Overview

overview

10

Static

static

Fri0541e16...8f.exe

windows7_x64

10

Fri0541e16...8f.exe

windows7_x64

10

Fri0541e16...8f.exe

windows7_x64

10

Fri0541e16...8f.exe

windows11_x64

10

Fri0541e16...8f.exe

windows10_x64

10

Fri0541e16...8f.exe

windows10_x64

10

Fri0541e16...8f.exe

windows10_x64

10

Analysis

  • max time kernel
    1806s
  • max time network
    1809s
  • platform
    windows7_x64
  • resource
    win7-de-20211014
  • submitted
    22-10-2021 14:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Fri0541e16ce794d258f.exe

  • Size

    284KB

  • MD5

    dec69c757ce1ae8454f97ef6966aa817

  • SHA1

    160d556701a012ab18194aeecaa396e21727c9b2

  • SHA256

    2b396ae1fa95ef655bb7b0eb45532a857d882bb601adeb8fb1b5d43dcff9ec31

  • SHA512

    c6304aa1a5b762804c81461fb1db1bae9ba57120c279dfb1ad83c3bb2e3309563f15c90a1a04a9f3acb5aac3a527432a87d1bb7ba32846dc75bda961b162db16

Score
10/10
icedidsmokeloader1875681804backdoorbankertrojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://directorycart.com/upload/

http://tierzahnarzt.at/upload/

http://streetofcards.com/upload/

http://ycdfzd.com/upload/

http://successcoachceo.com/upload/

http://uhvu.cn/upload/

http://japanarticle.com/upload/
rc4.i32
rc4.i32

Extracted

Family

icedid

Campaign

1875681804

C2

enticationmetho.ink

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies system certificate store 2 TTPs 4 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Fri0541e16ce794d258f.exe
    "C:\Users\Admin\AppData\Local\Temp\Fri0541e16ce794d258f.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:1504
  • C:\Users\Admin\AppData\Local\Temp\1268.exe
    C:\Users\Admin\AppData\Local\Temp\1268.exe
    1⤵
    • Executes dropped EXE
    • Modifies system certificate store
    PID:1220
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {227DA936-B68F-428E-AA09-FB4CB6865589} S-1-5-21-2955169046-2371869340-1800780948-1000:UKNHJUQT\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1820
    • C:\Users\Admin\AppData\Roaming\afdtffd
      C:\Users\Admin\AppData\Roaming\afdtffd
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:1828
    • C:\Program Files\Mozilla Firefox\default-browser-agent.exe
      "C:\Program Files\Mozilla Firefox\default-browser-agent.exe" do-task
      2⤵
        PID:1600
      • C:\Program Files\Mozilla Firefox\default-browser-agent.exe
        "C:\Program Files\Mozilla Firefox\default-browser-agent.exe" do-task
        2⤵
          PID:1664
      • C:\Windows\system32\taskeng.exe
        taskeng.exe {0DF371F4-5C85-4C01-843C-FEA52F461702} S-1-5-18:NT AUTHORITY\System:Service:
        1⤵
          PID:1784
        • C:\Windows\system32\taskeng.exe
          taskeng.exe {842F1B2F-D0C7-426E-A59D-92562E936F39} S-1-5-18:NT AUTHORITY\System:Service:
          1⤵
            PID:964
          • C:\Windows\system32\taskeng.exe
            taskeng.exe {5F5A6159-9EB0-429E-82AD-34EEE7AFE2E6} S-1-5-21-2955169046-2371869340-1800780948-1000:UKNHJUQT\Admin:Interactive:[1]
            1⤵
            • Suspicious use of WriteProcessMemory
            PID:1060
            • C:\Users\Admin\AppData\Roaming\afdtffd
              C:\Users\Admin\AppData\Roaming\afdtffd
              2⤵
              • Executes dropped EXE
              • Checks SCSI registry key(s)
              • Suspicious behavior: MapViewOfSection
              PID:1896
          • C:\Windows\system32\taskeng.exe
            taskeng.exe {8C232EF4-430D-4736-845D-B1313EAA73F2} S-1-5-21-2955169046-2371869340-1800780948-1000:UKNHJUQT\Admin:Interactive:[1]
            1⤵
            • Suspicious use of WriteProcessMemory
            PID:1372
            • C:\Users\Admin\AppData\Roaming\afdtffd
              C:\Users\Admin\AppData\Roaming\afdtffd
              2⤵
              • Executes dropped EXE
              • Checks SCSI registry key(s)
              • Suspicious behavior: MapViewOfSection
              PID:904

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Initial Access

          Execution

          Persistence

          Privilege Escalation

          Defense Evasion

          Install Root Certificate

          1
          T1130

          Modify Registry

          1
          T1112

          Credential Access

          Discovery

          Query Registry

          1
          T1012

          Peripheral Device Discovery

          1
          T1120

          System Information Discovery

          1
          T1082

          Lateral Movement

          Collection

          Exfiltration

          Command and Control

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\1268.exe
            MD5

            81fc38de5b6197c4db58eb506037e7cb

            SHA1

            c2258ab3204e6061d548df202c99aa361242d848

            SHA256

            2b9cba43290c9d4cc2d6a47432ddac5752c63e5ac519c2056ba466580424ed3b

            SHA512

            4c96e9104e55454e741a13be34a7c5a3afb8d0d17c1924d629acbd487975d88d4435fd46b34649defe2d047ff4c84e06c4a0d0176085c7b5ab4d80eed18b0d9a

            Download Submit
          • C:\Users\Admin\AppData\Roaming\afdtffd
            MD5

            dec69c757ce1ae8454f97ef6966aa817

            SHA1

            160d556701a012ab18194aeecaa396e21727c9b2

            SHA256

            2b396ae1fa95ef655bb7b0eb45532a857d882bb601adeb8fb1b5d43dcff9ec31

            SHA512

            c6304aa1a5b762804c81461fb1db1bae9ba57120c279dfb1ad83c3bb2e3309563f15c90a1a04a9f3acb5aac3a527432a87d1bb7ba32846dc75bda961b162db16

            Download Submit
          • C:\Users\Admin\AppData\Roaming\afdtffd
            MD5

            dec69c757ce1ae8454f97ef6966aa817

            SHA1

            160d556701a012ab18194aeecaa396e21727c9b2

            SHA256

            2b396ae1fa95ef655bb7b0eb45532a857d882bb601adeb8fb1b5d43dcff9ec31

            SHA512

            c6304aa1a5b762804c81461fb1db1bae9ba57120c279dfb1ad83c3bb2e3309563f15c90a1a04a9f3acb5aac3a527432a87d1bb7ba32846dc75bda961b162db16

            Download Submit
          • C:\Users\Admin\AppData\Roaming\afdtffd
            MD5

            dec69c757ce1ae8454f97ef6966aa817

            SHA1

            160d556701a012ab18194aeecaa396e21727c9b2

            SHA256

            2b396ae1fa95ef655bb7b0eb45532a857d882bb601adeb8fb1b5d43dcff9ec31

            SHA512

            c6304aa1a5b762804c81461fb1db1bae9ba57120c279dfb1ad83c3bb2e3309563f15c90a1a04a9f3acb5aac3a527432a87d1bb7ba32846dc75bda961b162db16

            Download Submit
          • C:\Users\Admin\AppData\Roaming\afdtffd
            MD5

            dec69c757ce1ae8454f97ef6966aa817

            SHA1

            160d556701a012ab18194aeecaa396e21727c9b2

            SHA256

            2b396ae1fa95ef655bb7b0eb45532a857d882bb601adeb8fb1b5d43dcff9ec31

            SHA512

            c6304aa1a5b762804c81461fb1db1bae9ba57120c279dfb1ad83c3bb2e3309563f15c90a1a04a9f3acb5aac3a527432a87d1bb7ba32846dc75bda961b162db16

            Download Submit
          • \Users\Admin\AppData\Local\Temp\1268.exe
            MD5

            81fc38de5b6197c4db58eb506037e7cb

            SHA1

            c2258ab3204e6061d548df202c99aa361242d848

            SHA256

            2b9cba43290c9d4cc2d6a47432ddac5752c63e5ac519c2056ba466580424ed3b

            SHA512

            4c96e9104e55454e741a13be34a7c5a3afb8d0d17c1924d629acbd487975d88d4435fd46b34649defe2d047ff4c84e06c4a0d0176085c7b5ab4d80eed18b0d9a

            Download Submit
          • \Users\Admin\AppData\Local\Temp\1268.exe
            MD5

            81fc38de5b6197c4db58eb506037e7cb

            SHA1

            c2258ab3204e6061d548df202c99aa361242d848

            SHA256

            2b9cba43290c9d4cc2d6a47432ddac5752c63e5ac519c2056ba466580424ed3b

            SHA512

            4c96e9104e55454e741a13be34a7c5a3afb8d0d17c1924d629acbd487975d88d4435fd46b34649defe2d047ff4c84e06c4a0d0176085c7b5ab4d80eed18b0d9a

            Download Submit
          • memory/904-82-0x0000000000A08000-0x0000000000A19000-memory.dmp
            Filesize

            68KB

            Download
          • memory/904-80-0x0000000000000000-mapping.dmp
            Download
          • memory/904-84-0x0000000000400000-0x0000000000877000-memory.dmp
            Filesize

            4.5MB

            Download
          • memory/1220-62-0x0000000000000000-mapping.dmp
            Download
          • memory/1220-64-0x0000000140000000-0x0000000140009000-memory.dmp
            Filesize

            36KB

            Download
          • memory/1228-79-0x0000000002C90000-0x0000000002CA6000-memory.dmp
            Filesize

            88KB

            Download
          • memory/1228-59-0x0000000002700000-0x0000000002716000-memory.dmp
            Filesize

            88KB

            Download
          • memory/1228-85-0x0000000002CC0000-0x0000000002CD6000-memory.dmp
            Filesize

            88KB

            Download
          • memory/1228-71-0x0000000002C60000-0x0000000002C76000-memory.dmp
            Filesize

            88KB

            Download
          • memory/1504-55-0x0000000000A09000-0x0000000000A19000-memory.dmp
            Filesize

            64KB

            Download
          • memory/1504-57-0x0000000000020000-0x0000000000029000-memory.dmp
            Filesize

            36KB

            Download
          • memory/1504-58-0x0000000000400000-0x0000000000877000-memory.dmp
            Filesize

            4.5MB

            Download
          • memory/1504-56-0x00000000755A1000-0x00000000755A3000-memory.dmp
            Filesize

            8KB

            Download
          • memory/1600-72-0x0000000000000000-mapping.dmp
            Download
          • memory/1664-73-0x0000000000000000-mapping.dmp
            Download
          • memory/1828-70-0x0000000000400000-0x0000000000877000-memory.dmp
            Filesize

            4.5MB

            Download
          • memory/1828-68-0x0000000000A68000-0x0000000000A79000-memory.dmp
            Filesize

            68KB

            Download
          • memory/1828-66-0x0000000000000000-mapping.dmp
            Download
          • memory/1896-78-0x0000000000400000-0x0000000000877000-memory.dmp
            Filesize

            4.5MB

            Download
          • memory/1896-76-0x0000000000958000-0x0000000000969000-memory.dmp
            Filesize

            68KB

            Download
          • memory/1896-74-0x0000000000000000-mapping.dmp
            Download