Analysis
-
max time kernel
160s -
max time network
145s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
16-10-2021 06:51
General
-
Target
keygen-step-4/pub1.exe
-
Size
292KB
-
MD5
21d97164ae557fe9f699de68ed6b2e26
-
SHA1
54f3d96addce8823edcd6b09a8ed59be31ed20b4
-
SHA256
45fc5cfccbb4088e43a65c0c53ec4d2486317f87ba4d06da4d66278d8025381d
-
SHA512
b5485e5855ba81e457bf1a6c0b04de4ba1f60f2c87f7f6a23266d565496a713717a4327ee0cfd77b83e21c69309f05a2e7e37601cb5dd62eb03fc22933c3b64f
Score
10/10
Malware Config
Extracted
Family
smokeloader
Version
2020
C2
http://directorycart.com/upload/
http://tierzahnarzt.at/upload/
http://streetofcards.com/upload/
http://ycdfzd.com/upload/
http://successcoachceo.com/upload/
http://uhvu.cn/upload/
http://japanarticle.com/upload/
rc4.i32
rc4.i32
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\keygen-step-4\pub1.exe"C:\Users\Admin\AppData\Local\Temp\keygen-step-4\pub1.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1816-117-0x0000000001999000-0x00000000019A9000-memory.dmpFilesize
64KB
-
memory/1816-118-0x00000000017F0000-0x000000000193A000-memory.dmpFilesize
1.3MB
-
memory/1816-119-0x0000000000400000-0x00000000016BC000-memory.dmpFilesize
18.7MB
-
memory/3008-120-0x0000000001250000-0x0000000001266000-memory.dmpFilesize
88KB