Analysis
-
max time kernel
152s -
max time network
59s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
07-10-2021 07:16
Static task
static1
Behavioral task
behavioral1
Sample
5bca3c8ad06d5375ed5a1f8e5e6a77d2.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
5bca3c8ad06d5375ed5a1f8e5e6a77d2.exe
Resource
win10v20210408
General
-
Target
5bca3c8ad06d5375ed5a1f8e5e6a77d2.exe
-
Size
234KB
-
MD5
5bca3c8ad06d5375ed5a1f8e5e6a77d2
-
SHA1
0c0beed83527d6a1e90ed92b4ecc1b50a3c6fdd9
-
SHA256
a1891a1f7227c10aa8e6d51667baacdecfe9e070e5f1c212f02ba20610267b21
-
SHA512
b7f36269d402393431a494fc3a0060da80e749127003ba6fc977bfa5f12b8edfb88b3341c82ded8ac4fc86137713ada10c4ee9a7d5524d65af65144ff79bab1b
Malware Config
Extracted
smokeloader
2020
http://fiskahlilian16.top/
http://paishancho17.top/
http://ydiannetter18.top/
http://azarehanelle19.top/
http://quericeriant20.top/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1356 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5bca3c8ad06d5375ed5a1f8e5e6a77d2.exedescription pid process target process PID 2036 set thread context of 2024 2036 5bca3c8ad06d5375ed5a1f8e5e6a77d2.exe 5bca3c8ad06d5375ed5a1f8e5e6a77d2.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
5bca3c8ad06d5375ed5a1f8e5e6a77d2.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5bca3c8ad06d5375ed5a1f8e5e6a77d2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5bca3c8ad06d5375ed5a1f8e5e6a77d2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5bca3c8ad06d5375ed5a1f8e5e6a77d2.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
5bca3c8ad06d5375ed5a1f8e5e6a77d2.exepid process 2024 5bca3c8ad06d5375ed5a1f8e5e6a77d2.exe 2024 5bca3c8ad06d5375ed5a1f8e5e6a77d2.exe 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 1356 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1356 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
5bca3c8ad06d5375ed5a1f8e5e6a77d2.exepid process 2024 5bca3c8ad06d5375ed5a1f8e5e6a77d2.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
pid process 1356 1356 1356 1356 1356 1356 -
Suspicious use of SendNotifyMessage 6 IoCs
Processes:
pid process 1356 1356 1356 1356 1356 1356 -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
5bca3c8ad06d5375ed5a1f8e5e6a77d2.exedescription pid process target process PID 2036 wrote to memory of 2024 2036 5bca3c8ad06d5375ed5a1f8e5e6a77d2.exe 5bca3c8ad06d5375ed5a1f8e5e6a77d2.exe PID 2036 wrote to memory of 2024 2036 5bca3c8ad06d5375ed5a1f8e5e6a77d2.exe 5bca3c8ad06d5375ed5a1f8e5e6a77d2.exe PID 2036 wrote to memory of 2024 2036 5bca3c8ad06d5375ed5a1f8e5e6a77d2.exe 5bca3c8ad06d5375ed5a1f8e5e6a77d2.exe PID 2036 wrote to memory of 2024 2036 5bca3c8ad06d5375ed5a1f8e5e6a77d2.exe 5bca3c8ad06d5375ed5a1f8e5e6a77d2.exe PID 2036 wrote to memory of 2024 2036 5bca3c8ad06d5375ed5a1f8e5e6a77d2.exe 5bca3c8ad06d5375ed5a1f8e5e6a77d2.exe PID 2036 wrote to memory of 2024 2036 5bca3c8ad06d5375ed5a1f8e5e6a77d2.exe 5bca3c8ad06d5375ed5a1f8e5e6a77d2.exe PID 2036 wrote to memory of 2024 2036 5bca3c8ad06d5375ed5a1f8e5e6a77d2.exe 5bca3c8ad06d5375ed5a1f8e5e6a77d2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5bca3c8ad06d5375ed5a1f8e5e6a77d2.exe"C:\Users\Admin\AppData\Local\Temp\5bca3c8ad06d5375ed5a1f8e5e6a77d2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5bca3c8ad06d5375ed5a1f8e5e6a77d2.exe"C:\Users\Admin\AppData\Local\Temp\5bca3c8ad06d5375ed5a1f8e5e6a77d2.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1356-58-0x0000000002560000-0x0000000002575000-memory.dmpFilesize
84KB
-
memory/2024-55-0x0000000000402F18-mapping.dmp
-
memory/2024-54-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2024-56-0x00000000759B1000-0x00000000759B3000-memory.dmpFilesize
8KB
-
memory/2036-57-0x0000000000020000-0x0000000000029000-memory.dmpFilesize
36KB