Overview

overview

10

Static

static

e5bda93ec7...be.exe

windows7_x64

10

e5bda93ec7...be.exe

windows10_x64

10

Analysis

  • max time kernel
    153s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-en-20211014
  • submitted
    28-10-2021 16:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e5bda93ec7d8724ce496359c5e3efabe.exe

  • Size

    185KB

  • MD5

    e5bda93ec7d8724ce496359c5e3efabe

  • SHA1

    ad9e1db817d0c69760155939c2fd633031f10418

  • SHA256

    0610000cdfda33355202ed75a2f542cf035207e5d26d5e4b11063a17cdcdc8be

  • SHA512

    53a1e16ab40c0173248b9adf8bb4ecf04fef532301581c63b3876803c8234185fedf4dd588d768e29b610dd5ecc62f933dd79427f086c89741768e5c8cfe9948

Score
10/10
smokeloaderbackdoorsuricatatrojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://brandyjaggers.com/upload/

http://andbal.com/upload/

http://alotofquotes.com/upload/

http://szpnc.cn/upload/

http://uggeboots.com/upload/

http://100klv.com/upload/

http://rapmusic.at/upload/
rc4.i32
rc4.i32

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e5bda93ec7d8724ce496359c5e3efabe.exe
    "C:\Users\Admin\AppData\Local\Temp\e5bda93ec7d8724ce496359c5e3efabe.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:464
  • C:\Users\Admin\AppData\Local\Temp\712.exe
    C:\Users\Admin\AppData\Local\Temp\712.exe
    1⤵
    • Executes dropped EXE
    PID:1084

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\712.exe
    MD5

    63151e4f7c3972f18a23c0e9996e14ef

    SHA1

    5d041fde6433a8ff8fc78a69fca1fd4630e3f270

    SHA256

    cc28e327610e9deb6551c99a32a44fec86220f2840276474ded747580af850d3

    SHA512

    f08c402f0a966cbe89fae0b5f9aa8536d6313dada788486a4db422a042769713a2896753acd47223348349b9960b5cde9470cc862668e2cdb90a6fcc1b87c8ec

    Download Submit
  • \Users\Admin\AppData\Local\Temp\712.exe
    MD5

    63151e4f7c3972f18a23c0e9996e14ef

    SHA1

    5d041fde6433a8ff8fc78a69fca1fd4630e3f270

    SHA256

    cc28e327610e9deb6551c99a32a44fec86220f2840276474ded747580af850d3

    SHA512

    f08c402f0a966cbe89fae0b5f9aa8536d6313dada788486a4db422a042769713a2896753acd47223348349b9960b5cde9470cc862668e2cdb90a6fcc1b87c8ec

    Download Submit
  • \Users\Admin\AppData\Local\Temp\712.exe
    MD5

    63151e4f7c3972f18a23c0e9996e14ef

    SHA1

    5d041fde6433a8ff8fc78a69fca1fd4630e3f270

    SHA256

    cc28e327610e9deb6551c99a32a44fec86220f2840276474ded747580af850d3

    SHA512

    f08c402f0a966cbe89fae0b5f9aa8536d6313dada788486a4db422a042769713a2896753acd47223348349b9960b5cde9470cc862668e2cdb90a6fcc1b87c8ec

    Download Submit
  • memory/464-55-0x00000000001C0000-0x00000000001C8000-memory.dmp
    Filesize

    32KB

    Download
  • memory/464-57-0x00000000764D1000-0x00000000764D3000-memory.dmp
    Filesize

    8KB

    Download
  • memory/464-58-0x0000000000400000-0x0000000002EF4000-memory.dmp
    Filesize

    43.0MB

    Download
  • memory/464-56-0x00000000001D0000-0x00000000001D9000-memory.dmp
    Filesize

    36KB

    Download
  • memory/1084-62-0x0000000000000000-mapping.dmp
    Download
  • memory/1084-64-0x0000000028302000-0x0000000028304000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1084-65-0x00000000412B0000-0x00000000416AF000-memory.dmp
    Filesize

    4.0MB

    Download
  • memory/1084-68-0x0000000028306000-0x0000000028307000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1084-67-0x0000000028304000-0x0000000028306000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1084-69-0x0000000028307000-0x0000000028308000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1268-59-0x0000000002B60000-0x0000000002B76000-memory.dmp
    Filesize

    88KB

    Download