Analysis
-
max time kernel
151s -
max time network
121s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
29-08-2021 08:46
Static task
static1
Behavioral task
behavioral1
Sample
566285f0bda34708c0f19e42f6d23929.exe
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral2
Sample
566285f0bda34708c0f19e42f6d23929.exe
Resource
win10v20210408
windows10_x64
General
-
Target
566285f0bda34708c0f19e42f6d23929.exe
-
Size
143KB
-
MD5
566285f0bda34708c0f19e42f6d23929
-
SHA1
503bee4aeec4972757c079527a2e0af7bdc84b3a
-
SHA256
73e71254b57fbc49f7e55767aee9ff95507630171bbda89b5adf1907bc802279
-
SHA512
f98d64ed8f4b2cccae95a3baff21285e75dfb42baaa5d935893dc5809ca8b81c39eab32aaef16844998e57b22b450e4085ef09460f730e09eca17b9c3021306f
Malware Config
Extracted
smokeloader
2020
http://readinglistforaugust1.xyz/
http://readinglistforaugust2.xyz/
http://readinglistforaugust3.xyz/
http://readinglistforaugust4.xyz/
http://readinglistforaugust5.xyz/
http://readinglistforaugust6.xyz/
http://readinglistforaugust7.xyz/
http://readinglistforaugust8.xyz/
http://readinglistforaugust9.xyz/
http://readinglistforaugust10.xyz/
http://readinglistforaugust1.site/
http://readinglistforaugust2.site/
http://readinglistforaugust3.site/
http://readinglistforaugust4.site/
http://readinglistforaugust5.site/
http://readinglistforaugust6.site/
http://readinglistforaugust7.site/
http://readinglistforaugust8.site/
http://readinglistforaugust9.site/
http://readinglistforaugust10.site/
http://readinglistforaugust1.club/
http://readinglistforaugust2.club/
http://readinglistforaugust3.club/
http://readinglistforaugust4.club/
http://readinglistforaugust5.club/
http://readinglistforaugust6.club/
http://readinglistforaugust7.club/
http://readinglistforaugust8.club/
http://readinglistforaugust9.club/
http://readinglistforaugust10.club/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid Process 2988 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
566285f0bda34708c0f19e42f6d23929.exedescription pid Process procid_target PID 568 set thread context of 3788 568 566285f0bda34708c0f19e42f6d23929.exe 77 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
566285f0bda34708c0f19e42f6d23929.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 566285f0bda34708c0f19e42f6d23929.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 566285f0bda34708c0f19e42f6d23929.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 566285f0bda34708c0f19e42f6d23929.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
566285f0bda34708c0f19e42f6d23929.exepid Process 3788 566285f0bda34708c0f19e42f6d23929.exe 3788 566285f0bda34708c0f19e42f6d23929.exe 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid Process 2988 -
Suspicious behavior: MapViewOfSection 19 IoCs
Processes:
566285f0bda34708c0f19e42f6d23929.exepid Process 3788 566285f0bda34708c0f19e42f6d23929.exe 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 2988 -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
pid Process 2988 -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
566285f0bda34708c0f19e42f6d23929.exedescription pid Process procid_target PID 568 wrote to memory of 3788 568 566285f0bda34708c0f19e42f6d23929.exe 77 PID 568 wrote to memory of 3788 568 566285f0bda34708c0f19e42f6d23929.exe 77 PID 568 wrote to memory of 3788 568 566285f0bda34708c0f19e42f6d23929.exe 77 PID 568 wrote to memory of 3788 568 566285f0bda34708c0f19e42f6d23929.exe 77 PID 568 wrote to memory of 3788 568 566285f0bda34708c0f19e42f6d23929.exe 77 PID 568 wrote to memory of 3788 568 566285f0bda34708c0f19e42f6d23929.exe 77 PID 2988 wrote to memory of 3032 2988 79 PID 2988 wrote to memory of 3032 2988 79 PID 2988 wrote to memory of 3032 2988 79 PID 2988 wrote to memory of 3032 2988 79 PID 2988 wrote to memory of 1252 2988 80 PID 2988 wrote to memory of 1252 2988 80 PID 2988 wrote to memory of 1252 2988 80 PID 2988 wrote to memory of 3904 2988 81 PID 2988 wrote to memory of 3904 2988 81 PID 2988 wrote to memory of 3904 2988 81 PID 2988 wrote to memory of 3904 2988 81 PID 2988 wrote to memory of 1504 2988 82 PID 2988 wrote to memory of 1504 2988 82 PID 2988 wrote to memory of 1504 2988 82 PID 2988 wrote to memory of 3692 2988 83 PID 2988 wrote to memory of 3692 2988 83 PID 2988 wrote to memory of 3692 2988 83 PID 2988 wrote to memory of 3692 2988 83 PID 2988 wrote to memory of 760 2988 84 PID 2988 wrote to memory of 760 2988 84 PID 2988 wrote to memory of 760 2988 84 PID 2988 wrote to memory of 4052 2988 85 PID 2988 wrote to memory of 4052 2988 85 PID 2988 wrote to memory of 4052 2988 85 PID 2988 wrote to memory of 4052 2988 85 PID 2988 wrote to memory of 844 2988 86 PID 2988 wrote to memory of 844 2988 86 PID 2988 wrote to memory of 844 2988 86 PID 2988 wrote to memory of 3916 2988 87 PID 2988 wrote to memory of 3916 2988 87 PID 2988 wrote to memory of 3916 2988 87 PID 2988 wrote to memory of 3916 2988 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\566285f0bda34708c0f19e42f6d23929.exe"C:\Users\Admin\AppData\Local\Temp\566285f0bda34708c0f19e42f6d23929.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Users\Admin\AppData\Local\Temp\566285f0bda34708c0f19e42f6d23929.exe"C:\Users\Admin\AppData\Local\Temp\566285f0bda34708c0f19e42f6d23929.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3788
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3032
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1252
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3904
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1504
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3692
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:760
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4052
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:844
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3916