Overview

overview

10

Static

static

SecuriteIn...34.exe

windows7_x64

SecuriteIn...34.exe

windows10_x64

10

Analysis

  • max time kernel
    124s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    14-03-2021 17:53

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.W32.AIDetect.malware2.29567.18434.exe

  • Size

    292KB

  • MD5

    a19ddedb140dec9232c60a8719044f0e

  • SHA1

    dbff7d815083faf53db85440402404f85424c99c

  • SHA256

    a60eba931c6438e60aed1b8a049a79cb6e53a28b84897c3963836c7d1e750c81

  • SHA512

    9c7e543d896ea3d328eb3e2a2773c9c2d9e1fd90ef25def6a0972948d016afb9f42883bf8838f023a3e64baa28e735c469825148e6ab556d449800283a23f946

Score
10/10
smokeloaderbackdoorbootkitpersistencetrojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://funzel.info/upload/

http://doeros.xyz/upload/

http://vromus.com/upload/

http://hqans.com/upload/

http://vxeudy.com/upload/

http://poderoa.com/upload/

http://nezzzo.com/upload/
rc4.i32
rc4.i32

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Executes dropped EXE 3 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware2.29567.18434.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware2.29567.18434.exe"
    1⤵
    • Loads dropped DLL
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:1152
  • C:\Users\Admin\AppData\Local\Temp\CF6F.exe
    C:\Users\Admin\AppData\Local\Temp\CF6F.exe
    1⤵
    • Executes dropped EXE
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of AdjustPrivilegeToken
    PID:1120
  • C:\Users\Admin\AppData\Local\Temp\D9BD.exe
    C:\Users\Admin\AppData\Local\Temp\D9BD.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:468
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\oeyklfxn\
      2⤵
        PID:1372
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\jsmrjidz.exe" C:\Windows\SysWOW64\oeyklfxn\
        2⤵
          PID:1944
        • C:\Users\Admin\owlpcajj.exe
          "C:\Users\Admin\owlpcajj.exe" /d"C:\Users\Admin\AppData\Local\Temp\D9BD.exe" /e5503011200000005
          2⤵
          • Executes dropped EXE
          PID:1260

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Bootkit

      1
      T1067

      Privilege Escalation

      Defense Evasion

      Credential Access

      Discovery

      System Information Discovery

      2
      T1082

      Query Registry

      1
      T1012

      Peripheral Device Discovery

      1
      T1120

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\CF6F.exe
        MD5

        b7264a7e95d24dc99ccd7b47ec80d19d

        SHA1

        606a7e6dc0b1d37073efdc8294cd8ebb0e6b6b99

        SHA256

        0bc6140084080837def0a3ea249c460267a4a995a4ece754b1af74bfa97b070e

        SHA512

        22db172b4be92ed5d3f0abd0ce838c26393b74875c6696f47c25e7064beb66cd53ed37d47879f9670d88e9c4861466e5ade729134a69d19d13662490eb545b6c

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\D9BD.exe
        MD5

        b2b843aca834ec04444536ac1487b4ce

        SHA1

        6d2ea3cfea293b5a4e813736fffcc40fd55a4cce

        SHA256

        9efb704efe3b8c9e836dab14c52e3be57b444963bfce3493385adb4f5070cc6c

        SHA512

        f2de1089949606cc0f5ee17077b3361056988379857e96a1a4fe3571a2849137ac2ecab91400e8a71a7f49154a1902fb711c547a1d87d82be0062c8cc04dc374

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\D9BD.exe
        MD5

        b2b843aca834ec04444536ac1487b4ce

        SHA1

        6d2ea3cfea293b5a4e813736fffcc40fd55a4cce

        SHA256

        9efb704efe3b8c9e836dab14c52e3be57b444963bfce3493385adb4f5070cc6c

        SHA512

        f2de1089949606cc0f5ee17077b3361056988379857e96a1a4fe3571a2849137ac2ecab91400e8a71a7f49154a1902fb711c547a1d87d82be0062c8cc04dc374

        Download Submit
      • C:\Users\Admin\owlpcajj.exe
        MD5

        2f5d3e33a3b9036d81e01e3f2faf28b9

        SHA1

        476572df5d815e1a41eeb2919b4e6dcf363ecdb6

        SHA256

        3dc3c9483411698c09dc1db41f41213624d93d4ce8ee518ee59ba6e5c27cb4dc

        SHA512

        a4feb3773e12f1f16a866cfa8e134db4c04de385adbcac151152b97126aea12b9071a930a471f19e05ee81ac24efcca6f9ca60ca1a42a550561ee064f4fdcfcc

        Download Submit
      • \Users\Admin\AppData\Local\Temp\CC4F.tmp
        MD5

        d124f55b9393c976963407dff51ffa79

        SHA1

        2c7bbedd79791bfb866898c85b504186db610b5d

        SHA256

        ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

        SHA512

        278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

        Download Submit
      • \Users\Admin\owlpcajj.exe
        MD5

        2f5d3e33a3b9036d81e01e3f2faf28b9

        SHA1

        476572df5d815e1a41eeb2919b4e6dcf363ecdb6

        SHA256

        3dc3c9483411698c09dc1db41f41213624d93d4ce8ee518ee59ba6e5c27cb4dc

        SHA512

        a4feb3773e12f1f16a866cfa8e134db4c04de385adbcac151152b97126aea12b9071a930a471f19e05ee81ac24efcca6f9ca60ca1a42a550561ee064f4fdcfcc

        Download Submit
      • memory/468-14-0x0000000000000000-mapping.dmp
        Download
      • memory/468-21-0x0000000000400000-0x0000000000415000-memory.dmp
        Filesize

        84KB

        Download
      • memory/468-20-0x0000000000020000-0x0000000000033000-memory.dmp
        Filesize

        76KB

        Download
      • memory/468-16-0x0000000002CC0000-0x0000000002CD1000-memory.dmp
        Filesize

        68KB

        Download
      • memory/1120-10-0x0000000002CD0000-0x0000000002CE1000-memory.dmp
        Filesize

        68KB

        Download
      • memory/1120-13-0x0000000000400000-0x000000000046F000-memory.dmp
        Filesize

        444KB

        Download
      • memory/1120-12-0x00000000002B0000-0x000000000031B000-memory.dmp
        Filesize

        428KB

        Download
      • memory/1120-8-0x0000000000000000-mapping.dmp
        Download
      • memory/1152-2-0x0000000002C90000-0x0000000002CA1000-memory.dmp
        Filesize

        68KB

        Download
      • memory/1152-6-0x0000000000400000-0x0000000000409000-memory.dmp
        Filesize

        36KB

        Download
      • memory/1152-5-0x0000000000030000-0x0000000000039000-memory.dmp
        Filesize

        36KB

        Download
      • memory/1152-3-0x00000000760C1000-0x00000000760C3000-memory.dmp
        Filesize

        8KB

        Download
      • memory/1328-7-0x0000000002A50000-0x0000000002A66000-memory.dmp
        Filesize

        88KB

        Download
      • memory/1372-19-0x0000000000000000-mapping.dmp
        Download
      • memory/1944-22-0x0000000000000000-mapping.dmp
        Download