679413f82101c328ce4264c5f84d0347db1c5170e16d8a459b9ad12a87bf5e718e049e5c9c639e22197ee26d4aa33fac8c133b9d86772dfe1a8068dfc
-
\Users\Admin\AppData\Local\Temp\7046.tmpMD5
50741b3f2d7debf5d2bed63d88404029
SHA156210388a627b926162b36967045be06ffb1aad3
SHA256f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c
SHA512fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3
-
memory/740-4-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/740-3-0x00000000005E0000-0x0000000000606000-memory.dmpFilesize
152KB
-
memory/3016-5-0x00000000005F0000-0x0000000000606000-memory.dmpFilesize
88KB