Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
17-04-2021 09:46
Static task
static1
Behavioral task
behavioral1
Sample
fm6t2.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
fm6t2.exe
Resource
win10v20210410
General
-
Target
fm6t2.exe
-
Size
276KB
-
MD5
69c1c62895726fedc482d2b2f408f8ce
-
SHA1
a6327d2b1e6c0d30681085699aa2290e2e371994
-
SHA256
f8f9e464b8f667a85f7095e9ac4ff80a08a96e5c4765d62b18471b1908bb0109
-
SHA512
de5ebb736d1dc225ca56218538dfc8d27b61f16caa7ebd6a14ff7534b42cee1edecdde43f70524d96f6ecccf1303fba90cff5109375eb8d273fef9df71027ab6
Malware Config
Extracted
smokeloader
2020
http://etasuklavish.today/
http://mragyzmachnobesdi.today/
http://kimchinikuzims.today/
http://slacvostinrius.today/
http://straponuliusyn.today/
http://grammmdinss.today/
http://viprasputinsd.chimkent.su/
http://lupadypa.dagestan.su/
http://stoknolimchin.exnet.su/
http://musaroprovadnikov.live/
http://teemforyourexprensiti.life/
http://stolkgolmishutich.termez.su/
http://roompampamgandish.wtf/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1288 -
Loads dropped DLL 1 IoCs
Processes:
fm6t2.exepid process 772 fm6t2.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
fm6t2.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fm6t2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fm6t2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fm6t2.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
fm6t2.exepid process 772 fm6t2.exe 772 fm6t2.exe 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 1288 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1288 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
fm6t2.exepid process 772 fm6t2.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
pid process 1288 1288 1288 1288 -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
pid process 1288 1288 1288 1288
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\2F6.tmpMD5
d124f55b9393c976963407dff51ffa79
SHA12c7bbedd79791bfb866898c85b504186db610b5d
SHA256ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef
SHA512278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06
-
memory/772-60-0x0000000075EF1000-0x0000000075EF3000-memory.dmpFilesize
8KB
-
memory/772-62-0x00000000003A0000-0x00000000003AA000-memory.dmpFilesize
40KB
-
memory/772-63-0x0000000000400000-0x0000000003DA8000-memory.dmpFilesize
57.7MB
-
memory/1288-64-0x00000000021C0000-0x00000000021D6000-memory.dmpFilesize
88KB