Analysis
- max time kernel
151s - max time network
103s - platform
windows10_x64 - resource
win10v20210408 - submitted
18/09/2021, 05:16
Static task
static1
Behavioral task
behavioral1
Sample
b9143f8b866d0f064b6685e9d1db705a.exe
Resource
win7-en-20210916
windows7_x64
0 signatures
0 seconds
General
- Target b9143f8b866d0f064b6685e9d1db705a.exe
- Size 239KB
- Sample210918-fx73qabffl
- SHA256 3c5232362ea229f9e937a7bb4263a5f1dc2bd3a3a040088901a5a74edf943c7e
- MD5 b9143f8b866d0f064b6685e9d1db705a
- SHA1 d64e670f8c26980cf3a006d5527fdb85067a137f
- SHA512 f0b57ac99924d15928485c261de74480fb81f027a72a94a25a4edb8b733aa87960692a92b42473e8563556eb16d450d99a34ec9d113c5960f221de9ae6df9f5c
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://venerynnet1.top/
-
http://kevonahira2.top/
-
http://vegangelist3.top/
-
http://kingriffaele4.top/
-
http://arakeishant5.top/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Downloads MZ/PE file
- Executes dropped EXE 2 IoCs
pid Process 4868 CA7F.exe 4944 CE77.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion CA7F.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion CA7F.exe - Deletes itself 1 IoCs
pid Process 2900 Process not Found - Loads dropped DLL 5 IoCs
pid Process 4944 CE77.exe 4944 CE77.exe 4944 CE77.exe 4944 CE77.exe 4944 CE77.exe - Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/files/0x000200000001ab3d-119.dat themida behavioral2/memory/4868-125-0x0000000000890000-0x0000000000891000-memory.dmp themida - Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA CA7F.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4868 CA7F.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4796 set thread context of 4816 4796 b9143f8b866d0f064b6685e9d1db705a.exe 68 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI b9143f8b866d0f064b6685e9d1db705a.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI b9143f8b866d0f064b6685e9d1db705a.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI b9143f8b866d0f064b6685e9d1db705a.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Process not Found Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Process not Found - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4816 b9143f8b866d0f064b6685e9d1db705a.exe 4816 b9143f8b866d0f064b6685e9d1db705a.exe 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2900 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4816 b9143f8b866d0f064b6685e9d1db705a.exe - Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeShutdownPrivilege 2900 Process not Found Token: SeCreatePagefilePrivilege 2900 Process not Found Token: SeShutdownPrivilege 2900 Process not Found Token: SeCreatePagefilePrivilege 2900 Process not Found Token: SeShutdownPrivilege 2900 Process not Found Token: SeCreatePagefilePrivilege 2900 Process not Found Token: SeShutdownPrivilege 2900 Process not Found Token: SeCreatePagefilePrivilege 2900 Process not Found Token: SeShutdownPrivilege 2900 Process not Found Token: SeCreatePagefilePrivilege 2900 Process not Found Token: SeShutdownPrivilege 2900 Process not Found Token: SeCreatePagefilePrivilege 2900 Process not Found Token: SeShutdownPrivilege 2900 Process not Found Token: SeCreatePagefilePrivilege 2900 Process not Found Token: SeShutdownPrivilege 2900 Process not Found Token: SeCreatePagefilePrivilege 2900 Process not Found Token: SeShutdownPrivilege 2900 Process not Found Token: SeCreatePagefilePrivilege 2900 Process not Found Token: SeDebugPrivilege 4868 CA7F.exe Token: SeShutdownPrivilege 2900 Process not Found Token: SeCreatePagefilePrivilege 2900 Process not Found Token: SeShutdownPrivilege 2900 Process not Found Token: SeCreatePagefilePrivilege 2900 Process not Found Token: SeShutdownPrivilege 2900 Process not Found Token: SeCreatePagefilePrivilege 2900 Process not Found Token: SeShutdownPrivilege 2900 Process not Found Token: SeCreatePagefilePrivilege 2900 Process not Found Token: SeShutdownPrivilege 2900 Process not Found Token: SeCreatePagefilePrivilege 2900 Process not Found Token: SeShutdownPrivilege 2900 Process not Found Token: SeCreatePagefilePrivilege 2900 Process not Found Token: SeShutdownPrivilege 2900 Process not Found Token: SeCreatePagefilePrivilege 2900 Process not Found - Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found 2900 Process not Found - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2900 Process not Found 2900 Process not Found - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4796 wrote to memory of 4816 4796 b9143f8b866d0f064b6685e9d1db705a.exe 68 PID 4796 wrote to memory of 4816 4796 b9143f8b866d0f064b6685e9d1db705a.exe 68 PID 4796 wrote to memory of 4816 4796 b9143f8b866d0f064b6685e9d1db705a.exe 68 PID 4796 wrote to memory of 4816 4796 b9143f8b866d0f064b6685e9d1db705a.exe 68 PID 4796 wrote to memory of 4816 4796 b9143f8b866d0f064b6685e9d1db705a.exe 68 PID 4796 wrote to memory of 4816 4796 b9143f8b866d0f064b6685e9d1db705a.exe 68 PID 2900 wrote to memory of 4868 2900 Process not Found 69 PID 2900 wrote to memory of 4868 2900 Process not Found 69 PID 2900 wrote to memory of 4868 2900 Process not Found 69 PID 2900 wrote to memory of 4944 2900 Process not Found 71 PID 2900 wrote to memory of 4944 2900 Process not Found 71 PID 2900 wrote to memory of 4944 2900 Process not Found 71
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9143f8b866d0f064b6685e9d1db705a.exe"C:\Users\Admin\AppData\Local\Temp\b9143f8b866d0f064b6685e9d1db705a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\b9143f8b866d0f064b6685e9d1db705a.exe"C:\Users\Admin\AppData\Local\Temp\b9143f8b866d0f064b6685e9d1db705a.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4816
-
-
C:\Users\Admin\AppData\Local\Temp\CA7F.exeC:\Users\Admin\AppData\Local\Temp\CA7F.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:4868
-
C:\Users\Admin\AppData\Local\Temp\CE77.exeC:\Users\Admin\AppData\Local\Temp\CE77.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4944