Analysis
- max time kernel
151s - max time network
124s - platform
windows10_x64 - resource
win10v20210410 - submitted
12/08/2021, 17:49
General
- Target 61cb66b049958cb48db0f5b33f96ae4f.exe
- Size 311KB
- Sample210812-by77le3vm6
- SHA256 cc700e4575649a012895b044f54ba9b8e87ea47efdeb755f32f135317451610d
Malware Config
Extracted
-
smokeloader
-
2020
-
http://readinglistforjuly1.xyz/
-
http://readinglistforjuly2.xyz/
-
http://readinglistforjuly3.xyz/
-
http://readinglistforjuly4.xyz/
-
http://readinglistforjuly5.xyz/
-
http://readinglistforjuly6.xyz/
-
http://readinglistforjuly7.xyz/
-
http://readinglistforjuly8.xyz/
-
http://readinglistforjuly9.xyz/
-
http://readinglistforjuly10.xyz/
-
http://readinglistforjuly1.site/
-
http://readinglistforjuly2.site/
-
http://readinglistforjuly3.site/
-
http://readinglistforjuly4.site/
-
http://readinglistforjuly5.site/
-
http://readinglistforjuly6.site/
-
http://readinglistforjuly7.site/
-
http://readinglistforjuly8.site/
-
http://readinglistforjuly9.site/
-
http://readinglistforjuly10.site/
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 19 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 38 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\61cb66b049958cb48db0f5b33f96ae4f.exe"C:\Users\Admin\AppData\Local\Temp\61cb66b049958cb48db0f5b33f96ae4f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\61cb66b049958cb48db0f5b33f96ae4f.exe"C:\Users\Admin\AppData\Local\Temp\61cb66b049958cb48db0f5b33f96ae4f.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/788-135-0x0000000000950000-0x000000000095C000-memory.dmp
memory/788-134-0x0000000000960000-0x0000000000966000-memory.dmp
memory/1108-120-0x0000000000C00000-0x0000000000C6B000-memory.dmp
memory/1108-119-0x0000000000C70000-0x0000000000CE4000-memory.dmp
memory/1164-132-0x00000000007C0000-0x00000000007C9000-memory.dmp
memory/1164-131-0x00000000007D0000-0x00000000007D5000-memory.dmp
memory/1248-144-0x0000000000500000-0x0000000000509000-memory.dmp
memory/1248-143-0x0000000000510000-0x0000000000515000-memory.dmp
memory/2132-137-0x0000000000BD0000-0x0000000000BD4000-memory.dmp
memory/2132-138-0x0000000000BC0000-0x0000000000BC9000-memory.dmp
memory/2764-114-0x0000000000400000-0x0000000000409000-memory.dmp
memory/3016-116-0x0000000000030000-0x000000000003A000-memory.dmp
memory/3036-117-0x00000000006A0000-0x00000000006B6000-memory.dmp
memory/3636-126-0x0000000000580000-0x000000000058B000-memory.dmp
memory/3636-125-0x0000000000590000-0x0000000000597000-memory.dmp
memory/3680-122-0x0000000000AF0000-0x0000000000AF7000-memory.dmp
memory/3680-123-0x0000000000AE0000-0x0000000000AEC000-memory.dmp
memory/3720-129-0x00000000001B0000-0x00000000001BF000-memory.dmp
memory/3720-128-0x00000000001C0000-0x00000000001C9000-memory.dmp
memory/3960-140-0x00000000009E0000-0x00000000009E5000-memory.dmp
memory/3960-141-0x00000000009D0000-0x00000000009D9000-memory.dmp