Analysis
- max time kernel
151s - max time network
139s - platform
windows7_x64 - resource
win7-en - submitted
06/09/2021, 12:35
Static task
static1
Behavioral task
behavioral1
Sample
278d7ebe9857c7f5599ccd09153f04b3.exe
Resource
win7-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
278d7ebe9857c7f5599ccd09153f04b3.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 278d7ebe9857c7f5599ccd09153f04b3.exe
- Size 202KB
- Sample210906-psc68abag4
- SHA256 76bbdd6144d670f4b0e425238d2ec42800711bfaf882dad3ec7f47ac37f2ddd9
- MD5 278d7ebe9857c7f5599ccd09153f04b3
- SHA1 b7f3cb6bb74d574cf0d80ff271eb5d450fa86503
- SHA512 6c1de40ab7e52a028c216cbc77a70b5bfa62cfa1d4f02820da42ec797f8057a2f61adc7926119e6ac2575edb6629c42c0bad27f33dac402596a65baa572479dd
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://fioajfoiarjfoi1.xyz/
-
http://rdukhnihioh2.xyz/
-
http://sdfghjklemm3.xyz/
-
http://eruiopijhgnn4.xyz/
-
http://igbyugfwbwb5.xyz/
-
http://shfuhfuwhhc6.xyz/
-
http://ersyglhjkuij7.xyz/
-
http://ygyguguuju8.store/
-
http://resbkjpokfct9.store/
-
http://sdfygfygu10.store/
-
http://hbibhibihnj11.store/
-
http://vfwlkjhbghg12.store/
-
http://poiuytrcvb13.store/
-
http://xsedfgtbh14.store/
-
http://iknhyghggh15.store/
-
http://wnlonevkiju16.site/
-
http://gfyufuhhihioh17.site/
-
http://nsgiuwrevi18.site/
-
http://oiureveiuv19.site/
-
http://ovrnevnriuen20.site/
-
http://apowkfeeifin21.site/
-
http://mewmofinoine22.site/
-
http://iefhuiehruiu23.site/
-
http://vjrnnvinerovn24.club/
-
http://roimvnnvwniov25.club/
-
http://fwenmfioewnjo26.club/
-
http://ewoijioewoif27.club/
-
http://fwjenfuihew28.club/
-
http://fwkejnfuiewn29.club/
-
http://fwkjenfuewnh30.club/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Deletes itself 1 IoCs
pid Process 1212 Process not Found - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1840 set thread context of 1764 1840 278d7ebe9857c7f5599ccd09153f04b3.exe 26 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 278d7ebe9857c7f5599ccd09153f04b3.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 278d7ebe9857c7f5599ccd09153f04b3.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 278d7ebe9857c7f5599ccd09153f04b3.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1764 278d7ebe9857c7f5599ccd09153f04b3.exe 1764 278d7ebe9857c7f5599ccd09153f04b3.exe 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1212 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1764 278d7ebe9857c7f5599ccd09153f04b3.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1840 wrote to memory of 1764 1840 278d7ebe9857c7f5599ccd09153f04b3.exe 26 PID 1840 wrote to memory of 1764 1840 278d7ebe9857c7f5599ccd09153f04b3.exe 26 PID 1840 wrote to memory of 1764 1840 278d7ebe9857c7f5599ccd09153f04b3.exe 26 PID 1840 wrote to memory of 1764 1840 278d7ebe9857c7f5599ccd09153f04b3.exe 26 PID 1840 wrote to memory of 1764 1840 278d7ebe9857c7f5599ccd09153f04b3.exe 26 PID 1840 wrote to memory of 1764 1840 278d7ebe9857c7f5599ccd09153f04b3.exe 26 PID 1840 wrote to memory of 1764 1840 278d7ebe9857c7f5599ccd09153f04b3.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\278d7ebe9857c7f5599ccd09153f04b3.exe"C:\Users\Admin\AppData\Local\Temp\278d7ebe9857c7f5599ccd09153f04b3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\278d7ebe9857c7f5599ccd09153f04b3.exe"C:\Users\Admin\AppData\Local\Temp\278d7ebe9857c7f5599ccd09153f04b3.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1764
-