Analysis
-
max time kernel
159s -
max time network
79s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
29/08/2021, 08:50
Static task
static1
Behavioral task
behavioral1
Sample
4ace52067451935ebab5e0826ae22a85.exe
Resource
win7v20210408
buranraccoonsmokeloadertofseexmrigd02c5d65069fc7ce1993e7c52edf0c9c4c195c81fe582536ec580228180f270f7cb80a867860e010backdoordiscoveryevasionminerpersistenceransomwarespywarestealerthemidatrojan
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
4ace52067451935ebab5e0826ae22a85.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
4ace52067451935ebab5e0826ae22a85.exe
-
Size
142KB
-
MD5
4ace52067451935ebab5e0826ae22a85
-
SHA1
f562290eb3c56f0c04fe65965174717b3d072aa2
-
SHA256
3d59ac598ad756cfa7d56ea28d85071266ccfbcec2bc952600ff82fec99d633c
-
SHA512
934fef4d12c30181b2d54390ed72b78086445f149c64a0ee9f5fe3aa15a397c20ac606fc7f6cacf814da7db88f0b4c5340a5a54e351ee7402ebba2698e560155
Score
10/10
Malware Config
Extracted
Family
smokeloader
Version
2020
C2
http://readinglistforaugust1.xyz/
http://readinglistforaugust2.xyz/
http://readinglistforaugust3.xyz/
http://readinglistforaugust4.xyz/
http://readinglistforaugust5.xyz/
http://readinglistforaugust6.xyz/
http://readinglistforaugust7.xyz/
http://readinglistforaugust8.xyz/
http://readinglistforaugust9.xyz/
http://readinglistforaugust10.xyz/
http://readinglistforaugust1.site/
http://readinglistforaugust2.site/
http://readinglistforaugust3.site/
http://readinglistforaugust4.site/
http://readinglistforaugust5.site/
http://readinglistforaugust6.site/
http://readinglistforaugust7.site/
http://readinglistforaugust8.site/
http://readinglistforaugust9.site/
http://readinglistforaugust10.site/
http://readinglistforaugust1.club/
http://readinglistforaugust2.club/
http://readinglistforaugust3.club/
http://readinglistforaugust4.club/
http://readinglistforaugust5.club/
http://readinglistforaugust6.club/
http://readinglistforaugust7.club/
http://readinglistforaugust8.club/
http://readinglistforaugust9.club/
http://readinglistforaugust10.club/
rc4.i32
rc4.i32
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 1 IoCs
pid Process 1556 defehsj -
Deletes itself 1 IoCs
pid Process 3020 Process not Found -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 652 set thread context of 3080 652 4ace52067451935ebab5e0826ae22a85.exe 75 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4ace52067451935ebab5e0826ae22a85.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4ace52067451935ebab5e0826ae22a85.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4ace52067451935ebab5e0826ae22a85.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3080 4ace52067451935ebab5e0826ae22a85.exe 3080 4ace52067451935ebab5e0826ae22a85.exe 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3020 Process not Found -
Suspicious behavior: MapViewOfSection 19 IoCs
pid Process 3080 4ace52067451935ebab5e0826ae22a85.exe 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3020 Process not Found -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 652 wrote to memory of 3080 652 4ace52067451935ebab5e0826ae22a85.exe 75 PID 652 wrote to memory of 3080 652 4ace52067451935ebab5e0826ae22a85.exe 75 PID 652 wrote to memory of 3080 652 4ace52067451935ebab5e0826ae22a85.exe 75 PID 652 wrote to memory of 3080 652 4ace52067451935ebab5e0826ae22a85.exe 75 PID 652 wrote to memory of 3080 652 4ace52067451935ebab5e0826ae22a85.exe 75 PID 652 wrote to memory of 3080 652 4ace52067451935ebab5e0826ae22a85.exe 75 PID 3020 wrote to memory of 2236 3020 Process not Found 79 PID 3020 wrote to memory of 2236 3020 Process not Found 79 PID 3020 wrote to memory of 2236 3020 Process not Found 79 PID 3020 wrote to memory of 2236 3020 Process not Found 79 PID 3020 wrote to memory of 596 3020 Process not Found 80 PID 3020 wrote to memory of 596 3020 Process not Found 80 PID 3020 wrote to memory of 596 3020 Process not Found 80 PID 3020 wrote to memory of 1508 3020 Process not Found 81 PID 3020 wrote to memory of 1508 3020 Process not Found 81 PID 3020 wrote to memory of 1508 3020 Process not Found 81 PID 3020 wrote to memory of 1508 3020 Process not Found 81 PID 3020 wrote to memory of 3744 3020 Process not Found 82 PID 3020 wrote to memory of 3744 3020 Process not Found 82 PID 3020 wrote to memory of 3744 3020 Process not Found 82 PID 3020 wrote to memory of 2164 3020 Process not Found 83 PID 3020 wrote to memory of 2164 3020 Process not Found 83 PID 3020 wrote to memory of 2164 3020 Process not Found 83 PID 3020 wrote to memory of 2164 3020 Process not Found 83 PID 3020 wrote to memory of 3968 3020 Process not Found 84 PID 3020 wrote to memory of 3968 3020 Process not Found 84 PID 3020 wrote to memory of 3968 3020 Process not Found 84 PID 3020 wrote to memory of 4076 3020 Process not Found 85 PID 3020 wrote to memory of 4076 3020 Process not Found 85 PID 3020 wrote to memory of 4076 3020 Process not Found 85 PID 3020 wrote to memory of 4076 3020 Process not Found 85 PID 3020 wrote to memory of 928 3020 Process not Found 86 PID 3020 wrote to memory of 928 3020 Process not Found 86 PID 3020 wrote to memory of 928 3020 Process not Found 86 PID 3020 wrote to memory of 2196 3020 Process not Found 87 PID 3020 wrote to memory of 2196 3020 Process not Found 87 PID 3020 wrote to memory of 2196 3020 Process not Found 87 PID 3020 wrote to memory of 2196 3020 Process not Found 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ace52067451935ebab5e0826ae22a85.exe"C:\Users\Admin\AppData\Local\Temp\4ace52067451935ebab5e0826ae22a85.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Users\Admin\AppData\Local\Temp\4ace52067451935ebab5e0826ae22a85.exe"C:\Users\Admin\AppData\Local\Temp\4ace52067451935ebab5e0826ae22a85.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3080
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2236
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:596
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1508
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3744
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2164
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3968
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4076
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:928
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2196
-
C:\Users\Admin\AppData\Roaming\defehsjC:\Users\Admin\AppData\Roaming\defehsj1⤵
- Executes dropped EXE
PID:1556