30e58538e3ddab70cc1edda521bfbba6.exe

General
Target

30e58538e3ddab70cc1edda521bfbba6.exe

Filesize

233KB

Completed

22-07-2021 08:06

Score
10 /10
MD5

30e58538e3ddab70cc1edda521bfbba6

SHA1

862591b95d16216f74b6b197de4f4740a881ccb8

SHA256

879f63c384febbffc5845be57df9c7ef33234b584f8059a38a3f4aafa2bc37e9

Malware Config

Extracted

Family smokeloader
Version 2020
C2

http://999080321newfolder1002002131-service1002.space/

http://999080321newfolder1002002231-service1002.space/

http://999080321newfolder3100231-service1002.space/

http://999080321newfolder1002002431-service1002.space/

http://999080321newfolder1002002531-service1002.space/

http://999080321newfolder33417-012425999080321.space/

http://999080321test125831-service10020125999080321.space/

http://999080321test136831-service10020125999080321.space/

http://999080321test147831-service10020125999080321.space/

http://999080321test146831-service10020125999080321.space/

http://999080321test134831-service10020125999080321.space/

http://999080321est213531-service1002012425999080321.ru/

http://999080321yes1t3481-service10020125999080321.ru/

http://999080321test13561-service10020125999080321.su/

http://999080321test14781-service10020125999080321.info/

http://999080321test13461-service10020125999080321.net/

http://999080321test15671-service10020125999080321.tech/

http://999080321test12671-service10020125999080321.online/

http://999080321utest1341-service10020125999080321.ru/

http://999080321uest71-service100201dom25999080321.ru/

http://999080321test61-service10020125999080321.website/

http://999080321test51-service10020125999080321.xyz/

http://999080321test41-service100201pro25999080321.ru/

http://999080321yest31-service100201rus25999080321.ru/

http://999080321rest21-service10020125999080321.eu/

http://999080321test11-service10020125999080321.press/

http://999080321newfolder4561-service10020125999080321.ru/

http://999080321rustest213-service10020125999080321.ru/

http://999080321test281-service10020125999080321.ru/

http://999080321test261-service10020125999080321.space/

http://999080321yomtest251-service10020125999080321.ru/

http://999080321yirtest231-service10020125999080321.ru/

rc4.i32
rc4.i32
Signatures 12

Filter: none

Discovery
  • SmokeLoader

    Description

    Modular backdoor trojan in use since 2014.

  • Executes dropped EXE
    tjrasfwtjrasfw

    Reported IOCs

    pidprocess
    4032tjrasfw
    4136tjrasfw
  • Deletes itself

    Reported IOCs

    pidprocess
    3008
  • Loads dropped DLL
    30e58538e3ddab70cc1edda521bfbba6.exe

    Reported IOCs

    pidprocess
    507230e58538e3ddab70cc1edda521bfbba6.exe
  • Suspicious use of SetThreadContext
    30e58538e3ddab70cc1edda521bfbba6.exetjrasfw

    Reported IOCs

    descriptionpidprocesstarget process
    PID 4448 set thread context of 5072444830e58538e3ddab70cc1edda521bfbba6.exe30e58538e3ddab70cc1edda521bfbba6.exe
    PID 4032 set thread context of 41364032tjrasfwtjrasfw
  • Checks SCSI registry key(s)
    30e58538e3ddab70cc1edda521bfbba6.exe

    Description

    SCSI information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistryPeripheral Device DiscoverySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI30e58538e3ddab70cc1edda521bfbba6.exe
    Key queried\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI30e58538e3ddab70cc1edda521bfbba6.exe
    Key enumerated\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI30e58538e3ddab70cc1edda521bfbba6.exe
  • Suspicious behavior: EnumeratesProcesses
    30e58538e3ddab70cc1edda521bfbba6.exe

    Reported IOCs

    pidprocess
    507230e58538e3ddab70cc1edda521bfbba6.exe
    507230e58538e3ddab70cc1edda521bfbba6.exe
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
    3008
  • Suspicious behavior: GetForegroundWindowSpam

    Reported IOCs

    pidprocess
    3008
  • Suspicious behavior: MapViewOfSection
    30e58538e3ddab70cc1edda521bfbba6.exe

    Reported IOCs

    pidprocess
    507230e58538e3ddab70cc1edda521bfbba6.exe
  • Suspicious use of AdjustPrivilegeToken

    Reported IOCs

    descriptionpidprocess
    Token: SeShutdownPrivilege3008
    Token: SeCreatePagefilePrivilege3008
  • Suspicious use of UnmapMainImage

    Reported IOCs

    pidprocess
    3008
  • Suspicious use of WriteProcessMemory
    30e58538e3ddab70cc1edda521bfbba6.exetjrasfw

    Reported IOCs

    descriptionpidprocesstarget process
    PID 4448 wrote to memory of 5072444830e58538e3ddab70cc1edda521bfbba6.exe30e58538e3ddab70cc1edda521bfbba6.exe
    PID 4448 wrote to memory of 5072444830e58538e3ddab70cc1edda521bfbba6.exe30e58538e3ddab70cc1edda521bfbba6.exe
    PID 4448 wrote to memory of 5072444830e58538e3ddab70cc1edda521bfbba6.exe30e58538e3ddab70cc1edda521bfbba6.exe
    PID 4448 wrote to memory of 5072444830e58538e3ddab70cc1edda521bfbba6.exe30e58538e3ddab70cc1edda521bfbba6.exe
    PID 4448 wrote to memory of 5072444830e58538e3ddab70cc1edda521bfbba6.exe30e58538e3ddab70cc1edda521bfbba6.exe
    PID 4448 wrote to memory of 5072444830e58538e3ddab70cc1edda521bfbba6.exe30e58538e3ddab70cc1edda521bfbba6.exe
    PID 4032 wrote to memory of 41364032tjrasfwtjrasfw
    PID 4032 wrote to memory of 41364032tjrasfwtjrasfw
    PID 4032 wrote to memory of 41364032tjrasfwtjrasfw
    PID 4032 wrote to memory of 41364032tjrasfwtjrasfw
    PID 4032 wrote to memory of 41364032tjrasfwtjrasfw
    PID 4032 wrote to memory of 41364032tjrasfwtjrasfw
Processes 4
  • C:\Users\Admin\AppData\Local\Temp\30e58538e3ddab70cc1edda521bfbba6.exe
    "C:\Users\Admin\AppData\Local\Temp\30e58538e3ddab70cc1edda521bfbba6.exe"
    Suspicious use of SetThreadContext
    Suspicious use of WriteProcessMemory
    PID:4448
    • C:\Users\Admin\AppData\Local\Temp\30e58538e3ddab70cc1edda521bfbba6.exe
      "C:\Users\Admin\AppData\Local\Temp\30e58538e3ddab70cc1edda521bfbba6.exe"
      Loads dropped DLL
      Checks SCSI registry key(s)
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:5072
  • C:\Users\Admin\AppData\Roaming\tjrasfw
    C:\Users\Admin\AppData\Roaming\tjrasfw
    Executes dropped EXE
    Suspicious use of SetThreadContext
    Suspicious use of WriteProcessMemory
    PID:4032
    • C:\Users\Admin\AppData\Roaming\tjrasfw
      C:\Users\Admin\AppData\Roaming\tjrasfw
      Executes dropped EXE
      PID:4136
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads
                        • C:\Users\Admin\AppData\Local\Temp\AE30.tmp

                          MD5

                          50741b3f2d7debf5d2bed63d88404029

                          SHA1

                          56210388a627b926162b36967045be06ffb1aad3

                          SHA256

                          f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c

                          SHA512

                          fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3

                        • C:\Users\Admin\AppData\Roaming\tjrasfw

                          MD5

                          30e58538e3ddab70cc1edda521bfbba6

                          SHA1

                          862591b95d16216f74b6b197de4f4740a881ccb8

                          SHA256

                          879f63c384febbffc5845be57df9c7ef33234b584f8059a38a3f4aafa2bc37e9

                          SHA512

                          08de8cf30f6061c3f4057d617e2e8bc4be5e24a1b5a339d29bfa9655682f0f7f07301866436309a368a0af8efc4f6682d63532105ec62aff4b96c73504d26703

                        • C:\Users\Admin\AppData\Roaming\tjrasfw

                          MD5

                          30e58538e3ddab70cc1edda521bfbba6

                          SHA1

                          862591b95d16216f74b6b197de4f4740a881ccb8

                          SHA256

                          879f63c384febbffc5845be57df9c7ef33234b584f8059a38a3f4aafa2bc37e9

                          SHA512

                          08de8cf30f6061c3f4057d617e2e8bc4be5e24a1b5a339d29bfa9655682f0f7f07301866436309a368a0af8efc4f6682d63532105ec62aff4b96c73504d26703

                        • C:\Users\Admin\AppData\Roaming\tjrasfw

                          MD5

                          30e58538e3ddab70cc1edda521bfbba6

                          SHA1

                          862591b95d16216f74b6b197de4f4740a881ccb8

                          SHA256

                          879f63c384febbffc5845be57df9c7ef33234b584f8059a38a3f4aafa2bc37e9

                          SHA512

                          08de8cf30f6061c3f4057d617e2e8bc4be5e24a1b5a339d29bfa9655682f0f7f07301866436309a368a0af8efc4f6682d63532105ec62aff4b96c73504d26703

                        • \Users\Admin\AppData\Local\Temp\AE30.tmp

                          MD5

                          50741b3f2d7debf5d2bed63d88404029

                          SHA1

                          56210388a627b926162b36967045be06ffb1aad3

                          SHA256

                          f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c

                          SHA512

                          fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3

                        • memory/3008-118-0x0000000000660000-0x0000000000677000-memory.dmp

                        • memory/4032-125-0x0000000002B80000-0x0000000002CCA000-memory.dmp

                        • memory/4136-122-0x0000000000402F68-mapping.dmp

                        • memory/4448-117-0x0000000002C70000-0x0000000002DBA000-memory.dmp

                        • memory/5072-114-0x0000000000400000-0x000000000040C000-memory.dmp

                        • memory/5072-115-0x0000000000402F68-mapping.dmp