Analysis
- max time kernel
153s - max time network
144s - platform
windows7_x64 - resource
win7v20210408 - submitted
10/09/2021, 13:31
Static task
static1
Behavioral task
behavioral1
Sample
66C36989BE74F756DE04E43A0E975242.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
66C36989BE74F756DE04E43A0E975242.exe
Resource
win10-en
windows10_x64
0 signatures
0 seconds
General
- Target 66C36989BE74F756DE04E43A0E975242.exe
- Size 246KB
- Sample210910-qsc2wsdcbr
- SHA256 37b4ecc82510180fafd3190e86be4d714caa2522f3475fd8e8debbacb6fc3e38
- MD5 66c36989be74f756de04e43a0e975242
- SHA1 059affb8457336011a7196f6739eb463c264e8a0
- SHA512 5c129e1365640a3116384c23fdaa5206751e21b43c4b94d6a94b039662049950265ca7b82fb19879e30ff53098856edd571a765442ff2fe894c37ee9bcbd926a
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://fazanaharahe1.xyz/
-
http://xandelissane2.xyz/
-
http://ustiassosale3.xyz/
-
http://cytheriata4.xyz/
-
http://ggiergionard5.xyz/
-
http://rrelleynaniy6.store/
-
http://danniemusoa7.store/
-
http://nastanizab8.store/
-
http://onyokandis9.store/
-
http://dmunaavank10.store/
-
http://gilmandros11.site/
-
http://cusanthana12.site/
-
http://willietjeana13.site/
-
http://ximusokall14.site/
-
http://blodinetisha15.site/
-
http://urydiahadyss16.club/
-
http://glasamaddama17.club/
-
http://marlingarly18.club/
-
http://alluvianna19.club/
-
http://xandirkaniel20.club/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- suricata: ET MALWARE Known Sinkhole Response Header
suricata: ET MALWARE Known Sinkhole Response Header
- suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
- Executes dropped EXE 2 IoCs
pid Process 1624 udejfvf 1620 udejfvf - Deletes itself 1 IoCs
pid Process 1200 Process not Found - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1036 set thread context of 1876 1036 66C36989BE74F756DE04E43A0E975242.exe 26 PID 1624 set thread context of 1620 1624 udejfvf 32 - Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI udejfvf Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 66C36989BE74F756DE04E43A0E975242.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 66C36989BE74F756DE04E43A0E975242.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 66C36989BE74F756DE04E43A0E975242.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI udejfvf Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI udejfvf - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1876 66C36989BE74F756DE04E43A0E975242.exe 1876 66C36989BE74F756DE04E43A0E975242.exe 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1200 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1876 66C36989BE74F756DE04E43A0E975242.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1036 wrote to memory of 1876 1036 66C36989BE74F756DE04E43A0E975242.exe 26 PID 1036 wrote to memory of 1876 1036 66C36989BE74F756DE04E43A0E975242.exe 26 PID 1036 wrote to memory of 1876 1036 66C36989BE74F756DE04E43A0E975242.exe 26 PID 1036 wrote to memory of 1876 1036 66C36989BE74F756DE04E43A0E975242.exe 26 PID 1036 wrote to memory of 1876 1036 66C36989BE74F756DE04E43A0E975242.exe 26 PID 1036 wrote to memory of 1876 1036 66C36989BE74F756DE04E43A0E975242.exe 26 PID 1036 wrote to memory of 1876 1036 66C36989BE74F756DE04E43A0E975242.exe 26 PID 616 wrote to memory of 1624 616 taskeng.exe 31 PID 616 wrote to memory of 1624 616 taskeng.exe 31 PID 616 wrote to memory of 1624 616 taskeng.exe 31 PID 616 wrote to memory of 1624 616 taskeng.exe 31 PID 1624 wrote to memory of 1620 1624 udejfvf 32 PID 1624 wrote to memory of 1620 1624 udejfvf 32 PID 1624 wrote to memory of 1620 1624 udejfvf 32 PID 1624 wrote to memory of 1620 1624 udejfvf 32 PID 1624 wrote to memory of 1620 1624 udejfvf 32 PID 1624 wrote to memory of 1620 1624 udejfvf 32 PID 1624 wrote to memory of 1620 1624 udejfvf 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\66C36989BE74F756DE04E43A0E975242.exe"C:\Users\Admin\AppData\Local\Temp\66C36989BE74F756DE04E43A0E975242.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\66C36989BE74F756DE04E43A0E975242.exe"C:\Users\Admin\AppData\Local\Temp\66C36989BE74F756DE04E43A0E975242.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1876
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {B9A30BDE-DB68-4B48-9E21-46EA748BC4BB} S-1-5-21-2455352368-1077083310-2879168483-1000:QWOCTUPM\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Users\Admin\AppData\Roaming\udejfvfC:\Users\Admin\AppData\Roaming\udejfvf2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Roaming\udejfvfC:\Users\Admin\AppData\Roaming\udejfvf3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1620
-
-