Analysis
-
max time kernel
1803s -
max time network
1262s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
26-08-2021 21:12
Static task
static1
Behavioral task
behavioral1
Sample
06a029882deabf229f62728afe3baf4f.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
06a029882deabf229f62728afe3baf4f.exe
Resource
win11
Behavioral task
behavioral3
Sample
06a029882deabf229f62728afe3baf4f.exe
Resource
win10v20210408
General
-
Target
06a029882deabf229f62728afe3baf4f.exe
-
Size
319KB
-
MD5
06a029882deabf229f62728afe3baf4f
-
SHA1
33a5953fbcce8761af1e68df9c9f4ad153c4a536
-
SHA256
f24a559e79ba3121c7e0fed4ac995da056fe6a0dac71b2360f9e340b97117d05
-
SHA512
a81631eef6163f437e5bdf83156d26856653411dc6b9becc5580a83b9a4123faec5855d625beec15b1f71c3155624187f776f56b4f58e5f87e9f39bd8b61ba88
Malware Config
Extracted
smokeloader
2020
http://readinglistforjuly1.xyz/
http://readinglistforjuly2.xyz/
http://readinglistforjuly3.xyz/
http://readinglistforjuly4.xyz/
http://readinglistforjuly5.xyz/
http://readinglistforjuly6.xyz/
http://readinglistforjuly7.xyz/
http://readinglistforjuly8.xyz/
http://readinglistforjuly9.xyz/
http://readinglistforjuly10.xyz/
http://readinglistforjuly1.site/
http://readinglistforjuly2.site/
http://readinglistforjuly3.site/
http://readinglistforjuly4.site/
http://readinglistforjuly5.site/
http://readinglistforjuly6.site/
http://readinglistforjuly7.site/
http://readinglistforjuly8.site/
http://readinglistforjuly9.site/
http://readinglistforjuly10.site/
http://readinglistforjuly1.club/
http://readinglistforjuly2.club/
http://readinglistforjuly3.club/
http://readinglistforjuly4.club/
http://readinglistforjuly5.club/
http://readinglistforjuly6.club/
http://readinglistforjuly7.club/
http://readinglistforjuly8.club/
http://readinglistforjuly9.club/
http://readinglistforjuly10.club/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 6 IoCs
Processes:
wdcvistwdcvistwdcvistwdcvistwdcvistwdcvistpid process 1964 wdcvist 3504 wdcvist 816 wdcvist 4032 wdcvist 3988 wdcvist 696 wdcvist -
Deletes itself 1 IoCs
Processes:
pid process 3052 -
Suspicious use of SetThreadContext 4 IoCs
Processes:
06a029882deabf229f62728afe3baf4f.exewdcvistwdcvistwdcvistdescription pid process target process PID 636 set thread context of 2500 636 06a029882deabf229f62728afe3baf4f.exe 06a029882deabf229f62728afe3baf4f.exe PID 1964 set thread context of 3504 1964 wdcvist wdcvist PID 816 set thread context of 4032 816 wdcvist wdcvist PID 3988 set thread context of 696 3988 wdcvist wdcvist -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
wdcvistwdcvistwdcvist06a029882deabf229f62728afe3baf4f.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI wdcvist Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI wdcvist Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI wdcvist Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI wdcvist Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI wdcvist Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI wdcvist Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI wdcvist Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI wdcvist Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI wdcvist Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 06a029882deabf229f62728afe3baf4f.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 06a029882deabf229f62728afe3baf4f.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 06a029882deabf229f62728afe3baf4f.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
06a029882deabf229f62728afe3baf4f.exepid process 2500 06a029882deabf229f62728afe3baf4f.exe 2500 06a029882deabf229f62728afe3baf4f.exe 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 3052 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3052 -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
06a029882deabf229f62728afe3baf4f.exewdcvistwdcvistpid process 2500 06a029882deabf229f62728afe3baf4f.exe 3504 wdcvist 696 wdcvist -
Suspicious use of AdjustPrivilegeToken 18 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 3052 Token: SeCreatePagefilePrivilege 3052 Token: SeShutdownPrivilege 3052 Token: SeCreatePagefilePrivilege 3052 Token: SeShutdownPrivilege 3052 Token: SeCreatePagefilePrivilege 3052 Token: SeShutdownPrivilege 3052 Token: SeCreatePagefilePrivilege 3052 Token: SeShutdownPrivilege 3052 Token: SeCreatePagefilePrivilege 3052 Token: SeShutdownPrivilege 3052 Token: SeCreatePagefilePrivilege 3052 Token: SeShutdownPrivilege 3052 Token: SeCreatePagefilePrivilege 3052 Token: SeShutdownPrivilege 3052 Token: SeCreatePagefilePrivilege 3052 Token: SeShutdownPrivilege 3052 Token: SeCreatePagefilePrivilege 3052 -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
pid process 3052 -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
06a029882deabf229f62728afe3baf4f.exewdcvistwdcvistwdcvistdescription pid process target process PID 636 wrote to memory of 2500 636 06a029882deabf229f62728afe3baf4f.exe 06a029882deabf229f62728afe3baf4f.exe PID 636 wrote to memory of 2500 636 06a029882deabf229f62728afe3baf4f.exe 06a029882deabf229f62728afe3baf4f.exe PID 636 wrote to memory of 2500 636 06a029882deabf229f62728afe3baf4f.exe 06a029882deabf229f62728afe3baf4f.exe PID 636 wrote to memory of 2500 636 06a029882deabf229f62728afe3baf4f.exe 06a029882deabf229f62728afe3baf4f.exe PID 636 wrote to memory of 2500 636 06a029882deabf229f62728afe3baf4f.exe 06a029882deabf229f62728afe3baf4f.exe PID 636 wrote to memory of 2500 636 06a029882deabf229f62728afe3baf4f.exe 06a029882deabf229f62728afe3baf4f.exe PID 1964 wrote to memory of 3504 1964 wdcvist wdcvist PID 1964 wrote to memory of 3504 1964 wdcvist wdcvist PID 1964 wrote to memory of 3504 1964 wdcvist wdcvist PID 1964 wrote to memory of 3504 1964 wdcvist wdcvist PID 1964 wrote to memory of 3504 1964 wdcvist wdcvist PID 1964 wrote to memory of 3504 1964 wdcvist wdcvist PID 816 wrote to memory of 4032 816 wdcvist wdcvist PID 816 wrote to memory of 4032 816 wdcvist wdcvist PID 816 wrote to memory of 4032 816 wdcvist wdcvist PID 816 wrote to memory of 4032 816 wdcvist wdcvist PID 816 wrote to memory of 4032 816 wdcvist wdcvist PID 816 wrote to memory of 4032 816 wdcvist wdcvist PID 3988 wrote to memory of 696 3988 wdcvist wdcvist PID 3988 wrote to memory of 696 3988 wdcvist wdcvist PID 3988 wrote to memory of 696 3988 wdcvist wdcvist PID 3988 wrote to memory of 696 3988 wdcvist wdcvist PID 3988 wrote to memory of 696 3988 wdcvist wdcvist PID 3988 wrote to memory of 696 3988 wdcvist wdcvist
Processes
-
C:\Users\Admin\AppData\Local\Temp\06a029882deabf229f62728afe3baf4f.exe"C:\Users\Admin\AppData\Local\Temp\06a029882deabf229f62728afe3baf4f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\06a029882deabf229f62728afe3baf4f.exe"C:\Users\Admin\AppData\Local\Temp\06a029882deabf229f62728afe3baf4f.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\wdcvistC:\Users\Admin\AppData\Roaming\wdcvist1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\wdcvistC:\Users\Admin\AppData\Roaming\wdcvist2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\wdcvistC:\Users\Admin\AppData\Roaming\wdcvist1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\wdcvistC:\Users\Admin\AppData\Roaming\wdcvist2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Roaming\wdcvistC:\Users\Admin\AppData\Roaming\wdcvist1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\wdcvistC:\Users\Admin\AppData\Roaming\wdcvist2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\wdcvistMD5
06a029882deabf229f62728afe3baf4f
SHA133a5953fbcce8761af1e68df9c9f4ad153c4a536
SHA256f24a559e79ba3121c7e0fed4ac995da056fe6a0dac71b2360f9e340b97117d05
SHA512a81631eef6163f437e5bdf83156d26856653411dc6b9becc5580a83b9a4123faec5855d625beec15b1f71c3155624187f776f56b4f58e5f87e9f39bd8b61ba88
-
C:\Users\Admin\AppData\Roaming\wdcvistMD5
06a029882deabf229f62728afe3baf4f
SHA133a5953fbcce8761af1e68df9c9f4ad153c4a536
SHA256f24a559e79ba3121c7e0fed4ac995da056fe6a0dac71b2360f9e340b97117d05
SHA512a81631eef6163f437e5bdf83156d26856653411dc6b9becc5580a83b9a4123faec5855d625beec15b1f71c3155624187f776f56b4f58e5f87e9f39bd8b61ba88
-
C:\Users\Admin\AppData\Roaming\wdcvistMD5
06a029882deabf229f62728afe3baf4f
SHA133a5953fbcce8761af1e68df9c9f4ad153c4a536
SHA256f24a559e79ba3121c7e0fed4ac995da056fe6a0dac71b2360f9e340b97117d05
SHA512a81631eef6163f437e5bdf83156d26856653411dc6b9becc5580a83b9a4123faec5855d625beec15b1f71c3155624187f776f56b4f58e5f87e9f39bd8b61ba88
-
C:\Users\Admin\AppData\Roaming\wdcvistMD5
06a029882deabf229f62728afe3baf4f
SHA133a5953fbcce8761af1e68df9c9f4ad153c4a536
SHA256f24a559e79ba3121c7e0fed4ac995da056fe6a0dac71b2360f9e340b97117d05
SHA512a81631eef6163f437e5bdf83156d26856653411dc6b9becc5580a83b9a4123faec5855d625beec15b1f71c3155624187f776f56b4f58e5f87e9f39bd8b61ba88
-
C:\Users\Admin\AppData\Roaming\wdcvistMD5
06a029882deabf229f62728afe3baf4f
SHA133a5953fbcce8761af1e68df9c9f4ad153c4a536
SHA256f24a559e79ba3121c7e0fed4ac995da056fe6a0dac71b2360f9e340b97117d05
SHA512a81631eef6163f437e5bdf83156d26856653411dc6b9becc5580a83b9a4123faec5855d625beec15b1f71c3155624187f776f56b4f58e5f87e9f39bd8b61ba88
-
C:\Users\Admin\AppData\Roaming\wdcvistMD5
06a029882deabf229f62728afe3baf4f
SHA133a5953fbcce8761af1e68df9c9f4ad153c4a536
SHA256f24a559e79ba3121c7e0fed4ac995da056fe6a0dac71b2360f9e340b97117d05
SHA512a81631eef6163f437e5bdf83156d26856653411dc6b9becc5580a83b9a4123faec5855d625beec15b1f71c3155624187f776f56b4f58e5f87e9f39bd8b61ba88
-
C:\Users\Admin\AppData\Roaming\wdcvistMD5
06a029882deabf229f62728afe3baf4f
SHA133a5953fbcce8761af1e68df9c9f4ad153c4a536
SHA256f24a559e79ba3121c7e0fed4ac995da056fe6a0dac71b2360f9e340b97117d05
SHA512a81631eef6163f437e5bdf83156d26856653411dc6b9becc5580a83b9a4123faec5855d625beec15b1f71c3155624187f776f56b4f58e5f87e9f39bd8b61ba88
-
memory/636-114-0x0000000000030000-0x000000000003A000-memory.dmpFilesize
40KB
-
memory/696-130-0x0000000000402E1A-mapping.dmp
-
memory/2500-116-0x0000000000402E1A-mapping.dmp
-
memory/2500-115-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3052-117-0x0000000000720000-0x0000000000736000-memory.dmpFilesize
88KB
-
memory/3052-123-0x0000000000740000-0x0000000000756000-memory.dmpFilesize
88KB
-
memory/3052-132-0x00000000024D0000-0x00000000024E6000-memory.dmpFilesize
88KB
-
memory/3504-121-0x0000000000402E1A-mapping.dmp
-
memory/4032-126-0x0000000000402E1A-mapping.dmp