Analysis
- max time kernel
1800s - max time network
1551s - platform
windows7_x64 - resource
win7v20210408 - submitted
25/08/2021, 11:26
Static task
static1
Behavioral task
behavioral1
Sample
40c05a8ef279605719d194d37cf70a4a.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
40c05a8ef279605719d194d37cf70a4a.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target 40c05a8ef279605719d194d37cf70a4a.exe
- Size 142KB
- Sample210825-abfycnfjps
- SHA256 4d2041a2a0df754a74123b251358abd1f981985d32103138943ee2974cbb6f1d
- MD5 40c05a8ef279605719d194d37cf70a4a
- SHA1 5a295bfcb661642c5985135173450fafa416d43b
- SHA512 b8d99f82a2e34164d6b08385f8b8f93888682500ea800885b55ac54565b32f4f1cf09420d38ed2d46970a129a442ec8b043c54c891f107f839026dde4acfa0fc
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://readinglistforaugust1.xyz/
-
http://readinglistforaugust2.xyz/
-
http://readinglistforaugust3.xyz/
-
http://readinglistforaugust4.xyz/
-
http://readinglistforaugust5.xyz/
-
http://readinglistforaugust6.xyz/
-
http://readinglistforaugust7.xyz/
-
http://readinglistforaugust8.xyz/
-
http://readinglistforaugust9.xyz/
-
http://readinglistforaugust10.xyz/
-
http://readinglistforaugust1.site/
-
http://readinglistforaugust2.site/
-
http://readinglistforaugust3.site/
-
http://readinglistforaugust4.site/
-
http://readinglistforaugust5.site/
-
http://readinglistforaugust6.site/
-
http://readinglistforaugust7.site/
-
http://readinglistforaugust8.site/
-
http://readinglistforaugust9.site/
-
http://readinglistforaugust10.site/
-
http://readinglistforaugust1.club/
-
http://readinglistforaugust2.club/
-
http://readinglistforaugust3.club/
-
http://readinglistforaugust4.club/
-
http://readinglistforaugust5.club/
-
http://readinglistforaugust6.club/
-
http://readinglistforaugust7.club/
-
http://readinglistforaugust8.club/
-
http://readinglistforaugust9.club/
-
http://readinglistforaugust10.club/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Executes dropped EXE 6 IoCs
pid Process 2016 ewevfrb 1304 ewevfrb 844 ewevfrb 1812 ewevfrb 1388 ewevfrb 1592 ewevfrb - Deletes itself 1 IoCs
pid Process 1196 Process not Found - Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1992 set thread context of 1632 1992 40c05a8ef279605719d194d37cf70a4a.exe 29 PID 2016 set thread context of 1304 2016 ewevfrb 32 PID 844 set thread context of 1812 844 ewevfrb 36 PID 1388 set thread context of 1592 1388 ewevfrb 39 - Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ewevfrb Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ewevfrb Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ewevfrb Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 40c05a8ef279605719d194d37cf70a4a.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 40c05a8ef279605719d194d37cf70a4a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ewevfrb Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ewevfrb Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ewevfrb Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 40c05a8ef279605719d194d37cf70a4a.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ewevfrb Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ewevfrb Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ewevfrb - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1632 40c05a8ef279605719d194d37cf70a4a.exe 1632 40c05a8ef279605719d194d37cf70a4a.exe 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1196 Process not Found - Suspicious behavior: MapViewOfSection 4 IoCs
pid Process 1632 40c05a8ef279605719d194d37cf70a4a.exe 1304 ewevfrb 1812 ewevfrb 1592 ewevfrb - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeShutdownPrivilege 1196 Process not Found Token: SeShutdownPrivilege 1196 Process not Found Token: SeShutdownPrivilege 1196 Process not Found Token: SeShutdownPrivilege 1196 Process not Found Token: SeShutdownPrivilege 1196 Process not Found Token: SeShutdownPrivilege 1196 Process not Found Token: SeShutdownPrivilege 1196 Process not Found - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found - Suspicious use of SendNotifyMessage 7 IoCs
pid Process 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found - Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 1992 wrote to memory of 1632 1992 40c05a8ef279605719d194d37cf70a4a.exe 29 PID 1992 wrote to memory of 1632 1992 40c05a8ef279605719d194d37cf70a4a.exe 29 PID 1992 wrote to memory of 1632 1992 40c05a8ef279605719d194d37cf70a4a.exe 29 PID 1992 wrote to memory of 1632 1992 40c05a8ef279605719d194d37cf70a4a.exe 29 PID 1992 wrote to memory of 1632 1992 40c05a8ef279605719d194d37cf70a4a.exe 29 PID 1992 wrote to memory of 1632 1992 40c05a8ef279605719d194d37cf70a4a.exe 29 PID 1992 wrote to memory of 1632 1992 40c05a8ef279605719d194d37cf70a4a.exe 29 PID 792 wrote to memory of 2016 792 taskeng.exe 31 PID 792 wrote to memory of 2016 792 taskeng.exe 31 PID 792 wrote to memory of 2016 792 taskeng.exe 31 PID 792 wrote to memory of 2016 792 taskeng.exe 31 PID 2016 wrote to memory of 1304 2016 ewevfrb 32 PID 2016 wrote to memory of 1304 2016 ewevfrb 32 PID 2016 wrote to memory of 1304 2016 ewevfrb 32 PID 2016 wrote to memory of 1304 2016 ewevfrb 32 PID 2016 wrote to memory of 1304 2016 ewevfrb 32 PID 2016 wrote to memory of 1304 2016 ewevfrb 32 PID 2016 wrote to memory of 1304 2016 ewevfrb 32 PID 284 wrote to memory of 844 284 taskeng.exe 35 PID 284 wrote to memory of 844 284 taskeng.exe 35 PID 284 wrote to memory of 844 284 taskeng.exe 35 PID 284 wrote to memory of 844 284 taskeng.exe 35 PID 844 wrote to memory of 1812 844 ewevfrb 36 PID 844 wrote to memory of 1812 844 ewevfrb 36 PID 844 wrote to memory of 1812 844 ewevfrb 36 PID 844 wrote to memory of 1812 844 ewevfrb 36 PID 844 wrote to memory of 1812 844 ewevfrb 36 PID 844 wrote to memory of 1812 844 ewevfrb 36 PID 844 wrote to memory of 1812 844 ewevfrb 36 PID 956 wrote to memory of 1388 956 taskeng.exe 38 PID 956 wrote to memory of 1388 956 taskeng.exe 38 PID 956 wrote to memory of 1388 956 taskeng.exe 38 PID 956 wrote to memory of 1388 956 taskeng.exe 38 PID 1388 wrote to memory of 1592 1388 ewevfrb 39 PID 1388 wrote to memory of 1592 1388 ewevfrb 39 PID 1388 wrote to memory of 1592 1388 ewevfrb 39 PID 1388 wrote to memory of 1592 1388 ewevfrb 39 PID 1388 wrote to memory of 1592 1388 ewevfrb 39 PID 1388 wrote to memory of 1592 1388 ewevfrb 39 PID 1388 wrote to memory of 1592 1388 ewevfrb 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\40c05a8ef279605719d194d37cf70a4a.exe"C:\Users\Admin\AppData\Local\Temp\40c05a8ef279605719d194d37cf70a4a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\40c05a8ef279605719d194d37cf70a4a.exe"C:\Users\Admin\AppData\Local\Temp\40c05a8ef279605719d194d37cf70a4a.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1632
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {B79C8475-9DFA-4A74-9D54-C36F981B2ED0} S-1-5-21-2455352368-1077083310-2879168483-1000:QWOCTUPM\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Users\Admin\AppData\Roaming\ewevfrbC:\Users\Admin\AppData\Roaming\ewevfrb2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Roaming\ewevfrbC:\Users\Admin\AppData\Roaming\ewevfrb3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1304
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {249B16F8-E3D2-46A7-9843-E3A027AB04DB} S-1-5-21-2455352368-1077083310-2879168483-1000:QWOCTUPM\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:284 -
C:\Users\Admin\AppData\Roaming\ewevfrbC:\Users\Admin\AppData\Roaming\ewevfrb2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Users\Admin\AppData\Roaming\ewevfrbC:\Users\Admin\AppData\Roaming\ewevfrb3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1812
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {4888FDF8-D9DA-4344-ACA4-1C155F57405D} S-1-5-21-2455352368-1077083310-2879168483-1000:QWOCTUPM\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Roaming\ewevfrbC:\Users\Admin\AppData\Roaming\ewevfrb2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Roaming\ewevfrbC:\Users\Admin\AppData\Roaming\ewevfrb3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1592
-
-