Analysis
-
max time kernel
1806s -
max time network
1809s -
platform
windows7_x64 -
resource
win7-ja-20211014 -
submitted
22-10-2021 14:38
Static task
static1
Behavioral task
behavioral1
Sample
Fri0541e16ce794d258f.exe
Resource
win7-ja-20211014
Behavioral task
behavioral2
Sample
Fri0541e16ce794d258f.exe
Resource
win7-en-20210920
Behavioral task
behavioral3
Sample
Fri0541e16ce794d258f.exe
Resource
win7-de-20211014
Behavioral task
behavioral4
Sample
Fri0541e16ce794d258f.exe
Resource
win11
Behavioral task
behavioral5
Sample
Fri0541e16ce794d258f.exe
Resource
win10-ja-20211014
Behavioral task
behavioral6
Sample
Fri0541e16ce794d258f.exe
Resource
win10-en-20210920
Behavioral task
behavioral7
Sample
Fri0541e16ce794d258f.exe
Resource
win10-de-20210920
General
-
Target
Fri0541e16ce794d258f.exe
-
Size
284KB
-
MD5
dec69c757ce1ae8454f97ef6966aa817
-
SHA1
160d556701a012ab18194aeecaa396e21727c9b2
-
SHA256
2b396ae1fa95ef655bb7b0eb45532a857d882bb601adeb8fb1b5d43dcff9ec31
-
SHA512
c6304aa1a5b762804c81461fb1db1bae9ba57120c279dfb1ad83c3bb2e3309563f15c90a1a04a9f3acb5aac3a527432a87d1bb7ba32846dc75bda961b162db16
Malware Config
Extracted
smokeloader
2020
http://directorycart.com/upload/
http://tierzahnarzt.at/upload/
http://streetofcards.com/upload/
http://ycdfzd.com/upload/
http://successcoachceo.com/upload/
http://uhvu.cn/upload/
http://japanarticle.com/upload/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 3 IoCs
Processes:
retahhhretahhhretahhhpid process 856 retahhh 1072 retahhh 1672 retahhh -
Deletes itself 1 IoCs
Processes:
pid process 1360 -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
retahhhretahhhretahhhFri0541e16ce794d258f.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI retahhh Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI retahhh Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI retahhh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI retahhh Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Fri0541e16ce794d258f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI retahhh Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI retahhh Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI retahhh Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI retahhh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Fri0541e16ce794d258f.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Fri0541e16ce794d258f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI retahhh -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Fri0541e16ce794d258f.exepid process 1288 Fri0541e16ce794d258f.exe 1288 Fri0541e16ce794d258f.exe 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1360 -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
Fri0541e16ce794d258f.exeretahhhretahhhretahhhpid process 1288 Fri0541e16ce794d258f.exe 856 retahhh 1072 retahhh 1672 retahhh -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 1360 Token: SeShutdownPrivilege 1360 Token: SeShutdownPrivilege 1360 Token: SeShutdownPrivilege 1360 Token: SeShutdownPrivilege 1360 Token: SeShutdownPrivilege 1360 -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 1360 1360 -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
pid process 1360 1360 -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
taskeng.exetaskeng.exetaskeng.exedescription pid process target process PID 1728 wrote to memory of 856 1728 taskeng.exe retahhh PID 1728 wrote to memory of 856 1728 taskeng.exe retahhh PID 1728 wrote to memory of 856 1728 taskeng.exe retahhh PID 1728 wrote to memory of 856 1728 taskeng.exe retahhh PID 1728 wrote to memory of 1520 1728 taskeng.exe default-browser-agent.exe PID 1728 wrote to memory of 1520 1728 taskeng.exe default-browser-agent.exe PID 1728 wrote to memory of 1520 1728 taskeng.exe default-browser-agent.exe PID 1728 wrote to memory of 1740 1728 taskeng.exe default-browser-agent.exe PID 1728 wrote to memory of 1740 1728 taskeng.exe default-browser-agent.exe PID 1728 wrote to memory of 1740 1728 taskeng.exe default-browser-agent.exe PID 672 wrote to memory of 1072 672 taskeng.exe retahhh PID 672 wrote to memory of 1072 672 taskeng.exe retahhh PID 672 wrote to memory of 1072 672 taskeng.exe retahhh PID 672 wrote to memory of 1072 672 taskeng.exe retahhh PID 948 wrote to memory of 1672 948 taskeng.exe retahhh PID 948 wrote to memory of 1672 948 taskeng.exe retahhh PID 948 wrote to memory of 1672 948 taskeng.exe retahhh PID 948 wrote to memory of 1672 948 taskeng.exe retahhh
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fri0541e16ce794d258f.exe"C:\Users\Admin\AppData\Local\Temp\Fri0541e16ce794d258f.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\taskeng.exetaskeng.exe {4E28CDC7-A36E-4012-9CA9-315B17E7D889} S-1-5-18:NT AUTHORITY\System:Service:1⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {93A37B5E-65CA-41E3-9E66-E818A05F3E03} S-1-5-21-2955169046-2371869340-1800780948-1000:UKNHJUQT\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\retahhhC:\Users\Admin\AppData\Roaming\retahhh2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Program Files\Mozilla Firefox\default-browser-agent.exe"C:\Program Files\Mozilla Firefox\default-browser-agent.exe" do-task2⤵
-
C:\Program Files\Mozilla Firefox\default-browser-agent.exe"C:\Program Files\Mozilla Firefox\default-browser-agent.exe" do-task2⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {0EAABEC2-F4CB-48B9-A013-FC5FE13B3038} S-1-5-18:NT AUTHORITY\System:Service:1⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {92B421D0-09C5-46F2-B7B9-01BD8655506D} S-1-5-21-2955169046-2371869340-1800780948-1000:UKNHJUQT\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\retahhhC:\Users\Admin\AppData\Roaming\retahhh2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\taskeng.exetaskeng.exe {FB6DA47D-80B0-4638-9248-6E375F16FB3F} S-1-5-21-2955169046-2371869340-1800780948-1000:UKNHJUQT\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\retahhhC:\Users\Admin\AppData\Roaming\retahhh2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\retahhhMD5
dec69c757ce1ae8454f97ef6966aa817
SHA1160d556701a012ab18194aeecaa396e21727c9b2
SHA2562b396ae1fa95ef655bb7b0eb45532a857d882bb601adeb8fb1b5d43dcff9ec31
SHA512c6304aa1a5b762804c81461fb1db1bae9ba57120c279dfb1ad83c3bb2e3309563f15c90a1a04a9f3acb5aac3a527432a87d1bb7ba32846dc75bda961b162db16
-
C:\Users\Admin\AppData\Roaming\retahhhMD5
dec69c757ce1ae8454f97ef6966aa817
SHA1160d556701a012ab18194aeecaa396e21727c9b2
SHA2562b396ae1fa95ef655bb7b0eb45532a857d882bb601adeb8fb1b5d43dcff9ec31
SHA512c6304aa1a5b762804c81461fb1db1bae9ba57120c279dfb1ad83c3bb2e3309563f15c90a1a04a9f3acb5aac3a527432a87d1bb7ba32846dc75bda961b162db16
-
C:\Users\Admin\AppData\Roaming\retahhhMD5
dec69c757ce1ae8454f97ef6966aa817
SHA1160d556701a012ab18194aeecaa396e21727c9b2
SHA2562b396ae1fa95ef655bb7b0eb45532a857d882bb601adeb8fb1b5d43dcff9ec31
SHA512c6304aa1a5b762804c81461fb1db1bae9ba57120c279dfb1ad83c3bb2e3309563f15c90a1a04a9f3acb5aac3a527432a87d1bb7ba32846dc75bda961b162db16
-
C:\Users\Admin\AppData\Roaming\retahhhMD5
dec69c757ce1ae8454f97ef6966aa817
SHA1160d556701a012ab18194aeecaa396e21727c9b2
SHA2562b396ae1fa95ef655bb7b0eb45532a857d882bb601adeb8fb1b5d43dcff9ec31
SHA512c6304aa1a5b762804c81461fb1db1bae9ba57120c279dfb1ad83c3bb2e3309563f15c90a1a04a9f3acb5aac3a527432a87d1bb7ba32846dc75bda961b162db16
-
memory/856-61-0x0000000000000000-mapping.dmp
-
memory/856-65-0x0000000000400000-0x0000000000877000-memory.dmpFilesize
4.5MB
-
memory/856-63-0x0000000000918000-0x0000000000929000-memory.dmpFilesize
68KB
-
memory/1072-71-0x0000000000948000-0x0000000000959000-memory.dmpFilesize
68KB
-
memory/1072-69-0x0000000000000000-mapping.dmp
-
memory/1072-73-0x0000000000400000-0x0000000000877000-memory.dmpFilesize
4.5MB
-
memory/1288-58-0x0000000000400000-0x0000000000877000-memory.dmpFilesize
4.5MB
-
memory/1288-56-0x0000000076AA1000-0x0000000076AA3000-memory.dmpFilesize
8KB
-
memory/1288-55-0x00000000009A9000-0x00000000009B9000-memory.dmpFilesize
64KB
-
memory/1288-57-0x0000000000020000-0x0000000000029000-memory.dmpFilesize
36KB
-
memory/1360-74-0x0000000003D90000-0x0000000003DA6000-memory.dmpFilesize
88KB
-
memory/1360-59-0x00000000025F0000-0x0000000002606000-memory.dmpFilesize
88KB
-
memory/1360-66-0x0000000004020000-0x0000000004036000-memory.dmpFilesize
88KB
-
memory/1360-80-0x0000000003DD0000-0x0000000003DE6000-memory.dmpFilesize
88KB
-
memory/1520-67-0x0000000000000000-mapping.dmp
-
memory/1672-75-0x0000000000000000-mapping.dmp
-
memory/1672-77-0x00000000009C8000-0x00000000009D9000-memory.dmpFilesize
68KB
-
memory/1672-79-0x0000000000400000-0x0000000000877000-memory.dmpFilesize
4.5MB
-
memory/1740-68-0x0000000000000000-mapping.dmp