Analysis
-
max time kernel
154s -
max time network
130s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
03-05-2021 15:03
Static task
static1
Behavioral task
behavioral1
Sample
15d0c452_by_Libranalysis.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
15d0c452_by_Libranalysis.exe
Resource
win10v20210410
General
-
Target
15d0c452_by_Libranalysis.exe
-
Size
169KB
-
MD5
15d0c452ebee4621530ad0c834439a96
-
SHA1
7d8d83d21cc4c85382347545030eb7da5b66db6c
-
SHA256
5f31050b511cf181abfa18b04cdc3a4152afc18c34b4ffc1087496144ac56a7c
-
SHA512
39222091b9a87dcbc92ae477af2064838c7fde01f372145c06acc5f4b90d068db537b68d36e89e5068bdc0d2a4eee3700386adde5d2f97747c53ac62db436fdc
Malware Config
Extracted
smokeloader
2020
http://smbproperty.ru/
http://gmbshop.ru/
http://baksproperty.gov.ug/
http://magistralpsw.ru/
http://mpmanagertzz.ru/
http://powerglasspot.ru/
http://autopartswarehouses.ru/
http://memoloves.ru/
http://alfavanilin.ru/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1268 -
Loads dropped DLL 1 IoCs
Processes:
15d0c452_by_Libranalysis.exepid process 784 15d0c452_by_Libranalysis.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
15d0c452_by_Libranalysis.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 15d0c452_by_Libranalysis.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 15d0c452_by_Libranalysis.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 15d0c452_by_Libranalysis.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
15d0c452_by_Libranalysis.exepid process 784 15d0c452_by_Libranalysis.exe 784 15d0c452_by_Libranalysis.exe 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1268 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
15d0c452_by_Libranalysis.exepid process 784 15d0c452_by_Libranalysis.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
pid process 1268 1268 1268 1268 -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
pid process 1268 1268 1268 1268
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\9419.tmpMD5
d124f55b9393c976963407dff51ffa79
SHA12c7bbedd79791bfb866898c85b504186db610b5d
SHA256ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef
SHA512278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06
-
memory/784-60-0x0000000000220000-0x000000000022A000-memory.dmpFilesize
40KB
-
memory/784-61-0x0000000075AA1000-0x0000000075AA3000-memory.dmpFilesize
8KB
-
memory/784-63-0x0000000000400000-0x0000000000447000-memory.dmpFilesize
284KB
-
memory/1268-64-0x0000000002A30000-0x0000000002A46000-memory.dmpFilesize
88KB