Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
26-09-2021 01:39
Static task
static1
Behavioral task
behavioral1
Sample
00426f4b3edf4a8c0d512222d5257696.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
00426f4b3edf4a8c0d512222d5257696.exe
Resource
win10v20210408
General
-
Target
00426f4b3edf4a8c0d512222d5257696.exe
-
Size
146KB
-
MD5
00426f4b3edf4a8c0d512222d5257696
-
SHA1
84de454a9c3910e50048d7555c5836271d638216
-
SHA256
716821b6b210a9c8ae93af80ea648edd2ff944e6221e9900ff805c7df41731c0
-
SHA512
8649faa52f0235c4e07db005cc451fc2ef29cde922899d739ff409d2c8ed6c18c329cd2f349328333c56e3a2bf0686562cb0098f72089a8e98cc4e3386f5905d
Malware Config
Extracted
smokeloader
2020
http://naghenrietti1.top/
http://kimballiett2.top/
http://xadriettany3.top/
http://jebeccallis4.top/
http://nityanneron5.top/
http://umayaniela6.top/
http://lynettaram7.top/
http://sadineyalas8.top/
http://geenaldencia9.top/
http://aradysiusep10.top/
Extracted
raccoon
f6d7183c9e82d2a9b81e6c0608450aa66cefb51f
-
url4cnc
https://t.me/justoprostohello
Extracted
raccoon
5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4
-
url4cnc
https://t.me/agrybirdsgamerept
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 6 IoCs
Processes:
D79E.exeDC23.exejgEPL904nQ.exesihost.execffaghecffaghepid process 1528 D79E.exe 2252 DC23.exe 2420 jgEPL904nQ.exe 2984 sihost.exe 2996 cffaghe 1540 cffaghe -
Deletes itself 1 IoCs
Processes:
pid process 3092 -
Loads dropped DLL 6 IoCs
Processes:
D79E.exepid process 1528 D79E.exe 1528 D79E.exe 1528 D79E.exe 1528 D79E.exe 1528 D79E.exe 1528 D79E.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
00426f4b3edf4a8c0d512222d5257696.execffaghedescription pid process target process PID 644 set thread context of 772 644 00426f4b3edf4a8c0d512222d5257696.exe 00426f4b3edf4a8c0d512222d5257696.exe PID 2996 set thread context of 1540 2996 cffaghe cffaghe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
00426f4b3edf4a8c0d512222d5257696.execffaghedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 00426f4b3edf4a8c0d512222d5257696.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 00426f4b3edf4a8c0d512222d5257696.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cffaghe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cffaghe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cffaghe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 00426f4b3edf4a8c0d512222d5257696.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2680 schtasks.exe 2844 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3976 timeout.exe -
Modifies registry class 2 IoCs
Processes:
description ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
00426f4b3edf4a8c0d512222d5257696.exepid process 772 00426f4b3edf4a8c0d512222d5257696.exe 772 00426f4b3edf4a8c0d512222d5257696.exe 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 3092 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3092 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
00426f4b3edf4a8c0d512222d5257696.execffaghepid process 772 00426f4b3edf4a8c0d512222d5257696.exe 1540 cffaghe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 3092 Token: SeCreatePagefilePrivilege 3092 Token: SeShutdownPrivilege 3092 Token: SeCreatePagefilePrivilege 3092 Token: SeShutdownPrivilege 3092 Token: SeCreatePagefilePrivilege 3092 Token: SeShutdownPrivilege 3092 Token: SeCreatePagefilePrivilege 3092 Token: SeShutdownPrivilege 3092 Token: SeCreatePagefilePrivilege 3092 Token: SeShutdownPrivilege 3092 Token: SeCreatePagefilePrivilege 3092 Token: SeShutdownPrivilege 3092 Token: SeCreatePagefilePrivilege 3092 Token: SeShutdownPrivilege 3092 Token: SeCreatePagefilePrivilege 3092 Token: SeShutdownPrivilege 3092 Token: SeCreatePagefilePrivilege 3092 -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
pid process 3092 3092 3092 3092 -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
00426f4b3edf4a8c0d512222d5257696.exeD79E.execmd.exejgEPL904nQ.exesihost.execffaghedescription pid process target process PID 644 wrote to memory of 772 644 00426f4b3edf4a8c0d512222d5257696.exe 00426f4b3edf4a8c0d512222d5257696.exe PID 644 wrote to memory of 772 644 00426f4b3edf4a8c0d512222d5257696.exe 00426f4b3edf4a8c0d512222d5257696.exe PID 644 wrote to memory of 772 644 00426f4b3edf4a8c0d512222d5257696.exe 00426f4b3edf4a8c0d512222d5257696.exe PID 644 wrote to memory of 772 644 00426f4b3edf4a8c0d512222d5257696.exe 00426f4b3edf4a8c0d512222d5257696.exe PID 644 wrote to memory of 772 644 00426f4b3edf4a8c0d512222d5257696.exe 00426f4b3edf4a8c0d512222d5257696.exe PID 644 wrote to memory of 772 644 00426f4b3edf4a8c0d512222d5257696.exe 00426f4b3edf4a8c0d512222d5257696.exe PID 3092 wrote to memory of 1528 3092 D79E.exe PID 3092 wrote to memory of 1528 3092 D79E.exe PID 3092 wrote to memory of 1528 3092 D79E.exe PID 3092 wrote to memory of 2252 3092 DC23.exe PID 3092 wrote to memory of 2252 3092 DC23.exe PID 3092 wrote to memory of 2252 3092 DC23.exe PID 1528 wrote to memory of 2420 1528 D79E.exe jgEPL904nQ.exe PID 1528 wrote to memory of 2420 1528 D79E.exe jgEPL904nQ.exe PID 1528 wrote to memory of 2420 1528 D79E.exe jgEPL904nQ.exe PID 1528 wrote to memory of 4020 1528 D79E.exe cmd.exe PID 1528 wrote to memory of 4020 1528 D79E.exe cmd.exe PID 1528 wrote to memory of 4020 1528 D79E.exe cmd.exe PID 4020 wrote to memory of 3976 4020 cmd.exe timeout.exe PID 4020 wrote to memory of 3976 4020 cmd.exe timeout.exe PID 4020 wrote to memory of 3976 4020 cmd.exe timeout.exe PID 2420 wrote to memory of 2680 2420 jgEPL904nQ.exe schtasks.exe PID 2420 wrote to memory of 2680 2420 jgEPL904nQ.exe schtasks.exe PID 2420 wrote to memory of 2680 2420 jgEPL904nQ.exe schtasks.exe PID 2984 wrote to memory of 2844 2984 sihost.exe schtasks.exe PID 2984 wrote to memory of 2844 2984 sihost.exe schtasks.exe PID 2984 wrote to memory of 2844 2984 sihost.exe schtasks.exe PID 2996 wrote to memory of 1540 2996 cffaghe cffaghe PID 2996 wrote to memory of 1540 2996 cffaghe cffaghe PID 2996 wrote to memory of 1540 2996 cffaghe cffaghe PID 2996 wrote to memory of 1540 2996 cffaghe cffaghe PID 2996 wrote to memory of 1540 2996 cffaghe cffaghe PID 2996 wrote to memory of 1540 2996 cffaghe cffaghe
Processes
-
C:\Users\Admin\AppData\Local\Temp\00426f4b3edf4a8c0d512222d5257696.exe"C:\Users\Admin\AppData\Local\Temp\00426f4b3edf4a8c0d512222d5257696.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\00426f4b3edf4a8c0d512222d5257696.exe"C:\Users\Admin\AppData\Local\Temp\00426f4b3edf4a8c0d512222d5257696.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\D79E.exeC:\Users\Admin\AppData\Local\Temp\D79E.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jgEPL904nQ.exe"C:\Users\Admin\AppData\Local\Temp\jgEPL904nQ.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\D79E.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\DC23.exeC:\Users\Admin\AppData\Local\Temp\DC23.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\cffagheC:\Users\Admin\AppData\Roaming\cffaghe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\cffagheC:\Users\Admin\AppData\Roaming\cffaghe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\D79E.exeMD5
6060e81db5d59dd091079fbc044f2ce1
SHA1f5e8fb88273c1098563e99b3255bec516e7eeb19
SHA256603405c0c3b8b1ff41052f7937e10d6bd82852a6e556c41d1d5d2d29bc309335
SHA512bc50c344907cf0be650f9a30a1b41222876469a161a5e44c855d1a2a05d8aa8b8042cf2cef8aa2d403c694449c63f8f1889ea08909be6410663184e4cd67494c
-
C:\Users\Admin\AppData\Local\Temp\D79E.exeMD5
6060e81db5d59dd091079fbc044f2ce1
SHA1f5e8fb88273c1098563e99b3255bec516e7eeb19
SHA256603405c0c3b8b1ff41052f7937e10d6bd82852a6e556c41d1d5d2d29bc309335
SHA512bc50c344907cf0be650f9a30a1b41222876469a161a5e44c855d1a2a05d8aa8b8042cf2cef8aa2d403c694449c63f8f1889ea08909be6410663184e4cd67494c
-
C:\Users\Admin\AppData\Local\Temp\DC23.exeMD5
d454cdca10fb3af83deff9a5b8b9efdd
SHA14506855eeef9b4aff985f6ff5fedf80d8303bc5e
SHA256f9034746e6d31990b45226493bf1df0526b2bc590c68d968f253691458d03328
SHA512fde22bece55aafb84ed81f765da17b8193e68c2a6dbab5376e98aad33e01794db3810dc888ad009d1cf631e086b1db1288091eb1b33eb46c26f1584ea5bf30cc
-
C:\Users\Admin\AppData\Local\Temp\DC23.exeMD5
d454cdca10fb3af83deff9a5b8b9efdd
SHA14506855eeef9b4aff985f6ff5fedf80d8303bc5e
SHA256f9034746e6d31990b45226493bf1df0526b2bc590c68d968f253691458d03328
SHA512fde22bece55aafb84ed81f765da17b8193e68c2a6dbab5376e98aad33e01794db3810dc888ad009d1cf631e086b1db1288091eb1b33eb46c26f1584ea5bf30cc
-
C:\Users\Admin\AppData\Local\Temp\jgEPL904nQ.exeMD5
7c1ef2b9857fd3d2813892277086b2ca
SHA166fdce553852db33c86b8539f497e6ab4f930e87
SHA256253e4e738afb99e9a0ed7e9b92898d653f521b038dba6ea43c5162a23d5388f5
SHA5128c3ee0dee8192f1dc70be5c32117fd5aee24569b4007bb03fdbf95f1db65e6fd0f931b1a531666e0f5d92596740a0fea6559980392d2010880fd4c3f85ea9650
-
C:\Users\Admin\AppData\Local\Temp\jgEPL904nQ.exeMD5
7c1ef2b9857fd3d2813892277086b2ca
SHA166fdce553852db33c86b8539f497e6ab4f930e87
SHA256253e4e738afb99e9a0ed7e9b92898d653f521b038dba6ea43c5162a23d5388f5
SHA5128c3ee0dee8192f1dc70be5c32117fd5aee24569b4007bb03fdbf95f1db65e6fd0f931b1a531666e0f5d92596740a0fea6559980392d2010880fd4c3f85ea9650
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exeMD5
7c1ef2b9857fd3d2813892277086b2ca
SHA166fdce553852db33c86b8539f497e6ab4f930e87
SHA256253e4e738afb99e9a0ed7e9b92898d653f521b038dba6ea43c5162a23d5388f5
SHA5128c3ee0dee8192f1dc70be5c32117fd5aee24569b4007bb03fdbf95f1db65e6fd0f931b1a531666e0f5d92596740a0fea6559980392d2010880fd4c3f85ea9650
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exeMD5
7c1ef2b9857fd3d2813892277086b2ca
SHA166fdce553852db33c86b8539f497e6ab4f930e87
SHA256253e4e738afb99e9a0ed7e9b92898d653f521b038dba6ea43c5162a23d5388f5
SHA5128c3ee0dee8192f1dc70be5c32117fd5aee24569b4007bb03fdbf95f1db65e6fd0f931b1a531666e0f5d92596740a0fea6559980392d2010880fd4c3f85ea9650
-
C:\Users\Admin\AppData\Roaming\cffagheMD5
00426f4b3edf4a8c0d512222d5257696
SHA184de454a9c3910e50048d7555c5836271d638216
SHA256716821b6b210a9c8ae93af80ea648edd2ff944e6221e9900ff805c7df41731c0
SHA5128649faa52f0235c4e07db005cc451fc2ef29cde922899d739ff409d2c8ed6c18c329cd2f349328333c56e3a2bf0686562cb0098f72089a8e98cc4e3386f5905d
-
C:\Users\Admin\AppData\Roaming\cffagheMD5
00426f4b3edf4a8c0d512222d5257696
SHA184de454a9c3910e50048d7555c5836271d638216
SHA256716821b6b210a9c8ae93af80ea648edd2ff944e6221e9900ff805c7df41731c0
SHA5128649faa52f0235c4e07db005cc451fc2ef29cde922899d739ff409d2c8ed6c18c329cd2f349328333c56e3a2bf0686562cb0098f72089a8e98cc4e3386f5905d
-
C:\Users\Admin\AppData\Roaming\cffagheMD5
00426f4b3edf4a8c0d512222d5257696
SHA184de454a9c3910e50048d7555c5836271d638216
SHA256716821b6b210a9c8ae93af80ea648edd2ff944e6221e9900ff805c7df41731c0
SHA5128649faa52f0235c4e07db005cc451fc2ef29cde922899d739ff409d2c8ed6c18c329cd2f349328333c56e3a2bf0686562cb0098f72089a8e98cc4e3386f5905d
-
\Users\Admin\AppData\LocalLow\sqlite3.dllMD5
f964811b68f9f1487c2b41e1aef576ce
SHA1b423959793f14b1416bc3b7051bed58a1034025f
SHA25683bc57dcf282264f2b00c21ce0339eac20fcb7401f7c5472c0cd0c014844e5f7
SHA512565b1a7291c6fcb63205907fcd9e72fc2e11ca945afc4468c378edba882e2f314c2ac21a7263880ff7d4b84c2a1678024c1ac9971ac1c1de2bfa4248ec0f98c4
-
\Users\Admin\AppData\LocalLow\uS0wV5wY9qH3\freebl3.dllMD5
60acd24430204ad2dc7f148b8cfe9bdc
SHA1989f377b9117d7cb21cbe92a4117f88f9c7693d9
SHA2569876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97
SHA512626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01
-
\Users\Admin\AppData\LocalLow\uS0wV5wY9qH3\freebl3.dllMD5
60acd24430204ad2dc7f148b8cfe9bdc
SHA1989f377b9117d7cb21cbe92a4117f88f9c7693d9
SHA2569876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97
SHA512626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01
-
\Users\Admin\AppData\LocalLow\uS0wV5wY9qH3\mozglue.dllMD5
eae9273f8cdcf9321c6c37c244773139
SHA18378e2a2f3635574c106eea8419b5eb00b8489b0
SHA256a0c6630d4012ae0311ff40f4f06911bcf1a23f7a4762ce219b8dffa012d188cc
SHA51206e43e484a89cea9ba9b9519828d38e7c64b040f44cdaeb321cbda574e7551b11fea139ce3538f387a0a39a3d8c4cba7f4cf03e4a3c98db85f8121c2212a9097
-
\Users\Admin\AppData\LocalLow\uS0wV5wY9qH3\nss3.dllMD5
02cc7b8ee30056d5912de54f1bdfc219
SHA1a6923da95705fb81e368ae48f93d28522ef552fb
SHA2561989526553fd1e1e49b0fea8036822ca062d3d39c4cab4a37846173d0f1753d5
SHA5120d5dfcf4fb19b27246fa799e339d67cd1b494427783f379267fb2d10d615ffb734711bab2c515062c078f990a44a36f2d15859b1dacd4143dcc35b5c0cee0ef5
-
\Users\Admin\AppData\LocalLow\uS0wV5wY9qH3\softokn3.dllMD5
4e8df049f3459fa94ab6ad387f3561ac
SHA106ed392bc29ad9d5fc05ee254c2625fd65925114
SHA25625a4dae37120426ab060ebb39b7030b3e7c1093cc34b0877f223b6843b651871
SHA5123dd4a86f83465989b2b30c240a7307edd1b92d5c1d5c57d47eff287dc9daa7bace157017908d82e00be90f08ff5badb68019ffc9d881440229dcea5038f61cd6
-
memory/644-116-0x0000000000820000-0x0000000000829000-memory.dmpFilesize
36KB
-
memory/772-114-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/772-115-0x0000000000402FA5-mapping.dmp
-
memory/1528-125-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB
-
memory/1528-124-0x0000000002140000-0x00000000021D0000-memory.dmpFilesize
576KB
-
memory/1528-118-0x0000000000000000-mapping.dmp
-
memory/1540-148-0x0000000000402FA5-mapping.dmp
-
memory/2252-121-0x0000000000000000-mapping.dmp
-
memory/2252-126-0x0000000002140000-0x00000000021D0000-memory.dmpFilesize
576KB
-
memory/2252-127-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB
-
memory/2420-141-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/2420-140-0x00000000004B0000-0x000000000055E000-memory.dmpFilesize
696KB
-
memory/2420-134-0x0000000000000000-mapping.dmp
-
memory/2680-139-0x0000000000000000-mapping.dmp
-
memory/2844-146-0x0000000000000000-mapping.dmp
-
memory/2984-151-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/2984-150-0x00000000004B0000-0x00000000005FA000-memory.dmpFilesize
1.3MB
-
memory/3092-117-0x0000000000A00000-0x0000000000A16000-memory.dmpFilesize
88KB
-
memory/3092-152-0x0000000002A70000-0x0000000002A86000-memory.dmpFilesize
88KB
-
memory/3976-138-0x0000000000000000-mapping.dmp
-
memory/4020-137-0x0000000000000000-mapping.dmp