Analysis
- max time kernel
152s - max time network
125s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
24/10/2021, 01:11
General
- Target 74b87a77e94e9c3e0d8a3ac50364a50d.exe
- Size 260KB
- Sample211024-bjx85scfg3
- SHA256 a9596dcde2bcac8dba040c1bbc19801a5dcffd86944375f706f191110c3e7e8a
Malware Config
Extracted
-
smokeloader
-
2020
-
http://directorycart.com/upload/
-
http://tierzahnarzt.at/upload/
-
http://streetofcards.com/upload/
-
http://ycdfzd.com/upload/
-
http://successcoachceo.com/upload/
-
http://uhvu.cn/upload/
-
http://japanarticle.com/upload/
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 2 IoCs
- Deletes itself 1 IoCs
- Drops startup file 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\74b87a77e94e9c3e0d8a3ac50364a50d.exe"C:\Users\Admin\AppData\Local\Temp\74b87a77e94e9c3e0d8a3ac50364a50d.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\8E32.exeC:\Users\Admin\AppData\Local\Temp\8E32.exe1⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/392-118-0x00000000003B0000-0x00000000003C6000-memory.dmp
memory/2156-128-0x0000000000B8E000-0x0000000000C0E000-memory.dmp
memory/2156-129-0x0000000000400000-0x00000000008F2000-memory.dmp
memory/3116-115-0x00000000031C9000-0x00000000031D2000-memory.dmp
memory/3116-116-0x0000000003030000-0x0000000003039000-memory.dmp
memory/3116-117-0x0000000000400000-0x0000000002F09000-memory.dmp
memory/3620-123-0x0000000000C20000-0x0000000000CB1000-memory.dmp
memory/3620-124-0x0000000000400000-0x00000000008F2000-memory.dmp