Analysis
-
max time kernel
153s -
max time network
122s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
08-10-2021 11:51
Static task
static1
Behavioral task
behavioral1
Sample
72ec822792e913d602bf3b3d6ad3c68a.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
72ec822792e913d602bf3b3d6ad3c68a.exe
Resource
win10-en-20210920
General
-
Target
72ec822792e913d602bf3b3d6ad3c68a.exe
-
Size
192KB
-
MD5
72ec822792e913d602bf3b3d6ad3c68a
-
SHA1
f87844987a3690336ec089d44ca7a9f51c18f33c
-
SHA256
63f6a92084e81e72720f6160287e6766e2214f489d11142a9668925c6c4616f2
-
SHA512
3249b4a6282c748b3dd0c2dd7824496d021e17d3e745d8a726633965bd035fb95903b91789231a9426a4a5b305fdb1fcd250dc2df5d0cafa9ee4bc45f240c9f2
Malware Config
Extracted
smokeloader
2020
http://fazanaharahe10.top/
http://xandelissane20.top/
http://ustiassosale30.top/
http://cytheriata40.top/
http://ggiergionard50.top/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1364 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
72ec822792e913d602bf3b3d6ad3c68a.exedescription pid process target process PID 1080 set thread context of 1596 1080 72ec822792e913d602bf3b3d6ad3c68a.exe 72ec822792e913d602bf3b3d6ad3c68a.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
72ec822792e913d602bf3b3d6ad3c68a.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 72ec822792e913d602bf3b3d6ad3c68a.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 72ec822792e913d602bf3b3d6ad3c68a.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 72ec822792e913d602bf3b3d6ad3c68a.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
72ec822792e913d602bf3b3d6ad3c68a.exepid process 1596 72ec822792e913d602bf3b3d6ad3c68a.exe 1596 72ec822792e913d602bf3b3d6ad3c68a.exe 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1364 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
72ec822792e913d602bf3b3d6ad3c68a.exepid process 1596 72ec822792e913d602bf3b3d6ad3c68a.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 1364 1364 -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
pid process 1364 1364 -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
72ec822792e913d602bf3b3d6ad3c68a.exedescription pid process target process PID 1080 wrote to memory of 1596 1080 72ec822792e913d602bf3b3d6ad3c68a.exe 72ec822792e913d602bf3b3d6ad3c68a.exe PID 1080 wrote to memory of 1596 1080 72ec822792e913d602bf3b3d6ad3c68a.exe 72ec822792e913d602bf3b3d6ad3c68a.exe PID 1080 wrote to memory of 1596 1080 72ec822792e913d602bf3b3d6ad3c68a.exe 72ec822792e913d602bf3b3d6ad3c68a.exe PID 1080 wrote to memory of 1596 1080 72ec822792e913d602bf3b3d6ad3c68a.exe 72ec822792e913d602bf3b3d6ad3c68a.exe PID 1080 wrote to memory of 1596 1080 72ec822792e913d602bf3b3d6ad3c68a.exe 72ec822792e913d602bf3b3d6ad3c68a.exe PID 1080 wrote to memory of 1596 1080 72ec822792e913d602bf3b3d6ad3c68a.exe 72ec822792e913d602bf3b3d6ad3c68a.exe PID 1080 wrote to memory of 1596 1080 72ec822792e913d602bf3b3d6ad3c68a.exe 72ec822792e913d602bf3b3d6ad3c68a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\72ec822792e913d602bf3b3d6ad3c68a.exe"C:\Users\Admin\AppData\Local\Temp\72ec822792e913d602bf3b3d6ad3c68a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\72ec822792e913d602bf3b3d6ad3c68a.exe"C:\Users\Admin\AppData\Local\Temp\72ec822792e913d602bf3b3d6ad3c68a.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1596
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1080-54-0x0000000000288000-0x0000000000291000-memory.dmpFilesize
36KB
-
memory/1080-55-0x0000000000020000-0x0000000000029000-memory.dmpFilesize
36KB
-
memory/1364-59-0x0000000001C50000-0x0000000001C66000-memory.dmpFilesize
88KB
-
memory/1596-57-0x0000000000402E4E-mapping.dmp
-
memory/1596-56-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1596-58-0x0000000075FC1000-0x0000000075FC3000-memory.dmpFilesize
8KB