Analysis
- max time kernel
152s - max time network
125s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
25/10/2021, 12:01
General
- Target 9be0117edb0e6fbcd3c91658bb6df660.exe
- Size 233KB
- Sample211025-n6weaahaap
- SHA256 3f8dd3b7ef785b2df8931256b48b2f7967163840fa85080fecdbeb07e89391bf
Malware Config
Extracted
-
smokeloader
-
2020
-
http://directorycart.com/upload/
-
http://tierzahnarzt.at/upload/
-
http://streetofcards.com/upload/
-
http://ycdfzd.com/upload/
-
http://successcoachceo.com/upload/
-
http://uhvu.cn/upload/
-
http://japanarticle.com/upload/
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 2 IoCs
- Deletes itself 1 IoCs
- Drops startup file 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9be0117edb0e6fbcd3c91658bb6df660.exe"C:\Users\Admin\AppData\Local\Temp\9be0117edb0e6fbcd3c91658bb6df660.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\9798.exeC:\Users\Admin\AppData\Local\Temp\9798.exe1⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1048-123-0x00000000008C0000-0x0000000000951000-memory.dmp
memory/1048-124-0x0000000000400000-0x00000000005DC000-memory.dmp
memory/2596-117-0x0000000000400000-0x0000000002F02000-memory.dmp
memory/2596-116-0x0000000003040000-0x000000000318A000-memory.dmp
memory/2596-115-0x0000000003209000-0x0000000003212000-memory.dmp
memory/2792-128-0x0000000000768000-0x00000000007E8000-memory.dmp
memory/2792-129-0x0000000000400000-0x00000000005DC000-memory.dmp
memory/3028-118-0x0000000000C80000-0x0000000000C96000-memory.dmp