Analysis
- max time kernel
150s - max time network
181s - platform
windows7_x64 - resource
win7v20210410 - submitted
16/08/2021, 09:08
Static task
static1
Behavioral task
behavioral1
Sample
405ddfb635c6b65486f8b2498c2c761a.exe
Resource
win7v20210410
windows7_x64
Behavioral task
behavioral2
Sample
405ddfb635c6b65486f8b2498c2c761a.exe
Resource
win10v20210408
windows10_x64
General
- Target 405ddfb635c6b65486f8b2498c2c761a.exe
- Size 180KB
- Sample210816-fle77rjc8e
- SHA256 ce2fe316faac707fdef9aed79c1eb348f74a538fb5617ceea0a003b964c146e4
- MD5 405ddfb635c6b65486f8b2498c2c761a
- SHA1 d1112cf98d262cf2bec94691dbc89e0713ab5413
- SHA512 1845aa8891a321d6ff0bfa8442386083955c17bb9499dc1949671f1a6a8cd1e3ca7f8b965e695cbef132b9e7c3e76852c18c7e0674e6b301d67f55eb1a73dd26
- MD5 SHA1 SHA512
Malware Config
Extracted
-
smokeloader
-
2020
-
http://readinglistforjuly1.xyz/
-
http://readinglistforjuly2.xyz/
-
http://readinglistforjuly3.xyz/
-
http://readinglistforjuly4.xyz/
-
http://readinglistforjuly5.xyz/
-
http://readinglistforjuly6.xyz/
-
http://readinglistforjuly7.xyz/
-
http://readinglistforjuly8.xyz/
-
http://readinglistforjuly9.xyz/
-
http://readinglistforjuly10.xyz/
-
http://readinglistforjuly1.site/
-
http://readinglistforjuly2.site/
-
http://readinglistforjuly3.site/
-
http://readinglistforjuly4.site/
-
http://readinglistforjuly5.site/
-
http://readinglistforjuly6.site/
-
http://readinglistforjuly7.site/
-
http://readinglistforjuly8.site/
-
http://readinglistforjuly9.site/
-
http://readinglistforjuly10.site/
-
http://readinglistforjuly1.club/
-
http://readinglistforjuly2.club/
-
http://readinglistforjuly3.club/
-
http://readinglistforjuly4.club/
-
http://readinglistforjuly5.club/
-
http://readinglistforjuly6.club/
-
http://readinglistforjuly7.club/
-
http://readinglistforjuly8.club/
-
http://readinglistforjuly9.club/
-
http://readinglistforjuly10.club/
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Deletes itself 1 IoCs
pid Process 1288 Process not Found - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1660 set thread context of 1196 1660 405ddfb635c6b65486f8b2498c2c761a.exe 25 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 405ddfb635c6b65486f8b2498c2c761a.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 405ddfb635c6b65486f8b2498c2c761a.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 405ddfb635c6b65486f8b2498c2c761a.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1196 405ddfb635c6b65486f8b2498c2c761a.exe 1196 405ddfb635c6b65486f8b2498c2c761a.exe 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1288 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1196 405ddfb635c6b65486f8b2498c2c761a.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1660 wrote to memory of 1196 1660 405ddfb635c6b65486f8b2498c2c761a.exe 25 PID 1660 wrote to memory of 1196 1660 405ddfb635c6b65486f8b2498c2c761a.exe 25 PID 1660 wrote to memory of 1196 1660 405ddfb635c6b65486f8b2498c2c761a.exe 25 PID 1660 wrote to memory of 1196 1660 405ddfb635c6b65486f8b2498c2c761a.exe 25 PID 1660 wrote to memory of 1196 1660 405ddfb635c6b65486f8b2498c2c761a.exe 25 PID 1660 wrote to memory of 1196 1660 405ddfb635c6b65486f8b2498c2c761a.exe 25 PID 1660 wrote to memory of 1196 1660 405ddfb635c6b65486f8b2498c2c761a.exe 25
Processes
-
C:\Users\Admin\AppData\Local\Temp\405ddfb635c6b65486f8b2498c2c761a.exe"C:\Users\Admin\AppData\Local\Temp\405ddfb635c6b65486f8b2498c2c761a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\405ddfb635c6b65486f8b2498c2c761a.exe"C:\Users\Admin\AppData\Local\Temp\405ddfb635c6b65486f8b2498c2c761a.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1196
-