Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
26-09-2021 04:57
Static task
static1
Behavioral task
behavioral1
Sample
5b009c8b072d2343573044ee5dbc7839b50747afd04c796cff0f9a5e36c329ed.exe
Resource
win10-en-20210920
General
-
Target
5b009c8b072d2343573044ee5dbc7839b50747afd04c796cff0f9a5e36c329ed.exe
-
Size
145KB
-
MD5
632d6ec7729fbaaa4bcdf1a91fb9f7b5
-
SHA1
f41a5c62399a1807346f7a9f59b1b207843383f1
-
SHA256
5b009c8b072d2343573044ee5dbc7839b50747afd04c796cff0f9a5e36c329ed
-
SHA512
c5b202422c844f7bf02b5ef46910127f9d5eed005608f6b7a8883e9f9f45babf1e3ce672d49c45946a5f1c2358ef29488eb2a7e6f97c37562bafd3e6d79b5afd
Malware Config
Extracted
smokeloader
2020
http://naghenrietti1.top/
http://kimballiett2.top/
http://xadriettany3.top/
http://jebeccallis4.top/
http://nityanneron5.top/
http://umayaniela6.top/
http://lynettaram7.top/
http://sadineyalas8.top/
http://geenaldencia9.top/
http://aradysiusep10.top/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3028 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5b009c8b072d2343573044ee5dbc7839b50747afd04c796cff0f9a5e36c329ed.exedescription pid process target process PID 2428 set thread context of 2636 2428 5b009c8b072d2343573044ee5dbc7839b50747afd04c796cff0f9a5e36c329ed.exe 5b009c8b072d2343573044ee5dbc7839b50747afd04c796cff0f9a5e36c329ed.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
5b009c8b072d2343573044ee5dbc7839b50747afd04c796cff0f9a5e36c329ed.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5b009c8b072d2343573044ee5dbc7839b50747afd04c796cff0f9a5e36c329ed.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5b009c8b072d2343573044ee5dbc7839b50747afd04c796cff0f9a5e36c329ed.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5b009c8b072d2343573044ee5dbc7839b50747afd04c796cff0f9a5e36c329ed.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
5b009c8b072d2343573044ee5dbc7839b50747afd04c796cff0f9a5e36c329ed.exepid process 2636 5b009c8b072d2343573044ee5dbc7839b50747afd04c796cff0f9a5e36c329ed.exe 2636 5b009c8b072d2343573044ee5dbc7839b50747afd04c796cff0f9a5e36c329ed.exe 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3028 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
5b009c8b072d2343573044ee5dbc7839b50747afd04c796cff0f9a5e36c329ed.exepid process 2636 5b009c8b072d2343573044ee5dbc7839b50747afd04c796cff0f9a5e36c329ed.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
5b009c8b072d2343573044ee5dbc7839b50747afd04c796cff0f9a5e36c329ed.exedescription pid process target process PID 2428 wrote to memory of 2636 2428 5b009c8b072d2343573044ee5dbc7839b50747afd04c796cff0f9a5e36c329ed.exe 5b009c8b072d2343573044ee5dbc7839b50747afd04c796cff0f9a5e36c329ed.exe PID 2428 wrote to memory of 2636 2428 5b009c8b072d2343573044ee5dbc7839b50747afd04c796cff0f9a5e36c329ed.exe 5b009c8b072d2343573044ee5dbc7839b50747afd04c796cff0f9a5e36c329ed.exe PID 2428 wrote to memory of 2636 2428 5b009c8b072d2343573044ee5dbc7839b50747afd04c796cff0f9a5e36c329ed.exe 5b009c8b072d2343573044ee5dbc7839b50747afd04c796cff0f9a5e36c329ed.exe PID 2428 wrote to memory of 2636 2428 5b009c8b072d2343573044ee5dbc7839b50747afd04c796cff0f9a5e36c329ed.exe 5b009c8b072d2343573044ee5dbc7839b50747afd04c796cff0f9a5e36c329ed.exe PID 2428 wrote to memory of 2636 2428 5b009c8b072d2343573044ee5dbc7839b50747afd04c796cff0f9a5e36c329ed.exe 5b009c8b072d2343573044ee5dbc7839b50747afd04c796cff0f9a5e36c329ed.exe PID 2428 wrote to memory of 2636 2428 5b009c8b072d2343573044ee5dbc7839b50747afd04c796cff0f9a5e36c329ed.exe 5b009c8b072d2343573044ee5dbc7839b50747afd04c796cff0f9a5e36c329ed.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b009c8b072d2343573044ee5dbc7839b50747afd04c796cff0f9a5e36c329ed.exe"C:\Users\Admin\AppData\Local\Temp\5b009c8b072d2343573044ee5dbc7839b50747afd04c796cff0f9a5e36c329ed.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5b009c8b072d2343573044ee5dbc7839b50747afd04c796cff0f9a5e36c329ed.exe"C:\Users\Admin\AppData\Local\Temp\5b009c8b072d2343573044ee5dbc7839b50747afd04c796cff0f9a5e36c329ed.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2428-117-0x00000000001D0000-0x00000000001D9000-memory.dmpFilesize
36KB
-
memory/2636-115-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2636-116-0x0000000000402FA5-mapping.dmp
-
memory/3028-118-0x0000000000EB0000-0x0000000000EC6000-memory.dmpFilesize
88KB