Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
26-09-2021 05:38
Static task
static1
Behavioral task
behavioral1
Sample
c4776d0c137ffdd7c1961d39d00c47625b56aa259391d042ab19bba938225653.exe
Resource
win10-en-20210920
General
-
Target
c4776d0c137ffdd7c1961d39d00c47625b56aa259391d042ab19bba938225653.exe
-
Size
145KB
-
MD5
02d4f0634b7dddcc91864649c92885fa
-
SHA1
f033b5245a2c7591cf37a56b37a7c587f313af97
-
SHA256
c4776d0c137ffdd7c1961d39d00c47625b56aa259391d042ab19bba938225653
-
SHA512
ec5299f39da5899a9222a83c197a7ecd77dbbbf49ac8975f8793fc2021e669b7e563aa5ac83822f464c6dcd43e2d6b1c1216f3ac6dc0602575fd090a8343ce16
Malware Config
Extracted
smokeloader
2020
http://naghenrietti1.top/
http://kimballiett2.top/
http://xadriettany3.top/
http://jebeccallis4.top/
http://nityanneron5.top/
http://umayaniela6.top/
http://lynettaram7.top/
http://sadineyalas8.top/
http://geenaldencia9.top/
http://aradysiusep10.top/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 2 IoCs
Processes:
hgdjwvfhgdjwvfpid process 460 hgdjwvf 1432 hgdjwvf -
Deletes itself 1 IoCs
Processes:
pid process 2648 -
Suspicious use of SetThreadContext 2 IoCs
Processes:
c4776d0c137ffdd7c1961d39d00c47625b56aa259391d042ab19bba938225653.exehgdjwvfdescription pid process target process PID 2068 set thread context of 2188 2068 c4776d0c137ffdd7c1961d39d00c47625b56aa259391d042ab19bba938225653.exe c4776d0c137ffdd7c1961d39d00c47625b56aa259391d042ab19bba938225653.exe PID 460 set thread context of 1432 460 hgdjwvf hgdjwvf -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
hgdjwvfc4776d0c137ffdd7c1961d39d00c47625b56aa259391d042ab19bba938225653.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hgdjwvf Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hgdjwvf Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hgdjwvf Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c4776d0c137ffdd7c1961d39d00c47625b56aa259391d042ab19bba938225653.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c4776d0c137ffdd7c1961d39d00c47625b56aa259391d042ab19bba938225653.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c4776d0c137ffdd7c1961d39d00c47625b56aa259391d042ab19bba938225653.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
c4776d0c137ffdd7c1961d39d00c47625b56aa259391d042ab19bba938225653.exepid process 2188 c4776d0c137ffdd7c1961d39d00c47625b56aa259391d042ab19bba938225653.exe 2188 c4776d0c137ffdd7c1961d39d00c47625b56aa259391d042ab19bba938225653.exe 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 2648 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2648 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
c4776d0c137ffdd7c1961d39d00c47625b56aa259391d042ab19bba938225653.exehgdjwvfpid process 2188 c4776d0c137ffdd7c1961d39d00c47625b56aa259391d042ab19bba938225653.exe 1432 hgdjwvf -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 2648 Token: SeCreatePagefilePrivilege 2648 -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
c4776d0c137ffdd7c1961d39d00c47625b56aa259391d042ab19bba938225653.exehgdjwvfdescription pid process target process PID 2068 wrote to memory of 2188 2068 c4776d0c137ffdd7c1961d39d00c47625b56aa259391d042ab19bba938225653.exe c4776d0c137ffdd7c1961d39d00c47625b56aa259391d042ab19bba938225653.exe PID 2068 wrote to memory of 2188 2068 c4776d0c137ffdd7c1961d39d00c47625b56aa259391d042ab19bba938225653.exe c4776d0c137ffdd7c1961d39d00c47625b56aa259391d042ab19bba938225653.exe PID 2068 wrote to memory of 2188 2068 c4776d0c137ffdd7c1961d39d00c47625b56aa259391d042ab19bba938225653.exe c4776d0c137ffdd7c1961d39d00c47625b56aa259391d042ab19bba938225653.exe PID 2068 wrote to memory of 2188 2068 c4776d0c137ffdd7c1961d39d00c47625b56aa259391d042ab19bba938225653.exe c4776d0c137ffdd7c1961d39d00c47625b56aa259391d042ab19bba938225653.exe PID 2068 wrote to memory of 2188 2068 c4776d0c137ffdd7c1961d39d00c47625b56aa259391d042ab19bba938225653.exe c4776d0c137ffdd7c1961d39d00c47625b56aa259391d042ab19bba938225653.exe PID 2068 wrote to memory of 2188 2068 c4776d0c137ffdd7c1961d39d00c47625b56aa259391d042ab19bba938225653.exe c4776d0c137ffdd7c1961d39d00c47625b56aa259391d042ab19bba938225653.exe PID 460 wrote to memory of 1432 460 hgdjwvf hgdjwvf PID 460 wrote to memory of 1432 460 hgdjwvf hgdjwvf PID 460 wrote to memory of 1432 460 hgdjwvf hgdjwvf PID 460 wrote to memory of 1432 460 hgdjwvf hgdjwvf PID 460 wrote to memory of 1432 460 hgdjwvf hgdjwvf PID 460 wrote to memory of 1432 460 hgdjwvf hgdjwvf
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4776d0c137ffdd7c1961d39d00c47625b56aa259391d042ab19bba938225653.exe"C:\Users\Admin\AppData\Local\Temp\c4776d0c137ffdd7c1961d39d00c47625b56aa259391d042ab19bba938225653.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c4776d0c137ffdd7c1961d39d00c47625b56aa259391d042ab19bba938225653.exe"C:\Users\Admin\AppData\Local\Temp\c4776d0c137ffdd7c1961d39d00c47625b56aa259391d042ab19bba938225653.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\hgdjwvfC:\Users\Admin\AppData\Roaming\hgdjwvf1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\hgdjwvfC:\Users\Admin\AppData\Roaming\hgdjwvf2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\hgdjwvfMD5
02d4f0634b7dddcc91864649c92885fa
SHA1f033b5245a2c7591cf37a56b37a7c587f313af97
SHA256c4776d0c137ffdd7c1961d39d00c47625b56aa259391d042ab19bba938225653
SHA512ec5299f39da5899a9222a83c197a7ecd77dbbbf49ac8975f8793fc2021e669b7e563aa5ac83822f464c6dcd43e2d6b1c1216f3ac6dc0602575fd090a8343ce16
-
C:\Users\Admin\AppData\Roaming\hgdjwvfMD5
02d4f0634b7dddcc91864649c92885fa
SHA1f033b5245a2c7591cf37a56b37a7c587f313af97
SHA256c4776d0c137ffdd7c1961d39d00c47625b56aa259391d042ab19bba938225653
SHA512ec5299f39da5899a9222a83c197a7ecd77dbbbf49ac8975f8793fc2021e669b7e563aa5ac83822f464c6dcd43e2d6b1c1216f3ac6dc0602575fd090a8343ce16
-
C:\Users\Admin\AppData\Roaming\hgdjwvfMD5
02d4f0634b7dddcc91864649c92885fa
SHA1f033b5245a2c7591cf37a56b37a7c587f313af97
SHA256c4776d0c137ffdd7c1961d39d00c47625b56aa259391d042ab19bba938225653
SHA512ec5299f39da5899a9222a83c197a7ecd77dbbbf49ac8975f8793fc2021e669b7e563aa5ac83822f464c6dcd43e2d6b1c1216f3ac6dc0602575fd090a8343ce16
-
memory/1432-122-0x0000000000402FA5-mapping.dmp
-
memory/2068-117-0x0000000000500000-0x0000000000509000-memory.dmpFilesize
36KB
-
memory/2188-115-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2188-116-0x0000000000402FA5-mapping.dmp
-
memory/2648-118-0x0000000000B70000-0x0000000000B86000-memory.dmpFilesize
88KB
-
memory/2648-124-0x0000000000BA0000-0x0000000000BB6000-memory.dmpFilesize
88KB