Analysis
-
max time kernel
1805s -
max time network
1808s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
22-10-2021 14:38
General
-
Target
Fri0541e16ce794d258f.exe
-
Size
284KB
-
MD5
dec69c757ce1ae8454f97ef6966aa817
-
SHA1
160d556701a012ab18194aeecaa396e21727c9b2
-
SHA256
2b396ae1fa95ef655bb7b0eb45532a857d882bb601adeb8fb1b5d43dcff9ec31
-
SHA512
c6304aa1a5b762804c81461fb1db1bae9ba57120c279dfb1ad83c3bb2e3309563f15c90a1a04a9f3acb5aac3a527432a87d1bb7ba32846dc75bda961b162db16
Malware Config
Extracted
smokeloader
2020
http://directorycart.com/upload/
http://tierzahnarzt.at/upload/
http://streetofcards.com/upload/
http://ycdfzd.com/upload/
http://successcoachceo.com/upload/
http://uhvu.cn/upload/
http://japanarticle.com/upload/
Extracted
icedid
1875681804
enticationmetho.ink
Signatures
-
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
-
Deletes itself 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies system certificate store 2 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fri0541e16ce794d258f.exe"C:\Users\Admin\AppData\Local\Temp\Fri0541e16ce794d258f.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\4846.exeC:\Users\Admin\AppData\Local\Temp\4846.exe1⤵
- Executes dropped EXE
- Modifies system certificate store
-
C:\Windows\system32\taskeng.exetaskeng.exe {1097AC97-89DC-485E-80FB-F5086C629D7F} S-1-5-21-3456797065-1076791440-4146276586-1000:JZCKHXIN\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\udbrhrtC:\Users\Admin\AppData\Roaming\udbrhrt2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\taskeng.exetaskeng.exe {FD5D85FD-667E-4D93-B449-69B6BF868DBB} S-1-5-21-3456797065-1076791440-4146276586-1000:JZCKHXIN\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\udbrhrtC:\Users\Admin\AppData\Roaming\udbrhrt2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\taskeng.exetaskeng.exe {CCF8724B-E06D-4AF5-BF49-96D88CB42306} S-1-5-21-3456797065-1076791440-4146276586-1000:JZCKHXIN\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\udbrhrtC:\Users\Admin\AppData\Roaming\udbrhrt2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\4846.exeMD5
81fc38de5b6197c4db58eb506037e7cb
SHA1c2258ab3204e6061d548df202c99aa361242d848
SHA2562b9cba43290c9d4cc2d6a47432ddac5752c63e5ac519c2056ba466580424ed3b
SHA5124c96e9104e55454e741a13be34a7c5a3afb8d0d17c1924d629acbd487975d88d4435fd46b34649defe2d047ff4c84e06c4a0d0176085c7b5ab4d80eed18b0d9a
-
C:\Users\Admin\AppData\Roaming\udbrhrtMD5
dec69c757ce1ae8454f97ef6966aa817
SHA1160d556701a012ab18194aeecaa396e21727c9b2
SHA2562b396ae1fa95ef655bb7b0eb45532a857d882bb601adeb8fb1b5d43dcff9ec31
SHA512c6304aa1a5b762804c81461fb1db1bae9ba57120c279dfb1ad83c3bb2e3309563f15c90a1a04a9f3acb5aac3a527432a87d1bb7ba32846dc75bda961b162db16
-
C:\Users\Admin\AppData\Roaming\udbrhrtMD5
dec69c757ce1ae8454f97ef6966aa817
SHA1160d556701a012ab18194aeecaa396e21727c9b2
SHA2562b396ae1fa95ef655bb7b0eb45532a857d882bb601adeb8fb1b5d43dcff9ec31
SHA512c6304aa1a5b762804c81461fb1db1bae9ba57120c279dfb1ad83c3bb2e3309563f15c90a1a04a9f3acb5aac3a527432a87d1bb7ba32846dc75bda961b162db16
-
C:\Users\Admin\AppData\Roaming\udbrhrtMD5
dec69c757ce1ae8454f97ef6966aa817
SHA1160d556701a012ab18194aeecaa396e21727c9b2
SHA2562b396ae1fa95ef655bb7b0eb45532a857d882bb601adeb8fb1b5d43dcff9ec31
SHA512c6304aa1a5b762804c81461fb1db1bae9ba57120c279dfb1ad83c3bb2e3309563f15c90a1a04a9f3acb5aac3a527432a87d1bb7ba32846dc75bda961b162db16
-
C:\Users\Admin\AppData\Roaming\udbrhrtMD5
dec69c757ce1ae8454f97ef6966aa817
SHA1160d556701a012ab18194aeecaa396e21727c9b2
SHA2562b396ae1fa95ef655bb7b0eb45532a857d882bb601adeb8fb1b5d43dcff9ec31
SHA512c6304aa1a5b762804c81461fb1db1bae9ba57120c279dfb1ad83c3bb2e3309563f15c90a1a04a9f3acb5aac3a527432a87d1bb7ba32846dc75bda961b162db16
-
\Users\Admin\AppData\Local\Temp\4846.exeMD5
81fc38de5b6197c4db58eb506037e7cb
SHA1c2258ab3204e6061d548df202c99aa361242d848
SHA2562b9cba43290c9d4cc2d6a47432ddac5752c63e5ac519c2056ba466580424ed3b
SHA5124c96e9104e55454e741a13be34a7c5a3afb8d0d17c1924d629acbd487975d88d4435fd46b34649defe2d047ff4c84e06c4a0d0176085c7b5ab4d80eed18b0d9a
-
\Users\Admin\AppData\Local\Temp\4846.exeMD5
81fc38de5b6197c4db58eb506037e7cb
SHA1c2258ab3204e6061d548df202c99aa361242d848
SHA2562b9cba43290c9d4cc2d6a47432ddac5752c63e5ac519c2056ba466580424ed3b
SHA5124c96e9104e55454e741a13be34a7c5a3afb8d0d17c1924d629acbd487975d88d4435fd46b34649defe2d047ff4c84e06c4a0d0176085c7b5ab4d80eed18b0d9a
-
memory/1196-81-0x0000000000400000-0x0000000000877000-memory.dmpFilesize
4.5MB
-
memory/1196-79-0x0000000000948000-0x0000000000959000-memory.dmpFilesize
68KB
-
memory/1196-77-0x0000000000000000-mapping.dmp
-
memory/1204-61-0x0000000000000000-mapping.dmp
-
memory/1204-63-0x0000000140000000-0x0000000140009000-memory.dmpFilesize
36KB
-
memory/1420-76-0x0000000003D90000-0x0000000003DA6000-memory.dmpFilesize
88KB
-
memory/1420-82-0x0000000003DD0000-0x0000000003DE6000-memory.dmpFilesize
88KB
-
memory/1420-58-0x00000000025D0000-0x00000000025E6000-memory.dmpFilesize
88KB
-
memory/1420-70-0x00000000041E0000-0x00000000041F6000-memory.dmpFilesize
88KB
-
memory/1480-69-0x0000000000400000-0x0000000000877000-memory.dmpFilesize
4.5MB
-
memory/1480-65-0x0000000000000000-mapping.dmp
-
memory/1480-67-0x00000000002C8000-0x00000000002D9000-memory.dmpFilesize
68KB
-
memory/1568-54-0x0000000000979000-0x0000000000989000-memory.dmpFilesize
64KB
-
memory/1568-56-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/1568-57-0x0000000000400000-0x0000000000877000-memory.dmpFilesize
4.5MB
-
memory/1568-55-0x0000000075951000-0x0000000075953000-memory.dmpFilesize
8KB
-
memory/1968-73-0x0000000000958000-0x0000000000969000-memory.dmpFilesize
68KB
-
memory/1968-75-0x0000000000400000-0x0000000000877000-memory.dmpFilesize
4.5MB
-
memory/1968-71-0x0000000000000000-mapping.dmp