Analysis
- max time kernel
152s - max time network
135s - platform
windows10_x64 - resource
win10v20210408 - submitted
06/09/2021, 12:35
Static task
static1
Behavioral task
behavioral1
Sample
278d7ebe9857c7f5599ccd09153f04b3.exe
Resource
win7-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
278d7ebe9857c7f5599ccd09153f04b3.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 278d7ebe9857c7f5599ccd09153f04b3.exe
- Size 202KB
- Sample210906-psc68abag4
- SHA256 76bbdd6144d670f4b0e425238d2ec42800711bfaf882dad3ec7f47ac37f2ddd9
- MD5 278d7ebe9857c7f5599ccd09153f04b3
- SHA1 b7f3cb6bb74d574cf0d80ff271eb5d450fa86503
- SHA512 6c1de40ab7e52a028c216cbc77a70b5bfa62cfa1d4f02820da42ec797f8057a2f61adc7926119e6ac2575edb6629c42c0bad27f33dac402596a65baa572479dd
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://fioajfoiarjfoi1.xyz/
-
http://rdukhnihioh2.xyz/
-
http://sdfghjklemm3.xyz/
-
http://eruiopijhgnn4.xyz/
-
http://igbyugfwbwb5.xyz/
-
http://shfuhfuwhhc6.xyz/
-
http://ersyglhjkuij7.xyz/
-
http://ygyguguuju8.store/
-
http://resbkjpokfct9.store/
-
http://sdfygfygu10.store/
-
http://hbibhibihnj11.store/
-
http://vfwlkjhbghg12.store/
-
http://poiuytrcvb13.store/
-
http://xsedfgtbh14.store/
-
http://iknhyghggh15.store/
-
http://wnlonevkiju16.site/
-
http://gfyufuhhihioh17.site/
-
http://nsgiuwrevi18.site/
-
http://oiureveiuv19.site/
-
http://ovrnevnriuen20.site/
-
http://apowkfeeifin21.site/
-
http://mewmofinoine22.site/
-
http://iefhuiehruiu23.site/
-
http://vjrnnvinerovn24.club/
-
http://roimvnnvwniov25.club/
-
http://fwenmfioewnjo26.club/
-
http://ewoijioewoif27.club/
-
http://fwjenfuihew28.club/
-
http://fwkejnfuiewn29.club/
-
http://fwkjenfuewnh30.club/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Executes dropped EXE 2 IoCs
pid Process 3008 jjdwhec 2032 jjdwhec - Deletes itself 1 IoCs
pid Process 3016 Process not Found - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3128 set thread context of 1632 3128 278d7ebe9857c7f5599ccd09153f04b3.exe 74 PID 3008 set thread context of 2032 3008 jjdwhec 80 - Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 278d7ebe9857c7f5599ccd09153f04b3.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 278d7ebe9857c7f5599ccd09153f04b3.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 278d7ebe9857c7f5599ccd09153f04b3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jjdwhec Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jjdwhec Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jjdwhec - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1632 278d7ebe9857c7f5599ccd09153f04b3.exe 1632 278d7ebe9857c7f5599ccd09153f04b3.exe 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found 3016 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3016 Process not Found - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1632 278d7ebe9857c7f5599ccd09153f04b3.exe 2032 jjdwhec - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 3016 Process not Found Token: SeCreatePagefilePrivilege 3016 Process not Found - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3016 Process not Found - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3128 wrote to memory of 1632 3128 278d7ebe9857c7f5599ccd09153f04b3.exe 74 PID 3128 wrote to memory of 1632 3128 278d7ebe9857c7f5599ccd09153f04b3.exe 74 PID 3128 wrote to memory of 1632 3128 278d7ebe9857c7f5599ccd09153f04b3.exe 74 PID 3128 wrote to memory of 1632 3128 278d7ebe9857c7f5599ccd09153f04b3.exe 74 PID 3128 wrote to memory of 1632 3128 278d7ebe9857c7f5599ccd09153f04b3.exe 74 PID 3128 wrote to memory of 1632 3128 278d7ebe9857c7f5599ccd09153f04b3.exe 74 PID 3008 wrote to memory of 2032 3008 jjdwhec 80 PID 3008 wrote to memory of 2032 3008 jjdwhec 80 PID 3008 wrote to memory of 2032 3008 jjdwhec 80 PID 3008 wrote to memory of 2032 3008 jjdwhec 80 PID 3008 wrote to memory of 2032 3008 jjdwhec 80 PID 3008 wrote to memory of 2032 3008 jjdwhec 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\278d7ebe9857c7f5599ccd09153f04b3.exe"C:\Users\Admin\AppData\Local\Temp\278d7ebe9857c7f5599ccd09153f04b3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\278d7ebe9857c7f5599ccd09153f04b3.exe"C:\Users\Admin\AppData\Local\Temp\278d7ebe9857c7f5599ccd09153f04b3.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1632
-
-
C:\Users\Admin\AppData\Roaming\jjdwhecC:\Users\Admin\AppData\Roaming\jjdwhec1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Roaming\jjdwhecC:\Users\Admin\AppData\Roaming\jjdwhec2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2032
-