Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
14-04-2021 23:57
Static task
static1
Behavioral task
behavioral1
Sample
hb2le.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
hb2le.exe
Resource
win10v20210410
General
-
Target
hb2le.exe
-
Size
276KB
-
MD5
69c1c62895726fedc482d2b2f408f8ce
-
SHA1
a6327d2b1e6c0d30681085699aa2290e2e371994
-
SHA256
f8f9e464b8f667a85f7095e9ac4ff80a08a96e5c4765d62b18471b1908bb0109
-
SHA512
de5ebb736d1dc225ca56218538dfc8d27b61f16caa7ebd6a14ff7534b42cee1edecdde43f70524d96f6ecccf1303fba90cff5109375eb8d273fef9df71027ab6
Malware Config
Extracted
smokeloader
2020
http://etasuklavish.today/
http://mragyzmachnobesdi.today/
http://kimchinikuzims.today/
http://slacvostinrius.today/
http://straponuliusyn.today/
http://grammmdinss.today/
http://viprasputinsd.chimkent.su/
http://lupadypa.dagestan.su/
http://stoknolimchin.exnet.su/
http://musaroprovadnikov.live/
http://teemforyourexprensiti.life/
http://stolkgolmishutich.termez.su/
http://roompampamgandish.wtf/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 2492 -
Loads dropped DLL 1 IoCs
Processes:
hb2le.exepid process 3944 hb2le.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
hb2le.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hb2le.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hb2le.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hb2le.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
hb2le.exepid process 3944 hb2le.exe 3944 hb2le.exe 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2492 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
hb2le.exepid process 3944 hb2le.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
pid process 2492
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\2F6.tmpMD5
50741b3f2d7debf5d2bed63d88404029
SHA156210388a627b926162b36967045be06ffb1aad3
SHA256f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c
SHA512fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3
-
memory/2492-117-0x0000000001480000-0x0000000001496000-memory.dmpFilesize
88KB
-
memory/3944-115-0x0000000003E90000-0x0000000003E9A000-memory.dmpFilesize
40KB
-
memory/3944-116-0x0000000000400000-0x0000000003DA8000-memory.dmpFilesize
57.7MB