Analysis
- max time kernel
160s - max time network
174s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
22/10/2021, 18:44
Static task
static1
Behavioral task
behavioral1
Sample
98b15cf42082a0f58b2e0183478b64a2.exe
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
98b15cf42082a0f58b2e0183478b64a2.exe
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
General
- Target 98b15cf42082a0f58b2e0183478b64a2.exe
- Size 344KB
- Sample211022-xdjpfscad2
- SHA256 118d0ce35d4f5528b2883f244355ff9cee93dcc8ca25bdd9a121f503df979e61
- MD5 98b15cf42082a0f58b2e0183478b64a2
- SHA1 fa62eaacda5309a82f31c5ddcac8484ca361e787
- SHA512 b50afc31910ec244cd69f650532918c9dadf0fdbc28d812cb0e8301fe741a8be974efa6eb7c14b5d682df92125380d8ab7838ca4443d436afd303bfe84c5a98a
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://gejajoo7.top/
-
http://sysaheu9.top/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Deletes itself 1 IoCs
pid Process 2872 Process not Found - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3560 set thread context of 2384 3560 98b15cf42082a0f58b2e0183478b64a2.exe 69 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 98b15cf42082a0f58b2e0183478b64a2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 98b15cf42082a0f58b2e0183478b64a2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 98b15cf42082a0f58b2e0183478b64a2.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2384 98b15cf42082a0f58b2e0183478b64a2.exe 2384 98b15cf42082a0f58b2e0183478b64a2.exe 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found 2872 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2872 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2384 98b15cf42082a0f58b2e0183478b64a2.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3560 wrote to memory of 2384 3560 98b15cf42082a0f58b2e0183478b64a2.exe 69 PID 3560 wrote to memory of 2384 3560 98b15cf42082a0f58b2e0183478b64a2.exe 69 PID 3560 wrote to memory of 2384 3560 98b15cf42082a0f58b2e0183478b64a2.exe 69 PID 3560 wrote to memory of 2384 3560 98b15cf42082a0f58b2e0183478b64a2.exe 69 PID 3560 wrote to memory of 2384 3560 98b15cf42082a0f58b2e0183478b64a2.exe 69 PID 3560 wrote to memory of 2384 3560 98b15cf42082a0f58b2e0183478b64a2.exe 69
Processes
-
C:\Users\Admin\AppData\Local\Temp\98b15cf42082a0f58b2e0183478b64a2.exe"C:\Users\Admin\AppData\Local\Temp\98b15cf42082a0f58b2e0183478b64a2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\98b15cf42082a0f58b2e0183478b64a2.exe"C:\Users\Admin\AppData\Local\Temp\98b15cf42082a0f58b2e0183478b64a2.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2384
-