Analysis
-
max time kernel
152s -
max time network
148s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
26-09-2021 06:11
Static task
static1
Behavioral task
behavioral1
Sample
f9702ef18e2d257a34d1fbdd886ca26e.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
f9702ef18e2d257a34d1fbdd886ca26e.exe
Resource
win10-en-20210920
General
-
Target
f9702ef18e2d257a34d1fbdd886ca26e.exe
-
Size
149KB
-
MD5
f9702ef18e2d257a34d1fbdd886ca26e
-
SHA1
829f78ed4b6465ac8fd68ed8e0b3aa276e01a92d
-
SHA256
fa36cff7b919fb2f6e55059a14fccff00670687108f6f3fb736e8629ef6a7828
-
SHA512
efc50fde5d6a1f7a0930829bc39ca8d851b5c2b4b56fe444f9efe6448a57cf7bf9a63726995f9cdc7353c62e5d2d06a7a8e8f9da40769e1ce72611aab215128e
Malware Config
Extracted
smokeloader
2020
http://naghenrietti1.top/
http://kimballiett2.top/
http://xadriettany3.top/
http://jebeccallis4.top/
http://nityanneron5.top/
http://umayaniela6.top/
http://lynettaram7.top/
http://sadineyalas8.top/
http://geenaldencia9.top/
http://aradysiusep10.top/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1336 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f9702ef18e2d257a34d1fbdd886ca26e.exedescription pid process target process PID 1116 set thread context of 832 1116 f9702ef18e2d257a34d1fbdd886ca26e.exe f9702ef18e2d257a34d1fbdd886ca26e.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
f9702ef18e2d257a34d1fbdd886ca26e.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f9702ef18e2d257a34d1fbdd886ca26e.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f9702ef18e2d257a34d1fbdd886ca26e.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f9702ef18e2d257a34d1fbdd886ca26e.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
f9702ef18e2d257a34d1fbdd886ca26e.exepid process 832 f9702ef18e2d257a34d1fbdd886ca26e.exe 832 f9702ef18e2d257a34d1fbdd886ca26e.exe 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 1336 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1336 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
f9702ef18e2d257a34d1fbdd886ca26e.exepid process 832 f9702ef18e2d257a34d1fbdd886ca26e.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
pid process 1336 1336 1336 1336 1336 1336 -
Suspicious use of SendNotifyMessage 6 IoCs
Processes:
pid process 1336 1336 1336 1336 1336 1336 -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
f9702ef18e2d257a34d1fbdd886ca26e.exedescription pid process target process PID 1116 wrote to memory of 832 1116 f9702ef18e2d257a34d1fbdd886ca26e.exe f9702ef18e2d257a34d1fbdd886ca26e.exe PID 1116 wrote to memory of 832 1116 f9702ef18e2d257a34d1fbdd886ca26e.exe f9702ef18e2d257a34d1fbdd886ca26e.exe PID 1116 wrote to memory of 832 1116 f9702ef18e2d257a34d1fbdd886ca26e.exe f9702ef18e2d257a34d1fbdd886ca26e.exe PID 1116 wrote to memory of 832 1116 f9702ef18e2d257a34d1fbdd886ca26e.exe f9702ef18e2d257a34d1fbdd886ca26e.exe PID 1116 wrote to memory of 832 1116 f9702ef18e2d257a34d1fbdd886ca26e.exe f9702ef18e2d257a34d1fbdd886ca26e.exe PID 1116 wrote to memory of 832 1116 f9702ef18e2d257a34d1fbdd886ca26e.exe f9702ef18e2d257a34d1fbdd886ca26e.exe PID 1116 wrote to memory of 832 1116 f9702ef18e2d257a34d1fbdd886ca26e.exe f9702ef18e2d257a34d1fbdd886ca26e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9702ef18e2d257a34d1fbdd886ca26e.exe"C:\Users\Admin\AppData\Local\Temp\f9702ef18e2d257a34d1fbdd886ca26e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f9702ef18e2d257a34d1fbdd886ca26e.exe"C:\Users\Admin\AppData\Local\Temp\f9702ef18e2d257a34d1fbdd886ca26e.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/832-54-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/832-55-0x0000000000402FA5-mapping.dmp
-
memory/832-57-0x0000000075BF1000-0x0000000075BF3000-memory.dmpFilesize
8KB
-
memory/1116-56-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/1336-58-0x00000000026A0000-0x00000000026B6000-memory.dmpFilesize
88KB