Analysis
-
max time kernel
161s -
max time network
142s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
08-10-2021 11:51
Static task
static1
Behavioral task
behavioral1
Sample
88ac119caa32b27e7d7e51266c3e76e5.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
88ac119caa32b27e7d7e51266c3e76e5.exe
Resource
win10-en-20210920
General
-
Target
88ac119caa32b27e7d7e51266c3e76e5.exe
-
Size
193KB
-
MD5
88ac119caa32b27e7d7e51266c3e76e5
-
SHA1
d474ba953ef501603a21d5fd002c0d041f508e10
-
SHA256
d6d09e51d2e7eb9f29b4ee44530696f893ba14a7c1d119cb8f1e41cd7861eaa6
-
SHA512
3e31c6bc4b016e3aee6ac95bcd3e5a0385c1eb77710ab63bd6bd0a3470f3fd7443e263cc78895d47b0b7f0c9e888fe770fb438318a738be230828c7f5d70e623
Malware Config
Extracted
smokeloader
2020
http://fazanaharahe10.top/
http://xandelissane20.top/
http://ustiassosale30.top/
http://cytheriata40.top/
http://ggiergionard50.top/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3048 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
88ac119caa32b27e7d7e51266c3e76e5.exedescription pid process target process PID 3704 set thread context of 4480 3704 88ac119caa32b27e7d7e51266c3e76e5.exe 88ac119caa32b27e7d7e51266c3e76e5.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
88ac119caa32b27e7d7e51266c3e76e5.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 88ac119caa32b27e7d7e51266c3e76e5.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 88ac119caa32b27e7d7e51266c3e76e5.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 88ac119caa32b27e7d7e51266c3e76e5.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
88ac119caa32b27e7d7e51266c3e76e5.exepid process 4480 88ac119caa32b27e7d7e51266c3e76e5.exe 4480 88ac119caa32b27e7d7e51266c3e76e5.exe 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3048 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
88ac119caa32b27e7d7e51266c3e76e5.exepid process 4480 88ac119caa32b27e7d7e51266c3e76e5.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
88ac119caa32b27e7d7e51266c3e76e5.exedescription pid process target process PID 3704 wrote to memory of 4480 3704 88ac119caa32b27e7d7e51266c3e76e5.exe 88ac119caa32b27e7d7e51266c3e76e5.exe PID 3704 wrote to memory of 4480 3704 88ac119caa32b27e7d7e51266c3e76e5.exe 88ac119caa32b27e7d7e51266c3e76e5.exe PID 3704 wrote to memory of 4480 3704 88ac119caa32b27e7d7e51266c3e76e5.exe 88ac119caa32b27e7d7e51266c3e76e5.exe PID 3704 wrote to memory of 4480 3704 88ac119caa32b27e7d7e51266c3e76e5.exe 88ac119caa32b27e7d7e51266c3e76e5.exe PID 3704 wrote to memory of 4480 3704 88ac119caa32b27e7d7e51266c3e76e5.exe 88ac119caa32b27e7d7e51266c3e76e5.exe PID 3704 wrote to memory of 4480 3704 88ac119caa32b27e7d7e51266c3e76e5.exe 88ac119caa32b27e7d7e51266c3e76e5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\88ac119caa32b27e7d7e51266c3e76e5.exe"C:\Users\Admin\AppData\Local\Temp\88ac119caa32b27e7d7e51266c3e76e5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\88ac119caa32b27e7d7e51266c3e76e5.exe"C:\Users\Admin\AppData\Local\Temp\88ac119caa32b27e7d7e51266c3e76e5.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3048-119-0x0000000000460000-0x0000000000476000-memory.dmpFilesize
88KB
-
memory/3704-115-0x0000000002E71000-0x0000000002E7A000-memory.dmpFilesize
36KB
-
memory/3704-118-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/4480-116-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4480-117-0x0000000000402E4E-mapping.dmp