Analysis
-
max time kernel
152s -
max time network
125s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
29-10-2021 06:38
Static task
static1
Behavioral task
behavioral1
Sample
eb3db5499d6268d825cb9290596230a1.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
eb3db5499d6268d825cb9290596230a1.exe
Resource
win10-en-20210920
General
-
Target
eb3db5499d6268d825cb9290596230a1.exe
-
Size
340KB
-
MD5
eb3db5499d6268d825cb9290596230a1
-
SHA1
80e7b787928df6c7599956c08039d108b96c3e93
-
SHA256
a34d8cb4697d93f0030e651f1e1f66d67c411b3a7b68832c9981ad145a560bd3
-
SHA512
2afe915889886ba28f4acf9bc4f4c031598e7582965ef05d0a461ce9f2ea3c86be72fbe6dbb9fb0285550ba542872542bed6c65804f4b791f0861a0e784f2203
Malware Config
Extracted
smokeloader
2020
http://xacokuo8.top/
http://hajezey1.top/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 2 IoCs
Processes:
utijdujutijdujpid process 1920 utijduj 668 utijduj -
Deletes itself 1 IoCs
Processes:
pid process 3008 -
Suspicious use of SetThreadContext 2 IoCs
Processes:
eb3db5499d6268d825cb9290596230a1.exeutijdujdescription pid process target process PID 1020 set thread context of 1932 1020 eb3db5499d6268d825cb9290596230a1.exe eb3db5499d6268d825cb9290596230a1.exe PID 1920 set thread context of 668 1920 utijduj utijduj -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
utijdujeb3db5499d6268d825cb9290596230a1.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI utijduj Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI eb3db5499d6268d825cb9290596230a1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI eb3db5499d6268d825cb9290596230a1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI eb3db5499d6268d825cb9290596230a1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI utijduj Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI utijduj -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
eb3db5499d6268d825cb9290596230a1.exepid process 1932 eb3db5499d6268d825cb9290596230a1.exe 1932 eb3db5499d6268d825cb9290596230a1.exe 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 3008 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3008 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
eb3db5499d6268d825cb9290596230a1.exeutijdujpid process 1932 eb3db5499d6268d825cb9290596230a1.exe 668 utijduj -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 3008 Token: SeCreatePagefilePrivilege 3008 -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
eb3db5499d6268d825cb9290596230a1.exeutijdujdescription pid process target process PID 1020 wrote to memory of 1932 1020 eb3db5499d6268d825cb9290596230a1.exe eb3db5499d6268d825cb9290596230a1.exe PID 1020 wrote to memory of 1932 1020 eb3db5499d6268d825cb9290596230a1.exe eb3db5499d6268d825cb9290596230a1.exe PID 1020 wrote to memory of 1932 1020 eb3db5499d6268d825cb9290596230a1.exe eb3db5499d6268d825cb9290596230a1.exe PID 1020 wrote to memory of 1932 1020 eb3db5499d6268d825cb9290596230a1.exe eb3db5499d6268d825cb9290596230a1.exe PID 1020 wrote to memory of 1932 1020 eb3db5499d6268d825cb9290596230a1.exe eb3db5499d6268d825cb9290596230a1.exe PID 1020 wrote to memory of 1932 1020 eb3db5499d6268d825cb9290596230a1.exe eb3db5499d6268d825cb9290596230a1.exe PID 1920 wrote to memory of 668 1920 utijduj utijduj PID 1920 wrote to memory of 668 1920 utijduj utijduj PID 1920 wrote to memory of 668 1920 utijduj utijduj PID 1920 wrote to memory of 668 1920 utijduj utijduj PID 1920 wrote to memory of 668 1920 utijduj utijduj PID 1920 wrote to memory of 668 1920 utijduj utijduj
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb3db5499d6268d825cb9290596230a1.exe"C:\Users\Admin\AppData\Local\Temp\eb3db5499d6268d825cb9290596230a1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\eb3db5499d6268d825cb9290596230a1.exe"C:\Users\Admin\AppData\Local\Temp\eb3db5499d6268d825cb9290596230a1.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\utijdujC:\Users\Admin\AppData\Roaming\utijduj1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\utijdujC:\Users\Admin\AppData\Roaming\utijduj2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\utijdujMD5
eb3db5499d6268d825cb9290596230a1
SHA180e7b787928df6c7599956c08039d108b96c3e93
SHA256a34d8cb4697d93f0030e651f1e1f66d67c411b3a7b68832c9981ad145a560bd3
SHA5122afe915889886ba28f4acf9bc4f4c031598e7582965ef05d0a461ce9f2ea3c86be72fbe6dbb9fb0285550ba542872542bed6c65804f4b791f0861a0e784f2203
-
C:\Users\Admin\AppData\Roaming\utijdujMD5
eb3db5499d6268d825cb9290596230a1
SHA180e7b787928df6c7599956c08039d108b96c3e93
SHA256a34d8cb4697d93f0030e651f1e1f66d67c411b3a7b68832c9981ad145a560bd3
SHA5122afe915889886ba28f4acf9bc4f4c031598e7582965ef05d0a461ce9f2ea3c86be72fbe6dbb9fb0285550ba542872542bed6c65804f4b791f0861a0e784f2203
-
C:\Users\Admin\AppData\Roaming\utijdujMD5
eb3db5499d6268d825cb9290596230a1
SHA180e7b787928df6c7599956c08039d108b96c3e93
SHA256a34d8cb4697d93f0030e651f1e1f66d67c411b3a7b68832c9981ad145a560bd3
SHA5122afe915889886ba28f4acf9bc4f4c031598e7582965ef05d0a461ce9f2ea3c86be72fbe6dbb9fb0285550ba542872542bed6c65804f4b791f0861a0e784f2203
-
memory/668-124-0x0000000000402E0C-mapping.dmp
-
memory/1020-115-0x0000000002E49000-0x0000000002E5A000-memory.dmpFilesize
68KB
-
memory/1020-118-0x0000000002BB0000-0x0000000002CFA000-memory.dmpFilesize
1.3MB
-
memory/1920-122-0x0000000002EC9000-0x0000000002EDA000-memory.dmpFilesize
68KB
-
memory/1932-117-0x0000000000402E0C-mapping.dmp
-
memory/1932-116-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3008-119-0x0000000001310000-0x0000000001326000-memory.dmpFilesize
88KB
-
memory/3008-126-0x0000000001330000-0x0000000001346000-memory.dmpFilesize
88KB