Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
30-09-2021 03:01
Static task
static1
Behavioral task
behavioral1
Sample
539cd7419efcd8142d20462511e931d3.exe
Resource
win7v20210408
gozi_rm3raccoonredlinesmokeloadertofseexmrig5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4rsecond build backdoorbankerdiscoveryevasioninfostealerminerpersistencespywarestealerthemidatrojan
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
539cd7419efcd8142d20462511e931d3.exe
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
General
-
Target
539cd7419efcd8142d20462511e931d3.exe
-
Size
240KB
-
MD5
539cd7419efcd8142d20462511e931d3
-
SHA1
2faf7df4c337ab8a4136560fd4b6fa0df8085bf7
-
SHA256
4ba939154ee9df1004629da3aee541a36eb4faabe421190ddbbbf1ccd195e03a
-
SHA512
a3ee44f0d4af926d6327af02229941e348fadc5d18d7d2b3278c3e6d3ee585af5c8f5be13fa89cd247dadf241ba08fce7c8c6e11d8959461d49305d38009ca45
Score
10/10
Malware Config
Extracted
Family
smokeloader
Version
2020
C2
http://fiskahlilian16.top/
http://paishancho17.top/
http://ydiannetter18.top/
http://azarehanelle19.top/
http://quericeriant20.top/
rc4.i32
rc4.i32
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
pid Process 3008 Process not Found -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2352 set thread context of 2420 2352 539cd7419efcd8142d20462511e931d3.exe 70 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 539cd7419efcd8142d20462511e931d3.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 539cd7419efcd8142d20462511e931d3.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 539cd7419efcd8142d20462511e931d3.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2420 539cd7419efcd8142d20462511e931d3.exe 2420 539cd7419efcd8142d20462511e931d3.exe 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3008 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2420 539cd7419efcd8142d20462511e931d3.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2352 wrote to memory of 2420 2352 539cd7419efcd8142d20462511e931d3.exe 70 PID 2352 wrote to memory of 2420 2352 539cd7419efcd8142d20462511e931d3.exe 70 PID 2352 wrote to memory of 2420 2352 539cd7419efcd8142d20462511e931d3.exe 70 PID 2352 wrote to memory of 2420 2352 539cd7419efcd8142d20462511e931d3.exe 70 PID 2352 wrote to memory of 2420 2352 539cd7419efcd8142d20462511e931d3.exe 70 PID 2352 wrote to memory of 2420 2352 539cd7419efcd8142d20462511e931d3.exe 70
Processes
-
C:\Users\Admin\AppData\Local\Temp\539cd7419efcd8142d20462511e931d3.exe"C:\Users\Admin\AppData\Local\Temp\539cd7419efcd8142d20462511e931d3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\539cd7419efcd8142d20462511e931d3.exe"C:\Users\Admin\AppData\Local\Temp\539cd7419efcd8142d20462511e931d3.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2420
-