Analysis
-
max time kernel
153s -
max time network
123s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
29-08-2021 06:46
Static task
static1
Behavioral task
behavioral1
Sample
cecf25eab4285753ad7fa006aabf4405.exe
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral2
Sample
cecf25eab4285753ad7fa006aabf4405.exe
Resource
win10v20210408
windows10_x64
General
-
Target
cecf25eab4285753ad7fa006aabf4405.exe
-
Size
143KB
-
MD5
cecf25eab4285753ad7fa006aabf4405
-
SHA1
366b60cf4a63e304c64258596aecc2b19007ad00
-
SHA256
27c106e7c9e455f880849d79759df345d2117aa2e2357696dabb51bc11adce8b
-
SHA512
15dba194b8fbc367e41a55138bdef6f604dbb011a4bfa4208df75f51f346403784393a35144089a01a73e9961f5a4d5cb4ad40e183a52407fb015dbf3063d54b
Malware Config
Extracted
smokeloader
2020
http://readinglistforaugust1.xyz/
http://readinglistforaugust2.xyz/
http://readinglistforaugust3.xyz/
http://readinglistforaugust4.xyz/
http://readinglistforaugust5.xyz/
http://readinglistforaugust6.xyz/
http://readinglistforaugust7.xyz/
http://readinglistforaugust8.xyz/
http://readinglistforaugust9.xyz/
http://readinglistforaugust10.xyz/
http://readinglistforaugust1.site/
http://readinglistforaugust2.site/
http://readinglistforaugust3.site/
http://readinglistforaugust4.site/
http://readinglistforaugust5.site/
http://readinglistforaugust6.site/
http://readinglistforaugust7.site/
http://readinglistforaugust8.site/
http://readinglistforaugust9.site/
http://readinglistforaugust10.site/
http://readinglistforaugust1.club/
http://readinglistforaugust2.club/
http://readinglistforaugust3.club/
http://readinglistforaugust4.club/
http://readinglistforaugust5.club/
http://readinglistforaugust6.club/
http://readinglistforaugust7.club/
http://readinglistforaugust8.club/
http://readinglistforaugust9.club/
http://readinglistforaugust10.club/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid Process 2900 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
cecf25eab4285753ad7fa006aabf4405.exedescription pid Process procid_target PID 4796 set thread context of 4164 4796 cecf25eab4285753ad7fa006aabf4405.exe 77 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
cecf25eab4285753ad7fa006aabf4405.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cecf25eab4285753ad7fa006aabf4405.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cecf25eab4285753ad7fa006aabf4405.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cecf25eab4285753ad7fa006aabf4405.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
cecf25eab4285753ad7fa006aabf4405.exepid Process 4164 cecf25eab4285753ad7fa006aabf4405.exe 4164 cecf25eab4285753ad7fa006aabf4405.exe 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid Process 2900 -
Suspicious behavior: MapViewOfSection 19 IoCs
Processes:
cecf25eab4285753ad7fa006aabf4405.exepid Process 4164 cecf25eab4285753ad7fa006aabf4405.exe 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 2900 -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
pid Process 2900 -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
cecf25eab4285753ad7fa006aabf4405.exedescription pid Process procid_target PID 4796 wrote to memory of 4164 4796 cecf25eab4285753ad7fa006aabf4405.exe 77 PID 4796 wrote to memory of 4164 4796 cecf25eab4285753ad7fa006aabf4405.exe 77 PID 4796 wrote to memory of 4164 4796 cecf25eab4285753ad7fa006aabf4405.exe 77 PID 4796 wrote to memory of 4164 4796 cecf25eab4285753ad7fa006aabf4405.exe 77 PID 4796 wrote to memory of 4164 4796 cecf25eab4285753ad7fa006aabf4405.exe 77 PID 4796 wrote to memory of 4164 4796 cecf25eab4285753ad7fa006aabf4405.exe 77 PID 2900 wrote to memory of 500 2900 79 PID 2900 wrote to memory of 500 2900 79 PID 2900 wrote to memory of 500 2900 79 PID 2900 wrote to memory of 500 2900 79 PID 2900 wrote to memory of 908 2900 80 PID 2900 wrote to memory of 908 2900 80 PID 2900 wrote to memory of 908 2900 80 PID 2900 wrote to memory of 352 2900 81 PID 2900 wrote to memory of 352 2900 81 PID 2900 wrote to memory of 352 2900 81 PID 2900 wrote to memory of 352 2900 81 PID 2900 wrote to memory of 1080 2900 82 PID 2900 wrote to memory of 1080 2900 82 PID 2900 wrote to memory of 1080 2900 82 PID 2900 wrote to memory of 1212 2900 83 PID 2900 wrote to memory of 1212 2900 83 PID 2900 wrote to memory of 1212 2900 83 PID 2900 wrote to memory of 1212 2900 83 PID 2900 wrote to memory of 1412 2900 84 PID 2900 wrote to memory of 1412 2900 84 PID 2900 wrote to memory of 1412 2900 84 PID 2900 wrote to memory of 1564 2900 85 PID 2900 wrote to memory of 1564 2900 85 PID 2900 wrote to memory of 1564 2900 85 PID 2900 wrote to memory of 1564 2900 85 PID 2900 wrote to memory of 1804 2900 86 PID 2900 wrote to memory of 1804 2900 86 PID 2900 wrote to memory of 1804 2900 86 PID 2900 wrote to memory of 2040 2900 87 PID 2900 wrote to memory of 2040 2900 87 PID 2900 wrote to memory of 2040 2900 87 PID 2900 wrote to memory of 2040 2900 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\cecf25eab4285753ad7fa006aabf4405.exe"C:\Users\Admin\AppData\Local\Temp\cecf25eab4285753ad7fa006aabf4405.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\cecf25eab4285753ad7fa006aabf4405.exe"C:\Users\Admin\AppData\Local\Temp\cecf25eab4285753ad7fa006aabf4405.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4164
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:500
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:908
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:352
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1080
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1212
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1412
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1564
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1804
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2040