Analysis

  • max time kernel
    150s
  • max time network
    54s
  • platform
    windows7_x64
  • resource
    win7-en-20210920
  • submitted
    29-09-2021 03:16

General

  • Target

    f8c9d11a8316183bc3c137f9e1d452c7.exe

  • Size

    233KB

  • MD5

    f8c9d11a8316183bc3c137f9e1d452c7

  • SHA1

    a32a7b8ca21bc1da2ccd397e88fcb589b41a81e4

  • SHA256

    897bb67dac34904d72e20fb6b62feb31c86575107563db56535c38d81eec56aa

  • SHA512

    0e5435387b765b38f3f3198b1a1a13c66cecb791129becb7187a1b3bfa98d603b3923f92e8ff1bb26ca69151c1fcb9ea4c1ea0d95492f14d552861fcb8102ae8

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://naghenrietti1.top/

http://kimballiett2.top/

http://xadriettany3.top/

http://jebeccallis4.top/

http://nityanneron5.top/

http://umayaniela6.top/

http://lynettaram7.top/

http://sadineyalas8.top/

http://geenaldencia9.top/

http://aradysiusep10.top/

rc4.i32
1
0x33f8f0d2
rc4.i32
1
0xaa0488bb

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f8c9d11a8316183bc3c137f9e1d452c7.exe
    "C:\Users\Admin\AppData\Local\Temp\f8c9d11a8316183bc3c137f9e1d452c7.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1272
    • C:\Users\Admin\AppData\Local\Temp\f8c9d11a8316183bc3c137f9e1d452c7.exe
      "C:\Users\Admin\AppData\Local\Temp\f8c9d11a8316183bc3c137f9e1d452c7.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:1328

Network

  • flag-us
    DNS
    naghenrietti1.top
    Remote address:
    8.8.8.8:53
    Request
    naghenrietti1.top
    IN A
    Response
  • flag-us
    DNS
    kimballiett2.top
    Remote address:
    8.8.8.8:53
    Request
    kimballiett2.top
    IN A
    Response
  • flag-us
    DNS
    xadriettany3.top
    Remote address:
    8.8.8.8:53
    Request
    xadriettany3.top
    IN A
    Response
  • flag-us
    DNS
    jebeccallis4.top
    Remote address:
    8.8.8.8:53
    Request
    jebeccallis4.top
    IN A
    Response
  • flag-us
    DNS
    nityanneron5.top
    Remote address:
    8.8.8.8:53
    Request
    nityanneron5.top
    IN A
    Response
  • flag-us
    DNS
    umayaniela6.top
    Remote address:
    8.8.8.8:53
    Request
    umayaniela6.top
    IN A
    Response
  • flag-us
    DNS
    umayaniela6.top
    Remote address:
    8.8.8.8:53
    Request
    umayaniela6.top
    IN A
    Response
  • flag-us
    DNS
    lynettaram7.top
    Remote address:
    8.8.8.8:53
    Request
    lynettaram7.top
    IN A
    Response
  • flag-us
    DNS
    sadineyalas8.top
    Remote address:
    8.8.8.8:53
    Request
    sadineyalas8.top
    IN A
    Response
  • flag-us
    DNS
    geenaldencia9.top
    Remote address:
    8.8.8.8:53
    Request
    geenaldencia9.top
    IN A
    Response
    geenaldencia9.top
    IN A
    194.87.210.36
  • flag-us
    DNS
    aradysiusep10.top
    Remote address:
    8.8.8.8:53
    Request
    aradysiusep10.top
    IN A
    Response
  • 194.87.210.36:80
    geenaldencia9.top
    152 B
    3
  • 8.8.8.8:53
    naghenrietti1.top
    dns
    63 B
    133 B
    1
    1

    DNS Request

    naghenrietti1.top

  • 8.8.8.8:53
    kimballiett2.top
    dns
    62 B
    132 B
    1
    1

    DNS Request

    kimballiett2.top

  • 8.8.8.8:53
    xadriettany3.top
    dns
    62 B
    132 B
    1
    1

    DNS Request

    xadriettany3.top

  • 8.8.8.8:53
    jebeccallis4.top
    dns
    62 B
    132 B
    1
    1

    DNS Request

    jebeccallis4.top

  • 8.8.8.8:53
    nityanneron5.top
    dns
    62 B
    132 B
    1
    1

    DNS Request

    nityanneron5.top

  • 8.8.8.8:53
    umayaniela6.top
    dns
    122 B
    122 B
    2
    2

    DNS Request

    umayaniela6.top

    DNS Request

    umayaniela6.top

  • 8.8.8.8:53
    lynettaram7.top
    dns
    61 B
    131 B
    1
    1

    DNS Request

    lynettaram7.top

  • 8.8.8.8:53
    sadineyalas8.top
    dns
    62 B
    132 B
    1
    1

    DNS Request

    sadineyalas8.top

  • 8.8.8.8:53
    geenaldencia9.top
    dns
    63 B
    79 B
    1
    1

    DNS Request

    geenaldencia9.top

    DNS Response

    194.87.210.36

  • 8.8.8.8:53
    aradysiusep10.top
    dns
    63 B
    133 B
    1
    1

    DNS Request

    aradysiusep10.top

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1216-57-0x00000000029D0000-0x00000000029E6000-memory.dmp

    Filesize

    88KB

  • memory/1272-56-0x0000000000020000-0x0000000000029000-memory.dmp

    Filesize

    36KB

  • memory/1328-53-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/1328-55-0x0000000075331000-0x0000000075333000-memory.dmp

    Filesize

    8KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.