Analysis
- max time kernel
150s - max time network
26s - platform
windows7_x64 - resource
win7-en-20210916 - submitted
20/09/2021, 03:31
Static task
static1
Behavioral task
behavioral1
Sample
a8f9a08868396c691207daaafe596569.exe
Resource
win7-en-20210916
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a8f9a08868396c691207daaafe596569.exe
Resource
win10-en
windows10_x64
0 signatures
0 seconds
General
- Target a8f9a08868396c691207daaafe596569.exe
- Size 243KB
- Sample210920-d22qdsfdcq
- SHA256 90ce980b980b372a90c20b959ee2ad27dcea764ce2e858043a8e02aa307cf3b1
- MD5 a8f9a08868396c691207daaafe596569
- SHA1 04ffa112f37475283540dcc2d970e74267c86ec3
- SHA512 953121037ce193c2727de5a7df6b10d682ca7fb91748f7505815714815a13ccff6281a8b0af12ab50c5d293a77f4703b57f0ab0aa5dd621f2ff667ef430efd70
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://venerynnet1.top/
-
http://kevonahira2.top/
-
http://vegangelist3.top/
-
http://kingriffaele4.top/
-
http://arakeishant5.top/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
pid Process 564 F508.exe - Deletes itself 1 IoCs
pid Process 1196 Process not Found - Loads dropped DLL 7 IoCs
pid Process 564 F508.exe 564 F508.exe 564 F508.exe 564 F508.exe 564 F508.exe 564 F508.exe 564 F508.exe - Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1124 set thread context of 1916 1124 a8f9a08868396c691207daaafe596569.exe 28 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a8f9a08868396c691207daaafe596569.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a8f9a08868396c691207daaafe596569.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a8f9a08868396c691207daaafe596569.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1916 a8f9a08868396c691207daaafe596569.exe 1916 a8f9a08868396c691207daaafe596569.exe 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1196 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1916 a8f9a08868396c691207daaafe596569.exe - Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found - Suspicious use of SendNotifyMessage 6 IoCs
pid Process 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1124 wrote to memory of 1916 1124 a8f9a08868396c691207daaafe596569.exe 28 PID 1124 wrote to memory of 1916 1124 a8f9a08868396c691207daaafe596569.exe 28 PID 1124 wrote to memory of 1916 1124 a8f9a08868396c691207daaafe596569.exe 28 PID 1124 wrote to memory of 1916 1124 a8f9a08868396c691207daaafe596569.exe 28 PID 1124 wrote to memory of 1916 1124 a8f9a08868396c691207daaafe596569.exe 28 PID 1124 wrote to memory of 1916 1124 a8f9a08868396c691207daaafe596569.exe 28 PID 1124 wrote to memory of 1916 1124 a8f9a08868396c691207daaafe596569.exe 28 PID 1196 wrote to memory of 564 1196 Process not Found 29 PID 1196 wrote to memory of 564 1196 Process not Found 29 PID 1196 wrote to memory of 564 1196 Process not Found 29 PID 1196 wrote to memory of 564 1196 Process not Found 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8f9a08868396c691207daaafe596569.exe"C:\Users\Admin\AppData\Local\Temp\a8f9a08868396c691207daaafe596569.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\a8f9a08868396c691207daaafe596569.exe"C:\Users\Admin\AppData\Local\Temp\a8f9a08868396c691207daaafe596569.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1916
-
-
C:\Users\Admin\AppData\Local\Temp\F508.exeC:\Users\Admin\AppData\Local\Temp\F508.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:564