Analysis
- max time kernel
153s - max time network
115s - platform
windows10_x64 - resource
win10v20210408 - submitted
19/08/2021, 13:10
Static task
static1
Behavioral task
behavioral1
Sample
efb545b4ac87e8ab201f04b7a09817b8.exe
Resource
win7v20210410
windows7_x64
Behavioral task
behavioral2
Sample
efb545b4ac87e8ab201f04b7a09817b8.exe
Resource
win10v20210408
windows10_x64
General
- Target efb545b4ac87e8ab201f04b7a09817b8.exe
- Size 275KB
- Sample210819-3hwp3ctryx
- SHA256 608248c1ef7bab54f8a7aeffaf618187a6f20d3bc829a6c6de625e2a2a376f2b
- MD5 efb545b4ac87e8ab201f04b7a09817b8
- SHA1 b3db9e08cde7979537d7cd57d3c3a3edee791da3
- SHA512 5572e723c5372b1953b20b4efd5bbf58e12eaf02c82b3eac5464aadf89fa09d6d9c7ed093860bc1cba3386be031e49f52a9d0d84e6b944a3a85f05a1c09e8f0a
- MD5 SHA1 SHA512
Malware Config
Extracted
-
smokeloader
-
2020
-
http://readinglistforaugust1.xyz/
-
http://readinglistforaugust2.xyz/
-
http://readinglistforaugust3.xyz/
-
http://readinglistforaugust4.xyz/
-
http://readinglistforaugust5.xyz/
-
http://readinglistforaugust6.xyz/
-
http://readinglistforaugust7.xyz/
-
http://readinglistforaugust8.xyz/
-
http://readinglistforaugust9.xyz/
-
http://readinglistforaugust10.xyz/
-
http://readinglistforaugust1.site/
-
http://readinglistforaugust2.site/
-
http://readinglistforaugust3.site/
-
http://readinglistforaugust4.site/
-
http://readinglistforaugust5.site/
-
http://readinglistforaugust6.site/
-
http://readinglistforaugust7.site/
-
http://readinglistforaugust8.site/
-
http://readinglistforaugust9.site/
-
http://readinglistforaugust10.site/
-
http://readinglistforaugust1.club/
-
http://readinglistforaugust2.club/
-
http://readinglistforaugust3.club/
-
http://readinglistforaugust4.club/
-
http://readinglistforaugust5.club/
-
http://readinglistforaugust6.club/
-
http://readinglistforaugust7.club/
-
http://readinglistforaugust8.club/
-
http://readinglistforaugust9.club/
-
http://readinglistforaugust10.club/
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Deletes itself 1 IoCs
pid Process 2900 Process not Found - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4800 set thread context of 4264 4800 efb545b4ac87e8ab201f04b7a09817b8.exe 75 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI efb545b4ac87e8ab201f04b7a09817b8.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI efb545b4ac87e8ab201f04b7a09817b8.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI efb545b4ac87e8ab201f04b7a09817b8.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4264 efb545b4ac87e8ab201f04b7a09817b8.exe 4264 efb545b4ac87e8ab201f04b7a09817b8.exe 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2900 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4264 efb545b4ac87e8ab201f04b7a09817b8.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2900 Process not Found - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4800 wrote to memory of 4264 4800 efb545b4ac87e8ab201f04b7a09817b8.exe 75 PID 4800 wrote to memory of 4264 4800 efb545b4ac87e8ab201f04b7a09817b8.exe 75 PID 4800 wrote to memory of 4264 4800 efb545b4ac87e8ab201f04b7a09817b8.exe 75 PID 4800 wrote to memory of 4264 4800 efb545b4ac87e8ab201f04b7a09817b8.exe 75 PID 4800 wrote to memory of 4264 4800 efb545b4ac87e8ab201f04b7a09817b8.exe 75 PID 4800 wrote to memory of 4264 4800 efb545b4ac87e8ab201f04b7a09817b8.exe 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\efb545b4ac87e8ab201f04b7a09817b8.exe"C:\Users\Admin\AppData\Local\Temp\efb545b4ac87e8ab201f04b7a09817b8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\efb545b4ac87e8ab201f04b7a09817b8.exe"C:\Users\Admin\AppData\Local\Temp\efb545b4ac87e8ab201f04b7a09817b8.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4264
-