Analysis
-
max time kernel
1802s -
max time network
1529s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
26-08-2021 21:12
Static task
static1
Behavioral task
behavioral1
Sample
06a029882deabf229f62728afe3baf4f.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
06a029882deabf229f62728afe3baf4f.exe
Resource
win11
Behavioral task
behavioral3
Sample
06a029882deabf229f62728afe3baf4f.exe
Resource
win10v20210408
General
-
Target
06a029882deabf229f62728afe3baf4f.exe
-
Size
319KB
-
MD5
06a029882deabf229f62728afe3baf4f
-
SHA1
33a5953fbcce8761af1e68df9c9f4ad153c4a536
-
SHA256
f24a559e79ba3121c7e0fed4ac995da056fe6a0dac71b2360f9e340b97117d05
-
SHA512
a81631eef6163f437e5bdf83156d26856653411dc6b9becc5580a83b9a4123faec5855d625beec15b1f71c3155624187f776f56b4f58e5f87e9f39bd8b61ba88
Malware Config
Extracted
smokeloader
2020
http://readinglistforjuly1.xyz/
http://readinglistforjuly2.xyz/
http://readinglistforjuly3.xyz/
http://readinglistforjuly4.xyz/
http://readinglistforjuly5.xyz/
http://readinglistforjuly6.xyz/
http://readinglistforjuly7.xyz/
http://readinglistforjuly8.xyz/
http://readinglistforjuly9.xyz/
http://readinglistforjuly10.xyz/
http://readinglistforjuly1.site/
http://readinglistforjuly2.site/
http://readinglistforjuly3.site/
http://readinglistforjuly4.site/
http://readinglistforjuly5.site/
http://readinglistforjuly6.site/
http://readinglistforjuly7.site/
http://readinglistforjuly8.site/
http://readinglistforjuly9.site/
http://readinglistforjuly10.site/
http://readinglistforjuly1.club/
http://readinglistforjuly2.club/
http://readinglistforjuly3.club/
http://readinglistforjuly4.club/
http://readinglistforjuly5.club/
http://readinglistforjuly6.club/
http://readinglistforjuly7.club/
http://readinglistforjuly8.club/
http://readinglistforjuly9.club/
http://readinglistforjuly10.club/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 6 IoCs
Processes:
igsbjfwigsbjfwigsbjfwigsbjfwigsbjfwigsbjfwpid process 1892 igsbjfw 432 igsbjfw 1364 igsbjfw 1220 igsbjfw 1476 igsbjfw 572 igsbjfw -
Deletes itself 1 IoCs
Processes:
pid process 1256 -
Suspicious use of SetThreadContext 4 IoCs
Processes:
06a029882deabf229f62728afe3baf4f.exeigsbjfwigsbjfwigsbjfwdescription pid process target process PID 2028 set thread context of 1884 2028 06a029882deabf229f62728afe3baf4f.exe 06a029882deabf229f62728afe3baf4f.exe PID 1892 set thread context of 432 1892 igsbjfw igsbjfw PID 1364 set thread context of 1220 1364 igsbjfw igsbjfw PID 1476 set thread context of 572 1476 igsbjfw igsbjfw -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
igsbjfwigsbjfwigsbjfw06a029882deabf229f62728afe3baf4f.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI igsbjfw Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI igsbjfw Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI igsbjfw Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI igsbjfw Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI igsbjfw Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 06a029882deabf229f62728afe3baf4f.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 06a029882deabf229f62728afe3baf4f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI igsbjfw Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI igsbjfw Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 06a029882deabf229f62728afe3baf4f.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI igsbjfw Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI igsbjfw -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
06a029882deabf229f62728afe3baf4f.exepid process 1884 06a029882deabf229f62728afe3baf4f.exe 1884 06a029882deabf229f62728afe3baf4f.exe 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 1256 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1256 -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
06a029882deabf229f62728afe3baf4f.exeigsbjfwigsbjfwigsbjfwpid process 1884 06a029882deabf229f62728afe3baf4f.exe 432 igsbjfw 1220 igsbjfw 572 igsbjfw -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 1256 Token: SeShutdownPrivilege 1256 Token: SeShutdownPrivilege 1256 Token: SeShutdownPrivilege 1256 Token: SeShutdownPrivilege 1256 -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
pid process 1256 1256 1256 1256 1256 1256 -
Suspicious use of SendNotifyMessage 6 IoCs
Processes:
pid process 1256 1256 1256 1256 1256 1256 -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
06a029882deabf229f62728afe3baf4f.exetaskeng.exeigsbjfwtaskeng.exeigsbjfwtaskeng.exeigsbjfwdescription pid process target process PID 2028 wrote to memory of 1884 2028 06a029882deabf229f62728afe3baf4f.exe 06a029882deabf229f62728afe3baf4f.exe PID 2028 wrote to memory of 1884 2028 06a029882deabf229f62728afe3baf4f.exe 06a029882deabf229f62728afe3baf4f.exe PID 2028 wrote to memory of 1884 2028 06a029882deabf229f62728afe3baf4f.exe 06a029882deabf229f62728afe3baf4f.exe PID 2028 wrote to memory of 1884 2028 06a029882deabf229f62728afe3baf4f.exe 06a029882deabf229f62728afe3baf4f.exe PID 2028 wrote to memory of 1884 2028 06a029882deabf229f62728afe3baf4f.exe 06a029882deabf229f62728afe3baf4f.exe PID 2028 wrote to memory of 1884 2028 06a029882deabf229f62728afe3baf4f.exe 06a029882deabf229f62728afe3baf4f.exe PID 2028 wrote to memory of 1884 2028 06a029882deabf229f62728afe3baf4f.exe 06a029882deabf229f62728afe3baf4f.exe PID 1064 wrote to memory of 1892 1064 taskeng.exe igsbjfw PID 1064 wrote to memory of 1892 1064 taskeng.exe igsbjfw PID 1064 wrote to memory of 1892 1064 taskeng.exe igsbjfw PID 1064 wrote to memory of 1892 1064 taskeng.exe igsbjfw PID 1892 wrote to memory of 432 1892 igsbjfw igsbjfw PID 1892 wrote to memory of 432 1892 igsbjfw igsbjfw PID 1892 wrote to memory of 432 1892 igsbjfw igsbjfw PID 1892 wrote to memory of 432 1892 igsbjfw igsbjfw PID 1892 wrote to memory of 432 1892 igsbjfw igsbjfw PID 1892 wrote to memory of 432 1892 igsbjfw igsbjfw PID 1892 wrote to memory of 432 1892 igsbjfw igsbjfw PID 1836 wrote to memory of 1364 1836 taskeng.exe igsbjfw PID 1836 wrote to memory of 1364 1836 taskeng.exe igsbjfw PID 1836 wrote to memory of 1364 1836 taskeng.exe igsbjfw PID 1836 wrote to memory of 1364 1836 taskeng.exe igsbjfw PID 1364 wrote to memory of 1220 1364 igsbjfw igsbjfw PID 1364 wrote to memory of 1220 1364 igsbjfw igsbjfw PID 1364 wrote to memory of 1220 1364 igsbjfw igsbjfw PID 1364 wrote to memory of 1220 1364 igsbjfw igsbjfw PID 1364 wrote to memory of 1220 1364 igsbjfw igsbjfw PID 1364 wrote to memory of 1220 1364 igsbjfw igsbjfw PID 1364 wrote to memory of 1220 1364 igsbjfw igsbjfw PID 1960 wrote to memory of 1476 1960 taskeng.exe igsbjfw PID 1960 wrote to memory of 1476 1960 taskeng.exe igsbjfw PID 1960 wrote to memory of 1476 1960 taskeng.exe igsbjfw PID 1960 wrote to memory of 1476 1960 taskeng.exe igsbjfw PID 1476 wrote to memory of 572 1476 igsbjfw igsbjfw PID 1476 wrote to memory of 572 1476 igsbjfw igsbjfw PID 1476 wrote to memory of 572 1476 igsbjfw igsbjfw PID 1476 wrote to memory of 572 1476 igsbjfw igsbjfw PID 1476 wrote to memory of 572 1476 igsbjfw igsbjfw PID 1476 wrote to memory of 572 1476 igsbjfw igsbjfw PID 1476 wrote to memory of 572 1476 igsbjfw igsbjfw
Processes
-
C:\Users\Admin\AppData\Local\Temp\06a029882deabf229f62728afe3baf4f.exe"C:\Users\Admin\AppData\Local\Temp\06a029882deabf229f62728afe3baf4f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\06a029882deabf229f62728afe3baf4f.exe"C:\Users\Admin\AppData\Local\Temp\06a029882deabf229f62728afe3baf4f.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\taskeng.exetaskeng.exe {23F95815-4725-43B7-B569-6A4E0501AD15} S-1-5-21-2513283230-931923277-594887482-1000:MRBKYMNO\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\igsbjfwC:\Users\Admin\AppData\Roaming\igsbjfw2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\igsbjfwC:\Users\Admin\AppData\Roaming\igsbjfw3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\taskeng.exetaskeng.exe {0C5E7FB4-C9BA-40C4-859C-796B96D8B13D} S-1-5-21-2513283230-931923277-594887482-1000:MRBKYMNO\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\igsbjfwC:\Users\Admin\AppData\Roaming\igsbjfw2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\igsbjfwC:\Users\Admin\AppData\Roaming\igsbjfw3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\taskeng.exetaskeng.exe {1D9E910F-31B5-4A9D-8A99-6F5899CA82AF} S-1-5-21-2513283230-931923277-594887482-1000:MRBKYMNO\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\igsbjfwC:\Users\Admin\AppData\Roaming\igsbjfw2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\igsbjfwC:\Users\Admin\AppData\Roaming\igsbjfw3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\igsbjfwMD5
06a029882deabf229f62728afe3baf4f
SHA133a5953fbcce8761af1e68df9c9f4ad153c4a536
SHA256f24a559e79ba3121c7e0fed4ac995da056fe6a0dac71b2360f9e340b97117d05
SHA512a81631eef6163f437e5bdf83156d26856653411dc6b9becc5580a83b9a4123faec5855d625beec15b1f71c3155624187f776f56b4f58e5f87e9f39bd8b61ba88
-
C:\Users\Admin\AppData\Roaming\igsbjfwMD5
06a029882deabf229f62728afe3baf4f
SHA133a5953fbcce8761af1e68df9c9f4ad153c4a536
SHA256f24a559e79ba3121c7e0fed4ac995da056fe6a0dac71b2360f9e340b97117d05
SHA512a81631eef6163f437e5bdf83156d26856653411dc6b9becc5580a83b9a4123faec5855d625beec15b1f71c3155624187f776f56b4f58e5f87e9f39bd8b61ba88
-
C:\Users\Admin\AppData\Roaming\igsbjfwMD5
06a029882deabf229f62728afe3baf4f
SHA133a5953fbcce8761af1e68df9c9f4ad153c4a536
SHA256f24a559e79ba3121c7e0fed4ac995da056fe6a0dac71b2360f9e340b97117d05
SHA512a81631eef6163f437e5bdf83156d26856653411dc6b9becc5580a83b9a4123faec5855d625beec15b1f71c3155624187f776f56b4f58e5f87e9f39bd8b61ba88
-
C:\Users\Admin\AppData\Roaming\igsbjfwMD5
06a029882deabf229f62728afe3baf4f
SHA133a5953fbcce8761af1e68df9c9f4ad153c4a536
SHA256f24a559e79ba3121c7e0fed4ac995da056fe6a0dac71b2360f9e340b97117d05
SHA512a81631eef6163f437e5bdf83156d26856653411dc6b9becc5580a83b9a4123faec5855d625beec15b1f71c3155624187f776f56b4f58e5f87e9f39bd8b61ba88
-
C:\Users\Admin\AppData\Roaming\igsbjfwMD5
06a029882deabf229f62728afe3baf4f
SHA133a5953fbcce8761af1e68df9c9f4ad153c4a536
SHA256f24a559e79ba3121c7e0fed4ac995da056fe6a0dac71b2360f9e340b97117d05
SHA512a81631eef6163f437e5bdf83156d26856653411dc6b9becc5580a83b9a4123faec5855d625beec15b1f71c3155624187f776f56b4f58e5f87e9f39bd8b61ba88
-
C:\Users\Admin\AppData\Roaming\igsbjfwMD5
06a029882deabf229f62728afe3baf4f
SHA133a5953fbcce8761af1e68df9c9f4ad153c4a536
SHA256f24a559e79ba3121c7e0fed4ac995da056fe6a0dac71b2360f9e340b97117d05
SHA512a81631eef6163f437e5bdf83156d26856653411dc6b9becc5580a83b9a4123faec5855d625beec15b1f71c3155624187f776f56b4f58e5f87e9f39bd8b61ba88
-
C:\Users\Admin\AppData\Roaming\igsbjfwMD5
06a029882deabf229f62728afe3baf4f
SHA133a5953fbcce8761af1e68df9c9f4ad153c4a536
SHA256f24a559e79ba3121c7e0fed4ac995da056fe6a0dac71b2360f9e340b97117d05
SHA512a81631eef6163f437e5bdf83156d26856653411dc6b9becc5580a83b9a4123faec5855d625beec15b1f71c3155624187f776f56b4f58e5f87e9f39bd8b61ba88
-
memory/432-69-0x0000000000402E1A-mapping.dmp
-
memory/572-83-0x0000000000402E1A-mapping.dmp
-
memory/1220-76-0x0000000000402E1A-mapping.dmp
-
memory/1256-72-0x0000000002AA0000-0x0000000002AB6000-memory.dmpFilesize
88KB
-
memory/1256-64-0x0000000002210000-0x0000000002226000-memory.dmpFilesize
88KB
-
memory/1256-79-0x00000000038A0000-0x00000000038B6000-memory.dmpFilesize
88KB
-
memory/1256-86-0x0000000002B60000-0x0000000002B76000-memory.dmpFilesize
88KB
-
memory/1364-73-0x0000000000000000-mapping.dmp
-
memory/1476-80-0x0000000000000000-mapping.dmp
-
memory/1884-60-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1884-62-0x00000000765F1000-0x00000000765F3000-memory.dmpFilesize
8KB
-
memory/1884-61-0x0000000000402E1A-mapping.dmp
-
memory/1892-66-0x0000000000000000-mapping.dmp
-
memory/2028-63-0x0000000000020000-0x000000000002A000-memory.dmpFilesize
40KB