Overview

overview

10

Static

static

Fri0541e16...8f.exe

windows7_x64

10

Fri0541e16...8f.exe

windows7_x64

10

Fri0541e16...8f.exe

windows7_x64

10

Fri0541e16...8f.exe

windows11_x64

10

Fri0541e16...8f.exe

windows10_x64

10

Fri0541e16...8f.exe

windows10_x64

10

Fri0541e16...8f.exe

windows10_x64

10

Analysis

  • max time kernel
    1802s
  • max time network
    1816s
  • platform
    windows10_x64
  • resource
    win10-de-20210920
  • submitted
    22-10-2021 14:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Fri0541e16ce794d258f.exe

  • Size

    284KB

  • MD5

    dec69c757ce1ae8454f97ef6966aa817

  • SHA1

    160d556701a012ab18194aeecaa396e21727c9b2

  • SHA256

    2b396ae1fa95ef655bb7b0eb45532a857d882bb601adeb8fb1b5d43dcff9ec31

  • SHA512

    c6304aa1a5b762804c81461fb1db1bae9ba57120c279dfb1ad83c3bb2e3309563f15c90a1a04a9f3acb5aac3a527432a87d1bb7ba32846dc75bda961b162db16

Score
10/10
icedidsmokeloader1875681804backdoorbankerpersistencetrojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://directorycart.com/upload/

http://tierzahnarzt.at/upload/

http://streetofcards.com/upload/

http://ycdfzd.com/upload/

http://successcoachceo.com/upload/

http://uhvu.cn/upload/

http://japanarticle.com/upload/
rc4.i32
rc4.i32

Extracted

Family

icedid

Campaign

1875681804

C2

enticationmetho.ink

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid
  • Registers COM server for autorun 1 TTPs
    persistence
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Deletes itself 1 IoCs
  • Drops file in System32 directory 4 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 23 IoCs
  • Modifies registry class 47 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Fri0541e16ce794d258f.exe
    "C:\Users\Admin\AppData\Local\Temp\Fri0541e16ce794d258f.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:2892
  • C:\Users\Admin\AppData\Local\Temp\922A.exe
    C:\Users\Admin\AppData\Local\Temp\922A.exe
    1⤵
    • Executes dropped EXE
    PID:2388
  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.196.0921.0007\FileSyncConfig.exe
    "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.196.0921.0007\FileSyncConfig.exe"
    1⤵
    • Modifies registry class
    PID:1636
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe
    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylevel=False
    1⤵
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:2192

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\922A.exe
    MD5

    81fc38de5b6197c4db58eb506037e7cb

    SHA1

    c2258ab3204e6061d548df202c99aa361242d848

    SHA256

    2b9cba43290c9d4cc2d6a47432ddac5752c63e5ac519c2056ba466580424ed3b

    SHA512

    4c96e9104e55454e741a13be34a7c5a3afb8d0d17c1924d629acbd487975d88d4435fd46b34649defe2d047ff4c84e06c4a0d0176085c7b5ab4d80eed18b0d9a

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\922A.exe
    MD5

    81fc38de5b6197c4db58eb506037e7cb

    SHA1

    c2258ab3204e6061d548df202c99aa361242d848

    SHA256

    2b9cba43290c9d4cc2d6a47432ddac5752c63e5ac519c2056ba466580424ed3b

    SHA512

    4c96e9104e55454e741a13be34a7c5a3afb8d0d17c1924d629acbd487975d88d4435fd46b34649defe2d047ff4c84e06c4a0d0176085c7b5ab4d80eed18b0d9a

    Download Submit
  • memory/2124-121-0x0000000001120000-0x0000000001136000-memory.dmp
    Filesize

    88KB

    Download
  • memory/2388-122-0x0000000000000000-mapping.dmp
    Download
  • memory/2388-125-0x0000000140000000-0x0000000140009000-memory.dmp
    Filesize

    36KB

    Download
  • memory/2892-120-0x0000000000400000-0x0000000000877000-memory.dmp
    Filesize

    4.5MB

    Download
  • memory/2892-119-0x0000000000030000-0x0000000000039000-memory.dmp
    Filesize

    36KB

    Download