Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
31-07-2021 20:05
Static task
static1
Behavioral task
behavioral1
Sample
2A0A05BCAE0114F543206ED1A81A8C69.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
2A0A05BCAE0114F543206ED1A81A8C69.exe
Resource
win10v20210410
General
-
Target
2A0A05BCAE0114F543206ED1A81A8C69.exe
-
Size
1.5MB
-
MD5
2a0a05bcae0114f543206ed1a81a8c69
-
SHA1
0e6b17c5c3dcab55697b4589e8a239961fac9ed0
-
SHA256
d74a07eeb26faeed4799f582bcb3c22ba985cc7bf21685d3b6e37aa694a72d97
-
SHA512
5aaee090fc713af1add2a040bb6cfdde26650c6991249d7cfe94bfdb04e5a9a65f2ede7db317a2eb67e0763a097c997612fbef2c9829053e81bb6d9afe97f9cb
Malware Config
Extracted
smokeloader
2020
http://conceitosseg.com/upload/
http://integrasidata.com/upload/
http://ozentekstil.com/upload/
http://finbelportal.com/upload/
http://telanganadigital.com/upload/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 1096 created 3336 1096 WerFault.exe essscbj -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS017F0934\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS017F0934\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS017F0934\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS017F0934\libcurlpp.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS017F0934\libstdc++-6.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS017F0934\libstdc++-6.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS017F0934\libcurl.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS017F0934\libcurl.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS017F0934\libcurlpp.dll aspack_v212_v242 -
Executes dropped EXE 4 IoCs
Processes:
setup_install.exekarotima_1.exekarotima_2.exeessscbjpid process 2344 setup_install.exe 3304 karotima_1.exe 3116 karotima_2.exe 3336 essscbj -
Loads dropped DLL 7 IoCs
Processes:
setup_install.exekarotima_2.exepid process 2344 setup_install.exe 2344 setup_install.exe 2344 setup_install.exe 2344 setup_install.exe 2344 setup_install.exe 2344 setup_install.exe 3116 karotima_2.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 11 ipinfo.io 12 ipinfo.io -
Drops file in Windows directory 1 IoCs
Processes:
WerFault.exedescription ioc process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1096 3336 WerFault.exe essscbj -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
karotima_2.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI karotima_2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI karotima_2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI karotima_2.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
karotima_2.exepid process 3116 karotima_2.exe 3116 karotima_2.exe 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 3016 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3016 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
karotima_2.exepid process 3116 karotima_2.exe -
Suspicious use of AdjustPrivilegeToken 20 IoCs
Processes:
WerFault.exedescription pid process Token: SeShutdownPrivilege 3016 Token: SeCreatePagefilePrivilege 3016 Token: SeShutdownPrivilege 3016 Token: SeCreatePagefilePrivilege 3016 Token: SeShutdownPrivilege 3016 Token: SeCreatePagefilePrivilege 3016 Token: SeShutdownPrivilege 3016 Token: SeCreatePagefilePrivilege 3016 Token: SeShutdownPrivilege 3016 Token: SeCreatePagefilePrivilege 3016 Token: SeRestorePrivilege 1096 WerFault.exe Token: SeBackupPrivilege 1096 WerFault.exe Token: SeBackupPrivilege 1096 WerFault.exe Token: SeDebugPrivilege 1096 WerFault.exe Token: SeShutdownPrivilege 3016 Token: SeCreatePagefilePrivilege 3016 Token: SeShutdownPrivilege 3016 Token: SeCreatePagefilePrivilege 3016 Token: SeShutdownPrivilege 3016 Token: SeCreatePagefilePrivilege 3016 -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
2A0A05BCAE0114F543206ED1A81A8C69.exesetup_install.execmd.execmd.exedescription pid process target process PID 1808 wrote to memory of 2344 1808 2A0A05BCAE0114F543206ED1A81A8C69.exe setup_install.exe PID 1808 wrote to memory of 2344 1808 2A0A05BCAE0114F543206ED1A81A8C69.exe setup_install.exe PID 1808 wrote to memory of 2344 1808 2A0A05BCAE0114F543206ED1A81A8C69.exe setup_install.exe PID 2344 wrote to memory of 1992 2344 setup_install.exe cmd.exe PID 2344 wrote to memory of 1992 2344 setup_install.exe cmd.exe PID 2344 wrote to memory of 1992 2344 setup_install.exe cmd.exe PID 2344 wrote to memory of 2808 2344 setup_install.exe cmd.exe PID 2344 wrote to memory of 2808 2344 setup_install.exe cmd.exe PID 2344 wrote to memory of 2808 2344 setup_install.exe cmd.exe PID 1992 wrote to memory of 3304 1992 cmd.exe karotima_1.exe PID 1992 wrote to memory of 3304 1992 cmd.exe karotima_1.exe PID 1992 wrote to memory of 3304 1992 cmd.exe karotima_1.exe PID 2808 wrote to memory of 3116 2808 cmd.exe karotima_2.exe PID 2808 wrote to memory of 3116 2808 cmd.exe karotima_2.exe PID 2808 wrote to memory of 3116 2808 cmd.exe karotima_2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2A0A05BCAE0114F543206ED1A81A8C69.exe"C:\Users\Admin\AppData\Local\Temp\2A0A05BCAE0114F543206ED1A81A8C69.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\7zS017F0934\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS017F0934\setup_install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c karotima_1.exe3⤵
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\7zS017F0934\karotima_1.exekarotima_1.exe4⤵
- Executes dropped EXE
PID:3304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c karotima_2.exe3⤵
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\7zS017F0934\karotima_2.exekarotima_2.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3116
-
C:\Users\Admin\AppData\Roaming\essscbjC:\Users\Admin\AppData\Roaming\essscbj1⤵
- Executes dropped EXE
PID:3336 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 2402⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Drops file in Windows directory
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1096
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS017F0934\karotima_1.exeMD5
9108ad5775c76cccbb4eadf02de24f5d
SHA182996bc4f72b3234536d0b58630d5d26bcf904b0
SHA256c9d5525b2f2b76087121039ee1c23ed35508e60f653479722ec64ea3a064878e
SHA51219021a28555bba1fe1bdcdc8845f1bcadebd256c7db02b9329d6b44ae01a123a00e162cc34a97ba51f088cafa6f54ab1de8f82f771ac54b94a3a796f84f73362
-
C:\Users\Admin\AppData\Local\Temp\7zS017F0934\karotima_1.txtMD5
9108ad5775c76cccbb4eadf02de24f5d
SHA182996bc4f72b3234536d0b58630d5d26bcf904b0
SHA256c9d5525b2f2b76087121039ee1c23ed35508e60f653479722ec64ea3a064878e
SHA51219021a28555bba1fe1bdcdc8845f1bcadebd256c7db02b9329d6b44ae01a123a00e162cc34a97ba51f088cafa6f54ab1de8f82f771ac54b94a3a796f84f73362
-
C:\Users\Admin\AppData\Local\Temp\7zS017F0934\karotima_2.exeMD5
2adf1986be67af56f5bfe1b9b857bdaa
SHA14336779d7127ea074a561632bc838b94e460a0f1
SHA2561c83bfcca6d10cdb603db804212d2ff60a478cbdd3c8547636e733a1e2bae28d
SHA512c86ffccffdc0378bd5241ca8ebbb7b0ac94901feaa37f53757d290c8785d15bdb75c837e93e88c57e597cbacdb7d2ceac8af992091fee35e2934afbfcd2424f7
-
C:\Users\Admin\AppData\Local\Temp\7zS017F0934\karotima_2.txtMD5
2adf1986be67af56f5bfe1b9b857bdaa
SHA14336779d7127ea074a561632bc838b94e460a0f1
SHA2561c83bfcca6d10cdb603db804212d2ff60a478cbdd3c8547636e733a1e2bae28d
SHA512c86ffccffdc0378bd5241ca8ebbb7b0ac94901feaa37f53757d290c8785d15bdb75c837e93e88c57e597cbacdb7d2ceac8af992091fee35e2934afbfcd2424f7
-
C:\Users\Admin\AppData\Local\Temp\7zS017F0934\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS017F0934\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS017F0934\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS017F0934\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS017F0934\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS017F0934\setup_install.exeMD5
57bfe9fe09c69c1f1ca4d484db1ed84a
SHA17bc744a5980f08eaac7622387df0c061a967d5b6
SHA256e21ebd099758bc8552b9f1b8b8026a8b73857b299b1995273f4ce9c989a0c83b
SHA5123304e78c461e6e754af12e85c83039a06f92d2fa74e7430f31941b130560b77fc346a59235baab131308ece20e5db84c2a757bfb47a1319cbcc24b37edad0e38
-
C:\Users\Admin\AppData\Local\Temp\7zS017F0934\setup_install.exeMD5
57bfe9fe09c69c1f1ca4d484db1ed84a
SHA17bc744a5980f08eaac7622387df0c061a967d5b6
SHA256e21ebd099758bc8552b9f1b8b8026a8b73857b299b1995273f4ce9c989a0c83b
SHA5123304e78c461e6e754af12e85c83039a06f92d2fa74e7430f31941b130560b77fc346a59235baab131308ece20e5db84c2a757bfb47a1319cbcc24b37edad0e38
-
C:\Users\Admin\AppData\Local\Temp\CC4F.tmpMD5
50741b3f2d7debf5d2bed63d88404029
SHA156210388a627b926162b36967045be06ffb1aad3
SHA256f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c
SHA512fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3
-
C:\Users\Admin\AppData\Roaming\essscbjMD5
2adf1986be67af56f5bfe1b9b857bdaa
SHA14336779d7127ea074a561632bc838b94e460a0f1
SHA2561c83bfcca6d10cdb603db804212d2ff60a478cbdd3c8547636e733a1e2bae28d
SHA512c86ffccffdc0378bd5241ca8ebbb7b0ac94901feaa37f53757d290c8785d15bdb75c837e93e88c57e597cbacdb7d2ceac8af992091fee35e2934afbfcd2424f7
-
C:\Users\Admin\AppData\Roaming\essscbjMD5
2adf1986be67af56f5bfe1b9b857bdaa
SHA14336779d7127ea074a561632bc838b94e460a0f1
SHA2561c83bfcca6d10cdb603db804212d2ff60a478cbdd3c8547636e733a1e2bae28d
SHA512c86ffccffdc0378bd5241ca8ebbb7b0ac94901feaa37f53757d290c8785d15bdb75c837e93e88c57e597cbacdb7d2ceac8af992091fee35e2934afbfcd2424f7
-
\Users\Admin\AppData\Local\Temp\7zS017F0934\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
\Users\Admin\AppData\Local\Temp\7zS017F0934\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
\Users\Admin\AppData\Local\Temp\7zS017F0934\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
\Users\Admin\AppData\Local\Temp\7zS017F0934\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
\Users\Admin\AppData\Local\Temp\7zS017F0934\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
\Users\Admin\AppData\Local\Temp\7zS017F0934\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
\Users\Admin\AppData\Local\Temp\CC4F.tmpMD5
50741b3f2d7debf5d2bed63d88404029
SHA156210388a627b926162b36967045be06ffb1aad3
SHA256f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c
SHA512fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3
-
memory/1992-134-0x0000000000000000-mapping.dmp
-
memory/2344-128-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/2344-129-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/2344-140-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/2344-131-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/2344-130-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/2344-143-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/2344-141-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/2344-137-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/2344-114-0x0000000000000000-mapping.dmp
-
memory/2808-135-0x0000000000000000-mapping.dmp
-
memory/3016-147-0x0000000001270000-0x0000000001285000-memory.dmpFilesize
84KB
-
memory/3116-146-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/3116-145-0x00000000004C0000-0x00000000004C9000-memory.dmpFilesize
36KB
-
memory/3116-138-0x0000000000000000-mapping.dmp
-
memory/3304-136-0x0000000000000000-mapping.dmp
-
memory/3336-152-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/3336-151-0x00000000004D0000-0x000000000061A000-memory.dmpFilesize
1.3MB