Analysis
-
max time kernel
156s -
max time network
182s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
22-10-2021 18:44
Static task
static1
Behavioral task
behavioral1
Sample
344125656ea9ae92a0dd9738771d4502.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
344125656ea9ae92a0dd9738771d4502.exe
Resource
win10-en-20211014
General
-
Target
344125656ea9ae92a0dd9738771d4502.exe
-
Size
343KB
-
MD5
344125656ea9ae92a0dd9738771d4502
-
SHA1
3c0aabd867110d01aeb285713424662cb3dd4bdb
-
SHA256
8a529c4d939a4c2945ed6f545f70dd639fc9e42262971c98a2710dd9a1fcd5ba
-
SHA512
dea4aa84057ccdc6da23540f963a99ffbd377d36e91a4da1c5f0f4acf9d56ef10bd231e716b920c9dabfa05855561035298e847b7afa6be0f6a588eeac55b423
Malware Config
Extracted
smokeloader
2020
http://gejajoo7.top/
http://sysaheu9.top/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1272 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
344125656ea9ae92a0dd9738771d4502.exedescription pid process target process PID 832 set thread context of 876 832 344125656ea9ae92a0dd9738771d4502.exe 344125656ea9ae92a0dd9738771d4502.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
344125656ea9ae92a0dd9738771d4502.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 344125656ea9ae92a0dd9738771d4502.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 344125656ea9ae92a0dd9738771d4502.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 344125656ea9ae92a0dd9738771d4502.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
344125656ea9ae92a0dd9738771d4502.exepid process 876 344125656ea9ae92a0dd9738771d4502.exe 876 344125656ea9ae92a0dd9738771d4502.exe 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1272 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
344125656ea9ae92a0dd9738771d4502.exepid process 876 344125656ea9ae92a0dd9738771d4502.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
344125656ea9ae92a0dd9738771d4502.exedescription pid process target process PID 832 wrote to memory of 876 832 344125656ea9ae92a0dd9738771d4502.exe 344125656ea9ae92a0dd9738771d4502.exe PID 832 wrote to memory of 876 832 344125656ea9ae92a0dd9738771d4502.exe 344125656ea9ae92a0dd9738771d4502.exe PID 832 wrote to memory of 876 832 344125656ea9ae92a0dd9738771d4502.exe 344125656ea9ae92a0dd9738771d4502.exe PID 832 wrote to memory of 876 832 344125656ea9ae92a0dd9738771d4502.exe 344125656ea9ae92a0dd9738771d4502.exe PID 832 wrote to memory of 876 832 344125656ea9ae92a0dd9738771d4502.exe 344125656ea9ae92a0dd9738771d4502.exe PID 832 wrote to memory of 876 832 344125656ea9ae92a0dd9738771d4502.exe 344125656ea9ae92a0dd9738771d4502.exe PID 832 wrote to memory of 876 832 344125656ea9ae92a0dd9738771d4502.exe 344125656ea9ae92a0dd9738771d4502.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\344125656ea9ae92a0dd9738771d4502.exe"C:\Users\Admin\AppData\Local\Temp\344125656ea9ae92a0dd9738771d4502.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\344125656ea9ae92a0dd9738771d4502.exe"C:\Users\Admin\AppData\Local\Temp\344125656ea9ae92a0dd9738771d4502.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/832-54-0x0000000000A69000-0x0000000000A79000-memory.dmpFilesize
64KB
-
memory/832-58-0x0000000000020000-0x0000000000029000-memory.dmpFilesize
36KB
-
memory/876-56-0x0000000000402EE8-mapping.dmp
-
memory/876-55-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/876-57-0x0000000074F81000-0x0000000074F83000-memory.dmpFilesize
8KB
-
memory/1272-59-0x0000000001DD0000-0x0000000001DE6000-memory.dmpFilesize
88KB