Analysis
-
max time kernel
151s -
max time network
116s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
26-09-2021 07:48
Static task
static1
Behavioral task
behavioral1
Sample
858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e.exe
Resource
win10-en-20210920
General
-
Target
858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e.exe
-
Size
145KB
-
MD5
924b06fed5002d7dbc6004401b7a519f
-
SHA1
669962749b03a129e44c6eec9ef2804ec31493f4
-
SHA256
858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e
-
SHA512
7b9e2c6765077ebe4e438e86f805792b02e18e2cc4519184c80db4a975db40dec9969a950451f1cdce95a0648f8ff2347fce619e8b40551319ee69e5f577b486
Malware Config
Extracted
smokeloader
2020
http://naghenrietti1.top/
http://kimballiett2.top/
http://xadriettany3.top/
http://jebeccallis4.top/
http://nityanneron5.top/
http://umayaniela6.top/
http://lynettaram7.top/
http://sadineyalas8.top/
http://geenaldencia9.top/
http://aradysiusep10.top/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 2 IoCs
Processes:
uhabdgauhabdgapid process 760 uhabdga 700 uhabdga -
Deletes itself 1 IoCs
Processes:
pid process 2712 -
Suspicious use of SetThreadContext 2 IoCs
Processes:
858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e.exeuhabdgadescription pid process target process PID 3512 set thread context of 3640 3512 858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e.exe 858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e.exe PID 760 set thread context of 700 760 uhabdga uhabdga -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e.exeuhabdgadescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI uhabdga Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI uhabdga Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI uhabdga -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e.exepid process 3640 858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e.exe 3640 858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e.exe 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 2712 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2712 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e.exeuhabdgapid process 3640 858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e.exe 700 uhabdga -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 2712 Token: SeCreatePagefilePrivilege 2712 -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e.exeuhabdgadescription pid process target process PID 3512 wrote to memory of 3640 3512 858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e.exe 858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e.exe PID 3512 wrote to memory of 3640 3512 858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e.exe 858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e.exe PID 3512 wrote to memory of 3640 3512 858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e.exe 858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e.exe PID 3512 wrote to memory of 3640 3512 858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e.exe 858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e.exe PID 3512 wrote to memory of 3640 3512 858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e.exe 858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e.exe PID 3512 wrote to memory of 3640 3512 858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e.exe 858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e.exe PID 760 wrote to memory of 700 760 uhabdga uhabdga PID 760 wrote to memory of 700 760 uhabdga uhabdga PID 760 wrote to memory of 700 760 uhabdga uhabdga PID 760 wrote to memory of 700 760 uhabdga uhabdga PID 760 wrote to memory of 700 760 uhabdga uhabdga PID 760 wrote to memory of 700 760 uhabdga uhabdga
Processes
-
C:\Users\Admin\AppData\Local\Temp\858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e.exe"C:\Users\Admin\AppData\Local\Temp\858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e.exe"C:\Users\Admin\AppData\Local\Temp\858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\uhabdgaC:\Users\Admin\AppData\Roaming\uhabdga1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\uhabdgaC:\Users\Admin\AppData\Roaming\uhabdga2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\uhabdgaMD5
924b06fed5002d7dbc6004401b7a519f
SHA1669962749b03a129e44c6eec9ef2804ec31493f4
SHA256858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e
SHA5127b9e2c6765077ebe4e438e86f805792b02e18e2cc4519184c80db4a975db40dec9969a950451f1cdce95a0648f8ff2347fce619e8b40551319ee69e5f577b486
-
C:\Users\Admin\AppData\Roaming\uhabdgaMD5
924b06fed5002d7dbc6004401b7a519f
SHA1669962749b03a129e44c6eec9ef2804ec31493f4
SHA256858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e
SHA5127b9e2c6765077ebe4e438e86f805792b02e18e2cc4519184c80db4a975db40dec9969a950451f1cdce95a0648f8ff2347fce619e8b40551319ee69e5f577b486
-
C:\Users\Admin\AppData\Roaming\uhabdgaMD5
924b06fed5002d7dbc6004401b7a519f
SHA1669962749b03a129e44c6eec9ef2804ec31493f4
SHA256858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e
SHA5127b9e2c6765077ebe4e438e86f805792b02e18e2cc4519184c80db4a975db40dec9969a950451f1cdce95a0648f8ff2347fce619e8b40551319ee69e5f577b486
-
memory/700-123-0x0000000000402FA5-mapping.dmp
-
memory/760-125-0x00000000004B0000-0x000000000055E000-memory.dmpFilesize
696KB
-
memory/2712-119-0x00000000003A0000-0x00000000003B6000-memory.dmpFilesize
88KB
-
memory/2712-126-0x0000000000600000-0x0000000000616000-memory.dmpFilesize
88KB
-
memory/3512-116-0x00000000001D0000-0x00000000001D9000-memory.dmpFilesize
36KB
-
memory/3640-117-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3640-118-0x0000000000402FA5-mapping.dmp