Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
26-09-2021 07:43
Static task
static1
Behavioral task
behavioral1
Sample
e15b4e93e703cb313a1e2e0421da0db3a8345a5b87d3908ae9564d2ccae7a45b.exe
Resource
win10-en-20210920
General
-
Target
e15b4e93e703cb313a1e2e0421da0db3a8345a5b87d3908ae9564d2ccae7a45b.exe
-
Size
146KB
-
MD5
a2c3621da84721bdf0694d6b9385502a
-
SHA1
3b13e4d0900463e4369ec2e71526d3efbdc53211
-
SHA256
e15b4e93e703cb313a1e2e0421da0db3a8345a5b87d3908ae9564d2ccae7a45b
-
SHA512
c8bccc204403d42dfb8fa67b91818a53c40924b9a5be9c2490a85a97fe12e8a44c5510b40231a2dacc4b55e253bda238c42bdcfeac4b892487b35b43d08fca17
Malware Config
Extracted
smokeloader
2020
http://naghenrietti1.top/
http://kimballiett2.top/
http://xadriettany3.top/
http://jebeccallis4.top/
http://nityanneron5.top/
http://umayaniela6.top/
http://lynettaram7.top/
http://sadineyalas8.top/
http://geenaldencia9.top/
http://aradysiusep10.top/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1588 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
e15b4e93e703cb313a1e2e0421da0db3a8345a5b87d3908ae9564d2ccae7a45b.exedescription pid process target process PID 2384 set thread context of 2424 2384 e15b4e93e703cb313a1e2e0421da0db3a8345a5b87d3908ae9564d2ccae7a45b.exe e15b4e93e703cb313a1e2e0421da0db3a8345a5b87d3908ae9564d2ccae7a45b.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
e15b4e93e703cb313a1e2e0421da0db3a8345a5b87d3908ae9564d2ccae7a45b.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e15b4e93e703cb313a1e2e0421da0db3a8345a5b87d3908ae9564d2ccae7a45b.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e15b4e93e703cb313a1e2e0421da0db3a8345a5b87d3908ae9564d2ccae7a45b.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e15b4e93e703cb313a1e2e0421da0db3a8345a5b87d3908ae9564d2ccae7a45b.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e15b4e93e703cb313a1e2e0421da0db3a8345a5b87d3908ae9564d2ccae7a45b.exepid process 2424 e15b4e93e703cb313a1e2e0421da0db3a8345a5b87d3908ae9564d2ccae7a45b.exe 2424 e15b4e93e703cb313a1e2e0421da0db3a8345a5b87d3908ae9564d2ccae7a45b.exe 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 1588 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1588 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
e15b4e93e703cb313a1e2e0421da0db3a8345a5b87d3908ae9564d2ccae7a45b.exepid process 2424 e15b4e93e703cb313a1e2e0421da0db3a8345a5b87d3908ae9564d2ccae7a45b.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
e15b4e93e703cb313a1e2e0421da0db3a8345a5b87d3908ae9564d2ccae7a45b.exedescription pid process target process PID 2384 wrote to memory of 2424 2384 e15b4e93e703cb313a1e2e0421da0db3a8345a5b87d3908ae9564d2ccae7a45b.exe e15b4e93e703cb313a1e2e0421da0db3a8345a5b87d3908ae9564d2ccae7a45b.exe PID 2384 wrote to memory of 2424 2384 e15b4e93e703cb313a1e2e0421da0db3a8345a5b87d3908ae9564d2ccae7a45b.exe e15b4e93e703cb313a1e2e0421da0db3a8345a5b87d3908ae9564d2ccae7a45b.exe PID 2384 wrote to memory of 2424 2384 e15b4e93e703cb313a1e2e0421da0db3a8345a5b87d3908ae9564d2ccae7a45b.exe e15b4e93e703cb313a1e2e0421da0db3a8345a5b87d3908ae9564d2ccae7a45b.exe PID 2384 wrote to memory of 2424 2384 e15b4e93e703cb313a1e2e0421da0db3a8345a5b87d3908ae9564d2ccae7a45b.exe e15b4e93e703cb313a1e2e0421da0db3a8345a5b87d3908ae9564d2ccae7a45b.exe PID 2384 wrote to memory of 2424 2384 e15b4e93e703cb313a1e2e0421da0db3a8345a5b87d3908ae9564d2ccae7a45b.exe e15b4e93e703cb313a1e2e0421da0db3a8345a5b87d3908ae9564d2ccae7a45b.exe PID 2384 wrote to memory of 2424 2384 e15b4e93e703cb313a1e2e0421da0db3a8345a5b87d3908ae9564d2ccae7a45b.exe e15b4e93e703cb313a1e2e0421da0db3a8345a5b87d3908ae9564d2ccae7a45b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e15b4e93e703cb313a1e2e0421da0db3a8345a5b87d3908ae9564d2ccae7a45b.exe"C:\Users\Admin\AppData\Local\Temp\e15b4e93e703cb313a1e2e0421da0db3a8345a5b87d3908ae9564d2ccae7a45b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e15b4e93e703cb313a1e2e0421da0db3a8345a5b87d3908ae9564d2ccae7a45b.exe"C:\Users\Admin\AppData\Local\Temp\e15b4e93e703cb313a1e2e0421da0db3a8345a5b87d3908ae9564d2ccae7a45b.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1588-118-0x0000000000880000-0x0000000000896000-memory.dmpFilesize
88KB
-
memory/2384-117-0x00000000005E0000-0x000000000072A000-memory.dmpFilesize
1.3MB
-
memory/2424-115-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2424-116-0x0000000000402FA5-mapping.dmp