Analysis
-
max time kernel
151s -
max time network
125s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
13-08-2021 14:33
Static task
static1
Behavioral task
behavioral1
Sample
de207c74c9afa99f39122c8fb5e8b1e1.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
de207c74c9afa99f39122c8fb5e8b1e1.exe
Resource
win10v20210410
General
-
Target
de207c74c9afa99f39122c8fb5e8b1e1.exe
-
Size
180KB
-
MD5
de207c74c9afa99f39122c8fb5e8b1e1
-
SHA1
f0a65c9b9b97632b424bd3e3c42932aeb42ac811
-
SHA256
831ec334b4f5f045aa0ac5f69a91bb69b40741a44b019f3546f21a9aeda6fcd2
-
SHA512
a9884d4696c687716f5c303b6123655738ec64f61f41b1366a47a3bb14f2895fba1a9778958db5bb0015e7aed7eb0fd345320935748f565490656c8765718d7b
Malware Config
Extracted
smokeloader
2020
http://readinglistforjuly1.xyz/
http://readinglistforjuly2.xyz/
http://readinglistforjuly3.xyz/
http://readinglistforjuly4.xyz/
http://readinglistforjuly5.xyz/
http://readinglistforjuly6.xyz/
http://readinglistforjuly7.xyz/
http://readinglistforjuly8.xyz/
http://readinglistforjuly9.xyz/
http://readinglistforjuly10.xyz/
http://readinglistforjuly1.site/
http://readinglistforjuly2.site/
http://readinglistforjuly3.site/
http://readinglistforjuly4.site/
http://readinglistforjuly5.site/
http://readinglistforjuly6.site/
http://readinglistforjuly7.site/
http://readinglistforjuly8.site/
http://readinglistforjuly9.site/
http://readinglistforjuly10.site/
http://readinglistforjuly1.club/
http://readinglistforjuly2.club/
http://readinglistforjuly3.club/
http://readinglistforjuly4.club/
http://readinglistforjuly5.club/
http://readinglistforjuly6.club/
http://readinglistforjuly7.club/
http://readinglistforjuly8.club/
http://readinglistforjuly9.club/
http://readinglistforjuly10.club/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 2756 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
de207c74c9afa99f39122c8fb5e8b1e1.exedescription pid process target process PID 3540 set thread context of 1552 3540 de207c74c9afa99f39122c8fb5e8b1e1.exe de207c74c9afa99f39122c8fb5e8b1e1.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
de207c74c9afa99f39122c8fb5e8b1e1.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI de207c74c9afa99f39122c8fb5e8b1e1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI de207c74c9afa99f39122c8fb5e8b1e1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI de207c74c9afa99f39122c8fb5e8b1e1.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
de207c74c9afa99f39122c8fb5e8b1e1.exepid process 1552 de207c74c9afa99f39122c8fb5e8b1e1.exe 1552 de207c74c9afa99f39122c8fb5e8b1e1.exe 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2756 -
Suspicious behavior: MapViewOfSection 19 IoCs
Processes:
de207c74c9afa99f39122c8fb5e8b1e1.exepid process 1552 de207c74c9afa99f39122c8fb5e8b1e1.exe 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 2756 -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
pid process 2756 -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
de207c74c9afa99f39122c8fb5e8b1e1.exedescription pid process target process PID 3540 wrote to memory of 1552 3540 de207c74c9afa99f39122c8fb5e8b1e1.exe de207c74c9afa99f39122c8fb5e8b1e1.exe PID 3540 wrote to memory of 1552 3540 de207c74c9afa99f39122c8fb5e8b1e1.exe de207c74c9afa99f39122c8fb5e8b1e1.exe PID 3540 wrote to memory of 1552 3540 de207c74c9afa99f39122c8fb5e8b1e1.exe de207c74c9afa99f39122c8fb5e8b1e1.exe PID 3540 wrote to memory of 1552 3540 de207c74c9afa99f39122c8fb5e8b1e1.exe de207c74c9afa99f39122c8fb5e8b1e1.exe PID 3540 wrote to memory of 1552 3540 de207c74c9afa99f39122c8fb5e8b1e1.exe de207c74c9afa99f39122c8fb5e8b1e1.exe PID 3540 wrote to memory of 1552 3540 de207c74c9afa99f39122c8fb5e8b1e1.exe de207c74c9afa99f39122c8fb5e8b1e1.exe PID 2756 wrote to memory of 3104 2756 explorer.exe PID 2756 wrote to memory of 3104 2756 explorer.exe PID 2756 wrote to memory of 3104 2756 explorer.exe PID 2756 wrote to memory of 3104 2756 explorer.exe PID 2756 wrote to memory of 1112 2756 explorer.exe PID 2756 wrote to memory of 1112 2756 explorer.exe PID 2756 wrote to memory of 1112 2756 explorer.exe PID 2756 wrote to memory of 3508 2756 explorer.exe PID 2756 wrote to memory of 3508 2756 explorer.exe PID 2756 wrote to memory of 3508 2756 explorer.exe PID 2756 wrote to memory of 3508 2756 explorer.exe PID 2756 wrote to memory of 3692 2756 explorer.exe PID 2756 wrote to memory of 3692 2756 explorer.exe PID 2756 wrote to memory of 3692 2756 explorer.exe PID 2756 wrote to memory of 2980 2756 explorer.exe PID 2756 wrote to memory of 2980 2756 explorer.exe PID 2756 wrote to memory of 2980 2756 explorer.exe PID 2756 wrote to memory of 2980 2756 explorer.exe PID 2756 wrote to memory of 1252 2756 explorer.exe PID 2756 wrote to memory of 1252 2756 explorer.exe PID 2756 wrote to memory of 1252 2756 explorer.exe PID 2756 wrote to memory of 2180 2756 explorer.exe PID 2756 wrote to memory of 2180 2756 explorer.exe PID 2756 wrote to memory of 2180 2756 explorer.exe PID 2756 wrote to memory of 2180 2756 explorer.exe PID 2756 wrote to memory of 3172 2756 explorer.exe PID 2756 wrote to memory of 3172 2756 explorer.exe PID 2756 wrote to memory of 3172 2756 explorer.exe PID 2756 wrote to memory of 644 2756 explorer.exe PID 2756 wrote to memory of 644 2756 explorer.exe PID 2756 wrote to memory of 644 2756 explorer.exe PID 2756 wrote to memory of 644 2756 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\de207c74c9afa99f39122c8fb5e8b1e1.exe"C:\Users\Admin\AppData\Local\Temp\de207c74c9afa99f39122c8fb5e8b1e1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\de207c74c9afa99f39122c8fb5e8b1e1.exe"C:\Users\Admin\AppData\Local\Temp\de207c74c9afa99f39122c8fb5e8b1e1.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/644-143-0x00000000036F0000-0x00000000036F5000-memory.dmpFilesize
20KB
-
memory/644-144-0x00000000036E0000-0x00000000036E9000-memory.dmpFilesize
36KB
-
memory/644-142-0x0000000000000000-mapping.dmp
-
memory/1112-121-0x0000000000000000-mapping.dmp
-
memory/1112-122-0x0000000000510000-0x0000000000517000-memory.dmpFilesize
28KB
-
memory/1112-123-0x0000000000500000-0x000000000050C000-memory.dmpFilesize
48KB
-
memory/1252-134-0x0000000000130000-0x0000000000136000-memory.dmpFilesize
24KB
-
memory/1252-135-0x0000000000120000-0x000000000012C000-memory.dmpFilesize
48KB
-
memory/1252-133-0x0000000000000000-mapping.dmp
-
memory/1552-114-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1552-115-0x0000000000402E1A-mapping.dmp
-
memory/2180-138-0x0000000000AA0000-0x0000000000AA9000-memory.dmpFilesize
36KB
-
memory/2180-137-0x0000000000AB0000-0x0000000000AB4000-memory.dmpFilesize
16KB
-
memory/2180-136-0x0000000000000000-mapping.dmp
-
memory/2756-117-0x0000000000950000-0x0000000000966000-memory.dmpFilesize
88KB
-
memory/2980-130-0x0000000000000000-mapping.dmp
-
memory/2980-132-0x0000000000320000-0x0000000000329000-memory.dmpFilesize
36KB
-
memory/2980-131-0x0000000000330000-0x0000000000335000-memory.dmpFilesize
20KB
-
memory/3104-120-0x0000000000AC0000-0x0000000000B2B000-memory.dmpFilesize
428KB
-
memory/3104-118-0x0000000000000000-mapping.dmp
-
memory/3104-119-0x0000000000B30000-0x0000000000BA4000-memory.dmpFilesize
464KB
-
memory/3172-139-0x0000000000000000-mapping.dmp
-
memory/3172-140-0x00000000008B0000-0x00000000008B5000-memory.dmpFilesize
20KB
-
memory/3172-141-0x00000000008A0000-0x00000000008A9000-memory.dmpFilesize
36KB
-
memory/3508-126-0x0000000000150000-0x000000000015B000-memory.dmpFilesize
44KB
-
memory/3508-125-0x0000000000160000-0x0000000000167000-memory.dmpFilesize
28KB
-
memory/3508-124-0x0000000000000000-mapping.dmp
-
memory/3540-116-0x0000000002D90000-0x0000000002D9A000-memory.dmpFilesize
40KB
-
memory/3692-128-0x00000000003E0000-0x00000000003E9000-memory.dmpFilesize
36KB
-
memory/3692-129-0x00000000003D0000-0x00000000003DF000-memory.dmpFilesize
60KB
-
memory/3692-127-0x0000000000000000-mapping.dmp