Analysis
-
max time kernel
152s -
max time network
135s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
23-08-2021 00:14
Static task
static1
Behavioral task
behavioral1
Sample
ca12d3f00e654a8c51e15c6eaed8330721e48f398f877.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
ca12d3f00e654a8c51e15c6eaed8330721e48f398f877.exe
Resource
win10v20210408
General
-
Target
ca12d3f00e654a8c51e15c6eaed8330721e48f398f877.exe
-
Size
263KB
-
MD5
a5c61aea82c6c065e1c6c1ae083effd7
-
SHA1
a7f6f6976bf1acce0d2f4662100eaf019fd405eb
-
SHA256
ca12d3f00e654a8c51e15c6eaed8330721e48f398f877fc0ed68a983d3191a37
-
SHA512
6569b0e4f8c5a58bb16dd950de3ccef42fc18b7569d73c9e0042e2b66b2cf5c35154865509dfe959ddb61b4dc41e802cb076d21bf43994138fad5af405908cea
Malware Config
Extracted
smokeloader
2020
http://readinglistforaugust1.xyz/
http://readinglistforaugust2.xyz/
http://readinglistforaugust3.xyz/
http://readinglistforaugust4.xyz/
http://readinglistforaugust5.xyz/
http://readinglistforaugust6.xyz/
http://readinglistforaugust7.xyz/
http://readinglistforaugust8.xyz/
http://readinglistforaugust9.xyz/
http://readinglistforaugust10.xyz/
http://readinglistforaugust1.site/
http://readinglistforaugust2.site/
http://readinglistforaugust3.site/
http://readinglistforaugust4.site/
http://readinglistforaugust5.site/
http://readinglistforaugust6.site/
http://readinglistforaugust7.site/
http://readinglistforaugust8.site/
http://readinglistforaugust9.site/
http://readinglistforaugust10.site/
http://readinglistforaugust1.club/
http://readinglistforaugust2.club/
http://readinglistforaugust3.club/
http://readinglistforaugust4.club/
http://readinglistforaugust5.club/
http://readinglistforaugust6.club/
http://readinglistforaugust7.club/
http://readinglistforaugust8.club/
http://readinglistforaugust9.club/
http://readinglistforaugust10.club/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3092 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ca12d3f00e654a8c51e15c6eaed8330721e48f398f877.exedescription pid process target process PID 640 set thread context of 3596 640 ca12d3f00e654a8c51e15c6eaed8330721e48f398f877.exe ca12d3f00e654a8c51e15c6eaed8330721e48f398f877.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
ca12d3f00e654a8c51e15c6eaed8330721e48f398f877.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ca12d3f00e654a8c51e15c6eaed8330721e48f398f877.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ca12d3f00e654a8c51e15c6eaed8330721e48f398f877.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ca12d3f00e654a8c51e15c6eaed8330721e48f398f877.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ca12d3f00e654a8c51e15c6eaed8330721e48f398f877.exepid process 3596 ca12d3f00e654a8c51e15c6eaed8330721e48f398f877.exe 3596 ca12d3f00e654a8c51e15c6eaed8330721e48f398f877.exe 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3092 -
Suspicious behavior: MapViewOfSection 19 IoCs
Processes:
ca12d3f00e654a8c51e15c6eaed8330721e48f398f877.exepid process 3596 ca12d3f00e654a8c51e15c6eaed8330721e48f398f877.exe 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
pid process 3092 -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
ca12d3f00e654a8c51e15c6eaed8330721e48f398f877.exedescription pid process target process PID 640 wrote to memory of 3596 640 ca12d3f00e654a8c51e15c6eaed8330721e48f398f877.exe ca12d3f00e654a8c51e15c6eaed8330721e48f398f877.exe PID 640 wrote to memory of 3596 640 ca12d3f00e654a8c51e15c6eaed8330721e48f398f877.exe ca12d3f00e654a8c51e15c6eaed8330721e48f398f877.exe PID 640 wrote to memory of 3596 640 ca12d3f00e654a8c51e15c6eaed8330721e48f398f877.exe ca12d3f00e654a8c51e15c6eaed8330721e48f398f877.exe PID 640 wrote to memory of 3596 640 ca12d3f00e654a8c51e15c6eaed8330721e48f398f877.exe ca12d3f00e654a8c51e15c6eaed8330721e48f398f877.exe PID 640 wrote to memory of 3596 640 ca12d3f00e654a8c51e15c6eaed8330721e48f398f877.exe ca12d3f00e654a8c51e15c6eaed8330721e48f398f877.exe PID 640 wrote to memory of 3596 640 ca12d3f00e654a8c51e15c6eaed8330721e48f398f877.exe ca12d3f00e654a8c51e15c6eaed8330721e48f398f877.exe PID 3092 wrote to memory of 4020 3092 explorer.exe PID 3092 wrote to memory of 4020 3092 explorer.exe PID 3092 wrote to memory of 4020 3092 explorer.exe PID 3092 wrote to memory of 4020 3092 explorer.exe PID 3092 wrote to memory of 200 3092 explorer.exe PID 3092 wrote to memory of 200 3092 explorer.exe PID 3092 wrote to memory of 200 3092 explorer.exe PID 3092 wrote to memory of 1432 3092 explorer.exe PID 3092 wrote to memory of 1432 3092 explorer.exe PID 3092 wrote to memory of 1432 3092 explorer.exe PID 3092 wrote to memory of 1432 3092 explorer.exe PID 3092 wrote to memory of 572 3092 explorer.exe PID 3092 wrote to memory of 572 3092 explorer.exe PID 3092 wrote to memory of 572 3092 explorer.exe PID 3092 wrote to memory of 764 3092 explorer.exe PID 3092 wrote to memory of 764 3092 explorer.exe PID 3092 wrote to memory of 764 3092 explorer.exe PID 3092 wrote to memory of 764 3092 explorer.exe PID 3092 wrote to memory of 1272 3092 explorer.exe PID 3092 wrote to memory of 1272 3092 explorer.exe PID 3092 wrote to memory of 1272 3092 explorer.exe PID 3092 wrote to memory of 2176 3092 explorer.exe PID 3092 wrote to memory of 2176 3092 explorer.exe PID 3092 wrote to memory of 2176 3092 explorer.exe PID 3092 wrote to memory of 2176 3092 explorer.exe PID 3092 wrote to memory of 2200 3092 explorer.exe PID 3092 wrote to memory of 2200 3092 explorer.exe PID 3092 wrote to memory of 2200 3092 explorer.exe PID 3092 wrote to memory of 648 3092 explorer.exe PID 3092 wrote to memory of 648 3092 explorer.exe PID 3092 wrote to memory of 648 3092 explorer.exe PID 3092 wrote to memory of 648 3092 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca12d3f00e654a8c51e15c6eaed8330721e48f398f877.exe"C:\Users\Admin\AppData\Local\Temp\ca12d3f00e654a8c51e15c6eaed8330721e48f398f877.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ca12d3f00e654a8c51e15c6eaed8330721e48f398f877.exe"C:\Users\Admin\AppData\Local\Temp\ca12d3f00e654a8c51e15c6eaed8330721e48f398f877.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/200-121-0x0000000000000000-mapping.dmp
-
memory/200-123-0x0000000000FC0000-0x0000000000FCC000-memory.dmpFilesize
48KB
-
memory/200-122-0x0000000000FD0000-0x0000000000FD7000-memory.dmpFilesize
28KB
-
memory/572-129-0x0000000001090000-0x000000000109F000-memory.dmpFilesize
60KB
-
memory/572-127-0x0000000000000000-mapping.dmp
-
memory/572-128-0x00000000010A0000-0x00000000010A9000-memory.dmpFilesize
36KB
-
memory/640-116-0x00000000024A0000-0x00000000025EA000-memory.dmpFilesize
1.3MB
-
memory/648-143-0x0000000000520000-0x0000000000525000-memory.dmpFilesize
20KB
-
memory/648-144-0x0000000000510000-0x0000000000519000-memory.dmpFilesize
36KB
-
memory/648-142-0x0000000000000000-mapping.dmp
-
memory/764-130-0x0000000000000000-mapping.dmp
-
memory/764-132-0x0000000000E70000-0x0000000000E79000-memory.dmpFilesize
36KB
-
memory/764-131-0x0000000000E80000-0x0000000000E85000-memory.dmpFilesize
20KB
-
memory/1272-134-0x0000000000C10000-0x0000000000C16000-memory.dmpFilesize
24KB
-
memory/1272-135-0x0000000000C00000-0x0000000000C0C000-memory.dmpFilesize
48KB
-
memory/1272-133-0x0000000000000000-mapping.dmp
-
memory/1432-124-0x0000000000000000-mapping.dmp
-
memory/1432-125-0x0000000000A50000-0x0000000000A57000-memory.dmpFilesize
28KB
-
memory/1432-126-0x0000000000A40000-0x0000000000A4B000-memory.dmpFilesize
44KB
-
memory/2176-136-0x0000000000000000-mapping.dmp
-
memory/2176-137-0x0000000000EF0000-0x0000000000EF4000-memory.dmpFilesize
16KB
-
memory/2176-138-0x0000000000EE0000-0x0000000000EE9000-memory.dmpFilesize
36KB
-
memory/2200-141-0x0000000000940000-0x0000000000949000-memory.dmpFilesize
36KB
-
memory/2200-139-0x0000000000000000-mapping.dmp
-
memory/2200-140-0x0000000000950000-0x0000000000955000-memory.dmpFilesize
20KB
-
memory/3092-117-0x0000000000A60000-0x0000000000A76000-memory.dmpFilesize
88KB
-
memory/3596-115-0x0000000000402FAB-mapping.dmp
-
memory/3596-114-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4020-118-0x0000000000000000-mapping.dmp
-
memory/4020-119-0x0000000000E70000-0x0000000000EE4000-memory.dmpFilesize
464KB
-
memory/4020-120-0x0000000000E00000-0x0000000000E6B000-memory.dmpFilesize
428KB