Analysis
- max time kernel
154s - max time network
162s - platform
windows7_x64 - resource
win7-en-20211014 - submitted
22/10/2021, 18:44
Static task
static1
Behavioral task
behavioral1
Sample
98b15cf42082a0f58b2e0183478b64a2.exe
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
98b15cf42082a0f58b2e0183478b64a2.exe
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
General
- Target 98b15cf42082a0f58b2e0183478b64a2.exe
- Size 344KB
- Sample211022-xdjpfscad2
- SHA256 118d0ce35d4f5528b2883f244355ff9cee93dcc8ca25bdd9a121f503df979e61
- MD5 98b15cf42082a0f58b2e0183478b64a2
- SHA1 fa62eaacda5309a82f31c5ddcac8484ca361e787
- SHA512 b50afc31910ec244cd69f650532918c9dadf0fdbc28d812cb0e8301fe741a8be974efa6eb7c14b5d682df92125380d8ab7838ca4443d436afd303bfe84c5a98a
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://gejajoo7.top/
-
http://sysaheu9.top/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Deletes itself 1 IoCs
pid Process 1204 Process not Found - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1288 set thread context of 888 1288 98b15cf42082a0f58b2e0183478b64a2.exe 28 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 98b15cf42082a0f58b2e0183478b64a2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 98b15cf42082a0f58b2e0183478b64a2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 98b15cf42082a0f58b2e0183478b64a2.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 888 98b15cf42082a0f58b2e0183478b64a2.exe 888 98b15cf42082a0f58b2e0183478b64a2.exe 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1204 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 888 98b15cf42082a0f58b2e0183478b64a2.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1204 Process not Found 1204 Process not Found - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1204 Process not Found 1204 Process not Found - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1288 wrote to memory of 888 1288 98b15cf42082a0f58b2e0183478b64a2.exe 28 PID 1288 wrote to memory of 888 1288 98b15cf42082a0f58b2e0183478b64a2.exe 28 PID 1288 wrote to memory of 888 1288 98b15cf42082a0f58b2e0183478b64a2.exe 28 PID 1288 wrote to memory of 888 1288 98b15cf42082a0f58b2e0183478b64a2.exe 28 PID 1288 wrote to memory of 888 1288 98b15cf42082a0f58b2e0183478b64a2.exe 28 PID 1288 wrote to memory of 888 1288 98b15cf42082a0f58b2e0183478b64a2.exe 28 PID 1288 wrote to memory of 888 1288 98b15cf42082a0f58b2e0183478b64a2.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\98b15cf42082a0f58b2e0183478b64a2.exe"C:\Users\Admin\AppData\Local\Temp\98b15cf42082a0f58b2e0183478b64a2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\98b15cf42082a0f58b2e0183478b64a2.exe"C:\Users\Admin\AppData\Local\Temp\98b15cf42082a0f58b2e0183478b64a2.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:888
-