Analysis
- max time kernel
152s - max time network
152s - platform
windows10_x64 - resource
win10v20210408 - submitted
03/09/2021, 06:26
General
- Target dfd9bc8144e3d01171554a89d4f52d10.exe
- Size 191KB
- Sample210903-g7aqmsffhr
- SHA256 58c665dff711329bab255eef59173bcbfbcb12ae2d69689be53efa9370898c13
Malware Config
Extracted
-
smokeloader
-
2020
-
http://readinglistforaugust1.xyz/
-
http://readinglistforaugust2.xyz/
-
http://readinglistforaugust3.xyz/
-
http://readinglistforaugust4.xyz/
-
http://readinglistforaugust5.xyz/
-
http://readinglistforaugust6.xyz/
-
http://readinglistforaugust7.xyz/
-
http://readinglistforaugust8.xyz/
-
http://readinglistforaugust9.xyz/
-
http://readinglistforaugust10.xyz/
-
http://readinglistforaugust1.site/
-
http://readinglistforaugust2.site/
-
http://readinglistforaugust3.site/
-
http://readinglistforaugust4.site/
-
http://readinglistforaugust5.site/
-
http://readinglistforaugust6.site/
-
http://readinglistforaugust7.site/
-
http://readinglistforaugust8.site/
-
http://readinglistforaugust9.site/
-
http://readinglistforaugust10.site/
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 19 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 38 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfd9bc8144e3d01171554a89d4f52d10.exe"C:\Users\Admin\AppData\Local\Temp\dfd9bc8144e3d01171554a89d4f52d10.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dfd9bc8144e3d01171554a89d4f52d10.exe"C:\Users\Admin\AppData\Local\Temp\dfd9bc8144e3d01171554a89d4f52d10.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/416-116-0x00000000022E0000-0x00000000022EA000-memory.dmp
memory/644-114-0x0000000000400000-0x0000000000409000-memory.dmp
memory/1016-134-0x0000000000F50000-0x0000000000F56000-memory.dmp
memory/1016-135-0x0000000000F40000-0x0000000000F4C000-memory.dmp
memory/1180-138-0x0000000000EB0000-0x0000000000EB9000-memory.dmp
memory/1180-137-0x0000000000EC0000-0x0000000000EC4000-memory.dmp
memory/1360-131-0x0000000000C90000-0x0000000000C95000-memory.dmp
memory/1360-132-0x0000000000C80000-0x0000000000C89000-memory.dmp
memory/1900-122-0x0000000000570000-0x000000000057C000-memory.dmp
memory/1900-121-0x0000000000580000-0x0000000000587000-memory.dmp
memory/2248-140-0x0000000000CA0000-0x0000000000CA5000-memory.dmp
memory/2248-141-0x0000000000C90000-0x0000000000C99000-memory.dmp
memory/2376-120-0x00000000006F0000-0x0000000000764000-memory.dmp
memory/2376-123-0x0000000000680000-0x00000000006EB000-memory.dmp
memory/3032-117-0x0000000000E40000-0x0000000000E56000-memory.dmp
memory/3040-125-0x00000000010E0000-0x00000000010E7000-memory.dmp
memory/3040-126-0x00000000010D0000-0x00000000010DB000-memory.dmp
memory/3480-144-0x0000000000120000-0x0000000000129000-memory.dmp
memory/3480-143-0x0000000000130000-0x0000000000135000-memory.dmp
memory/3772-128-0x0000000000DF0000-0x0000000000DF9000-memory.dmp
memory/3772-129-0x0000000000DE0000-0x0000000000DEF000-memory.dmp