Analysis
-
max time kernel
156s -
max time network
120s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
29/08/2021, 08:46
Static task
static1
Behavioral task
behavioral1
Sample
2cbfec5cd3f0662c2715c07cb5137bc9.exe
Resource
win7v20210408
buranraccoonsmokeloadertofseexmrigd02c5d65069fc7ce1993e7c52edf0c9c4c195c81fe582536ec580228180f270f7cb80a867860e010backdoordiscoveryevasionminerpersistenceransomwarespywarestealerthemidatrojan
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
2cbfec5cd3f0662c2715c07cb5137bc9.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
2cbfec5cd3f0662c2715c07cb5137bc9.exe
-
Size
139KB
-
MD5
2cbfec5cd3f0662c2715c07cb5137bc9
-
SHA1
d9d8cbb7e646d492aaff3280898b79bb764eabf9
-
SHA256
7a0413cd0a25ed760cf3e17c60ce915b28c0472a658ba910d76435c19213dfac
-
SHA512
80450e2cd7d059cfa9f2d752f2b4d4a9d642006879a5900f102e622eadede260db97103b55ceaa408896ac87f9e82a76b87f7d34328756bdd9b57d219e0ff7fc
Score
10/10
Malware Config
Extracted
Family
smokeloader
Version
2020
C2
http://readinglistforaugust1.xyz/
http://readinglistforaugust2.xyz/
http://readinglistforaugust3.xyz/
http://readinglistforaugust4.xyz/
http://readinglistforaugust5.xyz/
http://readinglistforaugust6.xyz/
http://readinglistforaugust7.xyz/
http://readinglistforaugust8.xyz/
http://readinglistforaugust9.xyz/
http://readinglistforaugust10.xyz/
http://readinglistforaugust1.site/
http://readinglistforaugust2.site/
http://readinglistforaugust3.site/
http://readinglistforaugust4.site/
http://readinglistforaugust5.site/
http://readinglistforaugust6.site/
http://readinglistforaugust7.site/
http://readinglistforaugust8.site/
http://readinglistforaugust9.site/
http://readinglistforaugust10.site/
http://readinglistforaugust1.club/
http://readinglistforaugust2.club/
http://readinglistforaugust3.club/
http://readinglistforaugust4.club/
http://readinglistforaugust5.club/
http://readinglistforaugust6.club/
http://readinglistforaugust7.club/
http://readinglistforaugust8.club/
http://readinglistforaugust9.club/
http://readinglistforaugust10.club/
rc4.i32
rc4.i32
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
pid Process 3044 Process not Found -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 804 set thread context of 3140 804 2cbfec5cd3f0662c2715c07cb5137bc9.exe 77 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2cbfec5cd3f0662c2715c07cb5137bc9.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2cbfec5cd3f0662c2715c07cb5137bc9.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2cbfec5cd3f0662c2715c07cb5137bc9.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3140 2cbfec5cd3f0662c2715c07cb5137bc9.exe 3140 2cbfec5cd3f0662c2715c07cb5137bc9.exe 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3044 Process not Found -
Suspicious behavior: MapViewOfSection 19 IoCs
pid Process 3140 2cbfec5cd3f0662c2715c07cb5137bc9.exe 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 804 wrote to memory of 3140 804 2cbfec5cd3f0662c2715c07cb5137bc9.exe 77 PID 804 wrote to memory of 3140 804 2cbfec5cd3f0662c2715c07cb5137bc9.exe 77 PID 804 wrote to memory of 3140 804 2cbfec5cd3f0662c2715c07cb5137bc9.exe 77 PID 804 wrote to memory of 3140 804 2cbfec5cd3f0662c2715c07cb5137bc9.exe 77 PID 804 wrote to memory of 3140 804 2cbfec5cd3f0662c2715c07cb5137bc9.exe 77 PID 804 wrote to memory of 3140 804 2cbfec5cd3f0662c2715c07cb5137bc9.exe 77 PID 3044 wrote to memory of 2912 3044 Process not Found 79 PID 3044 wrote to memory of 2912 3044 Process not Found 79 PID 3044 wrote to memory of 2912 3044 Process not Found 79 PID 3044 wrote to memory of 2912 3044 Process not Found 79 PID 3044 wrote to memory of 1264 3044 Process not Found 80 PID 3044 wrote to memory of 1264 3044 Process not Found 80 PID 3044 wrote to memory of 1264 3044 Process not Found 80 PID 3044 wrote to memory of 3332 3044 Process not Found 81 PID 3044 wrote to memory of 3332 3044 Process not Found 81 PID 3044 wrote to memory of 3332 3044 Process not Found 81 PID 3044 wrote to memory of 3332 3044 Process not Found 81 PID 3044 wrote to memory of 1116 3044 Process not Found 82 PID 3044 wrote to memory of 1116 3044 Process not Found 82 PID 3044 wrote to memory of 1116 3044 Process not Found 82 PID 3044 wrote to memory of 2192 3044 Process not Found 83 PID 3044 wrote to memory of 2192 3044 Process not Found 83 PID 3044 wrote to memory of 2192 3044 Process not Found 83 PID 3044 wrote to memory of 2192 3044 Process not Found 83 PID 3044 wrote to memory of 852 3044 Process not Found 84 PID 3044 wrote to memory of 852 3044 Process not Found 84 PID 3044 wrote to memory of 852 3044 Process not Found 84 PID 3044 wrote to memory of 2256 3044 Process not Found 85 PID 3044 wrote to memory of 2256 3044 Process not Found 85 PID 3044 wrote to memory of 2256 3044 Process not Found 85 PID 3044 wrote to memory of 2256 3044 Process not Found 85 PID 3044 wrote to memory of 2516 3044 Process not Found 86 PID 3044 wrote to memory of 2516 3044 Process not Found 86 PID 3044 wrote to memory of 2516 3044 Process not Found 86 PID 3044 wrote to memory of 3912 3044 Process not Found 87 PID 3044 wrote to memory of 3912 3044 Process not Found 87 PID 3044 wrote to memory of 3912 3044 Process not Found 87 PID 3044 wrote to memory of 3912 3044 Process not Found 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\2cbfec5cd3f0662c2715c07cb5137bc9.exe"C:\Users\Admin\AppData\Local\Temp\2cbfec5cd3f0662c2715c07cb5137bc9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\Temp\2cbfec5cd3f0662c2715c07cb5137bc9.exe"C:\Users\Admin\AppData\Local\Temp\2cbfec5cd3f0662c2715c07cb5137bc9.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3140
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2912
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1264
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3332
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1116
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2192
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:852
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2256
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2516
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3912