Analysis
-
max time kernel
166s -
max time network
122s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
29/08/2021, 08:50
Static task
static1
Behavioral task
behavioral1
Sample
88d7e4d97668f06068ec238fabc59d82.exe
Resource
win7v20210408
buranraccoonsmokeloadertofseexmrigd02c5d65069fc7ce1993e7c52edf0c9c4c195c81fe582536ec580228180f270f7cb80a867860e010backdoordiscoveryevasionminerpersistenceransomwarespywarestealerthemidatrojan
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
88d7e4d97668f06068ec238fabc59d82.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
88d7e4d97668f06068ec238fabc59d82.exe
-
Size
142KB
-
MD5
88d7e4d97668f06068ec238fabc59d82
-
SHA1
c5ded1e34d8b1aaa62d8fcc45f245ebe3922baed
-
SHA256
b54c24558cf6e2625c473b5703aa2fe21887b7434377fe1d868966a57c5bc483
-
SHA512
0629a9226af34f4f0c573a92cf567952c46acd6b707e0c576189ac96999d7ca24c00e0d19e428672566aa4dc72778c1d39053b296d6441946db4c646d6728f68
Score
10/10
Malware Config
Extracted
Family
smokeloader
Version
2020
C2
http://readinglistforaugust1.xyz/
http://readinglistforaugust2.xyz/
http://readinglistforaugust3.xyz/
http://readinglistforaugust4.xyz/
http://readinglistforaugust5.xyz/
http://readinglistforaugust6.xyz/
http://readinglistforaugust7.xyz/
http://readinglistforaugust8.xyz/
http://readinglistforaugust9.xyz/
http://readinglistforaugust10.xyz/
http://readinglistforaugust1.site/
http://readinglistforaugust2.site/
http://readinglistforaugust3.site/
http://readinglistforaugust4.site/
http://readinglistforaugust5.site/
http://readinglistforaugust6.site/
http://readinglistforaugust7.site/
http://readinglistforaugust8.site/
http://readinglistforaugust9.site/
http://readinglistforaugust10.site/
http://readinglistforaugust1.club/
http://readinglistforaugust2.club/
http://readinglistforaugust3.club/
http://readinglistforaugust4.club/
http://readinglistforaugust5.club/
http://readinglistforaugust6.club/
http://readinglistforaugust7.club/
http://readinglistforaugust8.club/
http://readinglistforaugust9.club/
http://readinglistforaugust10.club/
rc4.i32
rc4.i32
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 2 IoCs
pid Process 3844 rwtdiub 3180 rwtdiub -
Deletes itself 1 IoCs
pid Process 2536 Process not Found -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 764 set thread context of 68 764 88d7e4d97668f06068ec238fabc59d82.exe 75 PID 3844 set thread context of 3180 3844 rwtdiub 89 -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI rwtdiub Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 88d7e4d97668f06068ec238fabc59d82.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 88d7e4d97668f06068ec238fabc59d82.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 88d7e4d97668f06068ec238fabc59d82.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI rwtdiub Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI rwtdiub -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 68 88d7e4d97668f06068ec238fabc59d82.exe 68 88d7e4d97668f06068ec238fabc59d82.exe 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2536 Process not Found -
Suspicious behavior: MapViewOfSection 19 IoCs
pid Process 68 88d7e4d97668f06068ec238fabc59d82.exe 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found 2536 Process not Found -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 2536 Process not Found Token: SeCreatePagefilePrivilege 2536 Process not Found -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2536 Process not Found -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 764 wrote to memory of 68 764 88d7e4d97668f06068ec238fabc59d82.exe 75 PID 764 wrote to memory of 68 764 88d7e4d97668f06068ec238fabc59d82.exe 75 PID 764 wrote to memory of 68 764 88d7e4d97668f06068ec238fabc59d82.exe 75 PID 764 wrote to memory of 68 764 88d7e4d97668f06068ec238fabc59d82.exe 75 PID 764 wrote to memory of 68 764 88d7e4d97668f06068ec238fabc59d82.exe 75 PID 764 wrote to memory of 68 764 88d7e4d97668f06068ec238fabc59d82.exe 75 PID 2536 wrote to memory of 3700 2536 Process not Found 79 PID 2536 wrote to memory of 3700 2536 Process not Found 79 PID 2536 wrote to memory of 3700 2536 Process not Found 79 PID 2536 wrote to memory of 3700 2536 Process not Found 79 PID 2536 wrote to memory of 2816 2536 Process not Found 80 PID 2536 wrote to memory of 2816 2536 Process not Found 80 PID 2536 wrote to memory of 2816 2536 Process not Found 80 PID 2536 wrote to memory of 492 2536 Process not Found 81 PID 2536 wrote to memory of 492 2536 Process not Found 81 PID 2536 wrote to memory of 492 2536 Process not Found 81 PID 2536 wrote to memory of 492 2536 Process not Found 81 PID 2536 wrote to memory of 364 2536 Process not Found 82 PID 2536 wrote to memory of 364 2536 Process not Found 82 PID 2536 wrote to memory of 364 2536 Process not Found 82 PID 2536 wrote to memory of 2196 2536 Process not Found 83 PID 2536 wrote to memory of 2196 2536 Process not Found 83 PID 2536 wrote to memory of 2196 2536 Process not Found 83 PID 2536 wrote to memory of 2196 2536 Process not Found 83 PID 2536 wrote to memory of 4072 2536 Process not Found 84 PID 2536 wrote to memory of 4072 2536 Process not Found 84 PID 2536 wrote to memory of 4072 2536 Process not Found 84 PID 2536 wrote to memory of 2212 2536 Process not Found 85 PID 2536 wrote to memory of 2212 2536 Process not Found 85 PID 2536 wrote to memory of 2212 2536 Process not Found 85 PID 2536 wrote to memory of 2212 2536 Process not Found 85 PID 2536 wrote to memory of 3692 2536 Process not Found 86 PID 2536 wrote to memory of 3692 2536 Process not Found 86 PID 2536 wrote to memory of 3692 2536 Process not Found 86 PID 2536 wrote to memory of 2824 2536 Process not Found 87 PID 2536 wrote to memory of 2824 2536 Process not Found 87 PID 2536 wrote to memory of 2824 2536 Process not Found 87 PID 2536 wrote to memory of 2824 2536 Process not Found 87 PID 3844 wrote to memory of 3180 3844 rwtdiub 89 PID 3844 wrote to memory of 3180 3844 rwtdiub 89 PID 3844 wrote to memory of 3180 3844 rwtdiub 89 PID 3844 wrote to memory of 3180 3844 rwtdiub 89 PID 3844 wrote to memory of 3180 3844 rwtdiub 89 PID 3844 wrote to memory of 3180 3844 rwtdiub 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\88d7e4d97668f06068ec238fabc59d82.exe"C:\Users\Admin\AppData\Local\Temp\88d7e4d97668f06068ec238fabc59d82.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\88d7e4d97668f06068ec238fabc59d82.exe"C:\Users\Admin\AppData\Local\Temp\88d7e4d97668f06068ec238fabc59d82.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:68
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3700
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2816
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:492
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:364
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2196
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4072
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2212
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3692
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2824
-
C:\Users\Admin\AppData\Roaming\rwtdiubC:\Users\Admin\AppData\Roaming\rwtdiub1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Roaming\rwtdiubC:\Users\Admin\AppData\Roaming\rwtdiub2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3180
-