Analysis
-
max time kernel
152s -
max time network
56s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
14-10-2021 05:05
Static task
static1
Behavioral task
behavioral1
Sample
3a7ac1ac60baac512bf45e412aacb90c.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
3a7ac1ac60baac512bf45e412aacb90c.exe
Resource
win10-en-20210920
General
-
Target
3a7ac1ac60baac512bf45e412aacb90c.exe
-
Size
311KB
-
MD5
3a7ac1ac60baac512bf45e412aacb90c
-
SHA1
d579493a2190a8f6f44a9094148a494c5368cdc7
-
SHA256
5c88ec7f348d5b457a2f155bbd9b0353c1cb840e0e971013c0ebc58aaee3b715
-
SHA512
08c3a3861a092eb7e39f6aa7255b36e2bf54b1f7a15b7fb76ac5f94269e7879e3a27187af2ee11f7215f5796e35ecd9146d04744ab4a4e01fb29a137589963b9
Malware Config
Extracted
smokeloader
2020
http://linavanandr11.club/
http://iselaharty12.club/
http://giovaninardo13.club/
http://zayneliann14.club/
http://zorinosali15.club/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1212 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
3a7ac1ac60baac512bf45e412aacb90c.exedescription pid process target process PID 1516 set thread context of 1504 1516 3a7ac1ac60baac512bf45e412aacb90c.exe 3a7ac1ac60baac512bf45e412aacb90c.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
3a7ac1ac60baac512bf45e412aacb90c.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3a7ac1ac60baac512bf45e412aacb90c.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3a7ac1ac60baac512bf45e412aacb90c.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3a7ac1ac60baac512bf45e412aacb90c.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
3a7ac1ac60baac512bf45e412aacb90c.exepid process 1504 3a7ac1ac60baac512bf45e412aacb90c.exe 1504 3a7ac1ac60baac512bf45e412aacb90c.exe 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1212 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
3a7ac1ac60baac512bf45e412aacb90c.exepid process 1504 3a7ac1ac60baac512bf45e412aacb90c.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
pid process 1212 1212 1212 1212 -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
pid process 1212 1212 1212 1212 -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
3a7ac1ac60baac512bf45e412aacb90c.exedescription pid process target process PID 1516 wrote to memory of 1504 1516 3a7ac1ac60baac512bf45e412aacb90c.exe 3a7ac1ac60baac512bf45e412aacb90c.exe PID 1516 wrote to memory of 1504 1516 3a7ac1ac60baac512bf45e412aacb90c.exe 3a7ac1ac60baac512bf45e412aacb90c.exe PID 1516 wrote to memory of 1504 1516 3a7ac1ac60baac512bf45e412aacb90c.exe 3a7ac1ac60baac512bf45e412aacb90c.exe PID 1516 wrote to memory of 1504 1516 3a7ac1ac60baac512bf45e412aacb90c.exe 3a7ac1ac60baac512bf45e412aacb90c.exe PID 1516 wrote to memory of 1504 1516 3a7ac1ac60baac512bf45e412aacb90c.exe 3a7ac1ac60baac512bf45e412aacb90c.exe PID 1516 wrote to memory of 1504 1516 3a7ac1ac60baac512bf45e412aacb90c.exe 3a7ac1ac60baac512bf45e412aacb90c.exe PID 1516 wrote to memory of 1504 1516 3a7ac1ac60baac512bf45e412aacb90c.exe 3a7ac1ac60baac512bf45e412aacb90c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a7ac1ac60baac512bf45e412aacb90c.exe"C:\Users\Admin\AppData\Local\Temp\3a7ac1ac60baac512bf45e412aacb90c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3a7ac1ac60baac512bf45e412aacb90c.exe"C:\Users\Admin\AppData\Local\Temp\3a7ac1ac60baac512bf45e412aacb90c.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1212-64-0x00000000029F0000-0x0000000002A06000-memory.dmpFilesize
88KB
-
memory/1504-61-0x0000000000402DF8-mapping.dmp
-
memory/1504-60-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1504-62-0x0000000075801000-0x0000000075803000-memory.dmpFilesize
8KB
-
memory/1516-59-0x0000000001B3B000-0x0000000001B4C000-memory.dmpFilesize
68KB
-
memory/1516-63-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB