Analysis
-
max time kernel
152s -
max time network
116s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
20-04-2021 12:17
Static task
static1
Behavioral task
behavioral1
Sample
c78d424eba64076d3af57b29b7602d25.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
c78d424eba64076d3af57b29b7602d25.exe
Resource
win10v20210408
General
-
Target
c78d424eba64076d3af57b29b7602d25.exe
-
Size
241KB
-
MD5
c78d424eba64076d3af57b29b7602d25
-
SHA1
c0a75b1e6c61f81f57d810b2cf74599038b51350
-
SHA256
5d82b4f16469d125e3615431b1ccdbbf2decc388e1e3b417d2c0e12e0cca78f6
-
SHA512
281fe544504c2f90c7938c2fd21c4ddfd95046f287e36cc5070a0504bd926ac04b728490317ddca93ebef705499efacda3c79b1e9873215a177238aeda2f2bdc
Malware Config
Extracted
smokeloader
2020
http://smbproperty.ru/
http://gmbshop.ru/
http://baksproperty.gov.ug/
http://magistralpsw.ru/
http://mpmanagertzz.ru/
http://powerglasspot.ru/
http://autopartswarehouses.ru/
http://memoloves.ru/
http://alfavanilin.ru/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1220 -
Loads dropped DLL 1 IoCs
Processes:
c78d424eba64076d3af57b29b7602d25.exepid process 1652 c78d424eba64076d3af57b29b7602d25.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
c78d424eba64076d3af57b29b7602d25.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c78d424eba64076d3af57b29b7602d25.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c78d424eba64076d3af57b29b7602d25.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c78d424eba64076d3af57b29b7602d25.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
c78d424eba64076d3af57b29b7602d25.exepid process 1652 c78d424eba64076d3af57b29b7602d25.exe 1652 c78d424eba64076d3af57b29b7602d25.exe 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1220 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
c78d424eba64076d3af57b29b7602d25.exepid process 1652 c78d424eba64076d3af57b29b7602d25.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
pid process 1220 1220 1220 1220 -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
pid process 1220 1220 1220 1220
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\9419.tmpMD5
d124f55b9393c976963407dff51ffa79
SHA12c7bbedd79791bfb866898c85b504186db610b5d
SHA256ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef
SHA512278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06
-
memory/1220-64-0x0000000002BE0000-0x0000000002BF6000-memory.dmpFilesize
88KB
-
memory/1652-60-0x00000000754F1000-0x00000000754F3000-memory.dmpFilesize
8KB
-
memory/1652-62-0x0000000000220000-0x000000000022A000-memory.dmpFilesize
40KB
-
memory/1652-63-0x0000000000400000-0x0000000000835000-memory.dmpFilesize
4.2MB