Analysis
-
max time kernel
151s -
max time network
126s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
14-10-2021 06:19
Static task
static1
Behavioral task
behavioral1
Sample
e4f0bfdf674b98dc75b4ae56f5a3cf399097248b62c4a7bc3d0de0244c9cfb50.exe
Resource
win10-en-20210920
General
-
Target
e4f0bfdf674b98dc75b4ae56f5a3cf399097248b62c4a7bc3d0de0244c9cfb50.exe
-
Size
214KB
-
MD5
4bdd68f6755ce33ab489a8e818fbe740
-
SHA1
5c0f9f882f2137d468da01b2a1a20e4cc7bc6264
-
SHA256
e4f0bfdf674b98dc75b4ae56f5a3cf399097248b62c4a7bc3d0de0244c9cfb50
-
SHA512
58043b92bba6de7eae03955d844ae4d01ab57a1fe624a481763d835d2bb6351620e92b9c9261d4d0d15690634e0feaaf4362f0a201db1a06898dfb34d08e68e4
Malware Config
Extracted
smokeloader
2020
http://honawey7.xyz/
http://wijibui0.xyz/
http://hefahei6.xyz/
http://pipevai4.xyz/
http://nalirou7.xyz/
http://xacokuo8.xyz/
http://hajezey1.xyz/
http://gejajoo7.xyz/
http://sysaheu9.xyz/
http://rixoxeu9.xyz/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3028 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
e4f0bfdf674b98dc75b4ae56f5a3cf399097248b62c4a7bc3d0de0244c9cfb50.exedescription pid process target process PID 2396 set thread context of 656 2396 e4f0bfdf674b98dc75b4ae56f5a3cf399097248b62c4a7bc3d0de0244c9cfb50.exe e4f0bfdf674b98dc75b4ae56f5a3cf399097248b62c4a7bc3d0de0244c9cfb50.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
e4f0bfdf674b98dc75b4ae56f5a3cf399097248b62c4a7bc3d0de0244c9cfb50.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e4f0bfdf674b98dc75b4ae56f5a3cf399097248b62c4a7bc3d0de0244c9cfb50.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e4f0bfdf674b98dc75b4ae56f5a3cf399097248b62c4a7bc3d0de0244c9cfb50.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e4f0bfdf674b98dc75b4ae56f5a3cf399097248b62c4a7bc3d0de0244c9cfb50.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e4f0bfdf674b98dc75b4ae56f5a3cf399097248b62c4a7bc3d0de0244c9cfb50.exepid process 656 e4f0bfdf674b98dc75b4ae56f5a3cf399097248b62c4a7bc3d0de0244c9cfb50.exe 656 e4f0bfdf674b98dc75b4ae56f5a3cf399097248b62c4a7bc3d0de0244c9cfb50.exe 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3028 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
e4f0bfdf674b98dc75b4ae56f5a3cf399097248b62c4a7bc3d0de0244c9cfb50.exepid process 656 e4f0bfdf674b98dc75b4ae56f5a3cf399097248b62c4a7bc3d0de0244c9cfb50.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
e4f0bfdf674b98dc75b4ae56f5a3cf399097248b62c4a7bc3d0de0244c9cfb50.exedescription pid process target process PID 2396 wrote to memory of 656 2396 e4f0bfdf674b98dc75b4ae56f5a3cf399097248b62c4a7bc3d0de0244c9cfb50.exe e4f0bfdf674b98dc75b4ae56f5a3cf399097248b62c4a7bc3d0de0244c9cfb50.exe PID 2396 wrote to memory of 656 2396 e4f0bfdf674b98dc75b4ae56f5a3cf399097248b62c4a7bc3d0de0244c9cfb50.exe e4f0bfdf674b98dc75b4ae56f5a3cf399097248b62c4a7bc3d0de0244c9cfb50.exe PID 2396 wrote to memory of 656 2396 e4f0bfdf674b98dc75b4ae56f5a3cf399097248b62c4a7bc3d0de0244c9cfb50.exe e4f0bfdf674b98dc75b4ae56f5a3cf399097248b62c4a7bc3d0de0244c9cfb50.exe PID 2396 wrote to memory of 656 2396 e4f0bfdf674b98dc75b4ae56f5a3cf399097248b62c4a7bc3d0de0244c9cfb50.exe e4f0bfdf674b98dc75b4ae56f5a3cf399097248b62c4a7bc3d0de0244c9cfb50.exe PID 2396 wrote to memory of 656 2396 e4f0bfdf674b98dc75b4ae56f5a3cf399097248b62c4a7bc3d0de0244c9cfb50.exe e4f0bfdf674b98dc75b4ae56f5a3cf399097248b62c4a7bc3d0de0244c9cfb50.exe PID 2396 wrote to memory of 656 2396 e4f0bfdf674b98dc75b4ae56f5a3cf399097248b62c4a7bc3d0de0244c9cfb50.exe e4f0bfdf674b98dc75b4ae56f5a3cf399097248b62c4a7bc3d0de0244c9cfb50.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4f0bfdf674b98dc75b4ae56f5a3cf399097248b62c4a7bc3d0de0244c9cfb50.exe"C:\Users\Admin\AppData\Local\Temp\e4f0bfdf674b98dc75b4ae56f5a3cf399097248b62c4a7bc3d0de0244c9cfb50.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e4f0bfdf674b98dc75b4ae56f5a3cf399097248b62c4a7bc3d0de0244c9cfb50.exe"C:\Users\Admin\AppData\Local\Temp\e4f0bfdf674b98dc75b4ae56f5a3cf399097248b62c4a7bc3d0de0244c9cfb50.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/656-116-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/656-117-0x0000000000402E8F-mapping.dmp
-
memory/2396-115-0x0000000000751000-0x000000000075B000-memory.dmpFilesize
40KB
-
memory/2396-118-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/3028-119-0x0000000000ED0000-0x0000000000EE6000-memory.dmpFilesize
88KB