Analysis
- max time kernel
151s - max time network
72s - platform
windows10_x64 - resource
win10v20210408 - submitted
06/10/2021, 06:52
Static task
static1
Behavioral task
behavioral1
Sample
c78098e45a6f2eb3421e5fa14dedda9e.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
c78098e45a6f2eb3421e5fa14dedda9e.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target c78098e45a6f2eb3421e5fa14dedda9e.exe
- Size 242KB
- Sample211006-hm64saahfj
- SHA256 96d02aa6d831dbeece3c407da36a56d57527f5848ef1b99a84fccabba1934959
- MD5 c78098e45a6f2eb3421e5fa14dedda9e
- SHA1 24688fc7bb8e2faa35e87c3bb1996c07e32a5aad
- SHA512 5147ad244e5fcba0f47bbce4dfd401d31a23d7820aa1ff6330062aeb9e8d3b651ad1e353e9cf2ea1845c2c4e8cee5b3db278cbebdebb1074b9929a7581564757
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://fiskahlilian16.top/
-
http://paishancho17.top/
-
http://ydiannetter18.top/
-
http://azarehanelle19.top/
-
http://quericeriant20.top/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Deletes itself 1 IoCs
pid Process 3024 Process not Found - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 664 set thread context of 840 664 c78098e45a6f2eb3421e5fa14dedda9e.exe 68 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c78098e45a6f2eb3421e5fa14dedda9e.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c78098e45a6f2eb3421e5fa14dedda9e.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c78098e45a6f2eb3421e5fa14dedda9e.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Process not Found Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Process not Found - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 840 c78098e45a6f2eb3421e5fa14dedda9e.exe 840 c78098e45a6f2eb3421e5fa14dedda9e.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3024 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 840 c78098e45a6f2eb3421e5fa14dedda9e.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found - Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 664 wrote to memory of 840 664 c78098e45a6f2eb3421e5fa14dedda9e.exe 68 PID 664 wrote to memory of 840 664 c78098e45a6f2eb3421e5fa14dedda9e.exe 68 PID 664 wrote to memory of 840 664 c78098e45a6f2eb3421e5fa14dedda9e.exe 68 PID 664 wrote to memory of 840 664 c78098e45a6f2eb3421e5fa14dedda9e.exe 68 PID 664 wrote to memory of 840 664 c78098e45a6f2eb3421e5fa14dedda9e.exe 68 PID 664 wrote to memory of 840 664 c78098e45a6f2eb3421e5fa14dedda9e.exe 68
Processes
-
C:\Users\Admin\AppData\Local\Temp\c78098e45a6f2eb3421e5fa14dedda9e.exe"C:\Users\Admin\AppData\Local\Temp\c78098e45a6f2eb3421e5fa14dedda9e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Users\Admin\AppData\Local\Temp\c78098e45a6f2eb3421e5fa14dedda9e.exe"C:\Users\Admin\AppData\Local\Temp\c78098e45a6f2eb3421e5fa14dedda9e.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:840
-