Analysis
- max time kernel
159s - max time network
111s - platform
windows10_x64 - resource
win10v20210408 - submitted
27/09/2021, 08:36
Static task
static1
Behavioral task
behavioral1
Sample
dc395f4dd645bcbbe5f0f6ac7d3e7e30.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
General
- Target dc395f4dd645bcbbe5f0f6ac7d3e7e30.exe
- Size 135KB
- Sample210927-khk2vsgbck
- SHA256 fdc36317f82d799e8bb458d13daa364255cda71cde0c0dc1a61c3eff70c2dede
- MD5 dc395f4dd645bcbbe5f0f6ac7d3e7e30
- SHA1 9673a4e12bdac605b92aa0babfdd3bc537e82655
- SHA512 91799469e12d480f0364dbe7bf74e320b17e2c641f00eb86ca272a88195421976f5f2f3615cd6866746b26e3e24650279fad8a3ee9d1f0ec0f6e6842aa4a12ea
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://govsurplusstore.com/upload/
-
http://best-forsale.com/upload/
-
http://chmxnautoparts.com/upload/
-
http://kwazone.com/upload/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious
suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
pid Process 2640 FBD0.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion FBD0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion FBD0.exe - Deletes itself 1 IoCs
pid Process 3020 Process not Found - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/files/0x000300000001ab2f-118.dat themida behavioral2/memory/2640-120-0x0000000000310000-0x0000000000311000-memory.dmp themida - Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA FBD0.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2640 FBD0.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dc395f4dd645bcbbe5f0f6ac7d3e7e30.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dc395f4dd645bcbbe5f0f6ac7d3e7e30.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dc395f4dd645bcbbe5f0f6ac7d3e7e30.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Process not Found Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Process not Found - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 656 dc395f4dd645bcbbe5f0f6ac7d3e7e30.exe 656 dc395f4dd645bcbbe5f0f6ac7d3e7e30.exe 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3020 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 656 dc395f4dd645bcbbe5f0f6ac7d3e7e30.exe - Suspicious use of AdjustPrivilegeToken 27 IoCs
description pid Process Token: SeShutdownPrivilege 3020 Process not Found Token: SeCreatePagefilePrivilege 3020 Process not Found Token: SeShutdownPrivilege 3020 Process not Found Token: SeCreatePagefilePrivilege 3020 Process not Found Token: SeShutdownPrivilege 3020 Process not Found Token: SeCreatePagefilePrivilege 3020 Process not Found Token: SeShutdownPrivilege 3020 Process not Found Token: SeCreatePagefilePrivilege 3020 Process not Found Token: SeShutdownPrivilege 3020 Process not Found Token: SeCreatePagefilePrivilege 3020 Process not Found Token: SeShutdownPrivilege 3020 Process not Found Token: SeCreatePagefilePrivilege 3020 Process not Found Token: SeShutdownPrivilege 3020 Process not Found Token: SeCreatePagefilePrivilege 3020 Process not Found Token: SeDebugPrivilege 2640 FBD0.exe Token: SeShutdownPrivilege 3020 Process not Found Token: SeCreatePagefilePrivilege 3020 Process not Found Token: SeShutdownPrivilege 3020 Process not Found Token: SeCreatePagefilePrivilege 3020 Process not Found Token: SeShutdownPrivilege 3020 Process not Found Token: SeCreatePagefilePrivilege 3020 Process not Found Token: SeShutdownPrivilege 3020 Process not Found Token: SeCreatePagefilePrivilege 3020 Process not Found Token: SeShutdownPrivilege 3020 Process not Found Token: SeCreatePagefilePrivilege 3020 Process not Found Token: SeShutdownPrivilege 3020 Process not Found Token: SeCreatePagefilePrivilege 3020 Process not Found - Suspicious use of FindShellTrayWindow 10 IoCs
pid Process 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found - Suspicious use of SendNotifyMessage 5 IoCs
pid Process 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3020 wrote to memory of 2640 3020 Process not Found 74 PID 3020 wrote to memory of 2640 3020 Process not Found 74 PID 3020 wrote to memory of 2640 3020 Process not Found 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc395f4dd645bcbbe5f0f6ac7d3e7e30.exe"C:\Users\Admin\AppData\Local\Temp\dc395f4dd645bcbbe5f0f6ac7d3e7e30.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:656
-
C:\Users\Admin\AppData\Local\Temp\FBD0.exeC:\Users\Admin\AppData\Local\Temp\FBD0.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2640