Analysis
-
max time kernel
152s -
max time network
143s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
01-11-2021 10:39
Static task
static1
Behavioral task
behavioral1
Sample
f240a0240746af43de96ce02bc9fb5c8.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
f240a0240746af43de96ce02bc9fb5c8.exe
Resource
win10-en-20211014
General
-
Target
f240a0240746af43de96ce02bc9fb5c8.exe
-
Size
161KB
-
MD5
f240a0240746af43de96ce02bc9fb5c8
-
SHA1
0e962e42bda9d9524a225c6f98e1da3539c4a627
-
SHA256
a706b4a7c2d2a38b2a417f05c34fc5585fc89e31b9ce50438673832a40583967
-
SHA512
0318e5baaf5996ab367ad722480b0c801e93ee1f9e00bc783c39ccddf6fe80b31fd5da25fa8dce2236a26be1be79f0320905b5261b6cd7d0f48de0fbe555fe6a
Malware Config
Extracted
smokeloader
2020
http://honawey70.top/
http://wijibui00.top/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1212 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f240a0240746af43de96ce02bc9fb5c8.exedescription pid process target process PID 860 set thread context of 1100 860 f240a0240746af43de96ce02bc9fb5c8.exe f240a0240746af43de96ce02bc9fb5c8.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
f240a0240746af43de96ce02bc9fb5c8.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f240a0240746af43de96ce02bc9fb5c8.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f240a0240746af43de96ce02bc9fb5c8.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f240a0240746af43de96ce02bc9fb5c8.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
f240a0240746af43de96ce02bc9fb5c8.exepid process 1100 f240a0240746af43de96ce02bc9fb5c8.exe 1100 f240a0240746af43de96ce02bc9fb5c8.exe 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1212 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
f240a0240746af43de96ce02bc9fb5c8.exepid process 1100 f240a0240746af43de96ce02bc9fb5c8.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 1212 1212 -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
pid process 1212 1212 -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
f240a0240746af43de96ce02bc9fb5c8.exedescription pid process target process PID 860 wrote to memory of 1100 860 f240a0240746af43de96ce02bc9fb5c8.exe f240a0240746af43de96ce02bc9fb5c8.exe PID 860 wrote to memory of 1100 860 f240a0240746af43de96ce02bc9fb5c8.exe f240a0240746af43de96ce02bc9fb5c8.exe PID 860 wrote to memory of 1100 860 f240a0240746af43de96ce02bc9fb5c8.exe f240a0240746af43de96ce02bc9fb5c8.exe PID 860 wrote to memory of 1100 860 f240a0240746af43de96ce02bc9fb5c8.exe f240a0240746af43de96ce02bc9fb5c8.exe PID 860 wrote to memory of 1100 860 f240a0240746af43de96ce02bc9fb5c8.exe f240a0240746af43de96ce02bc9fb5c8.exe PID 860 wrote to memory of 1100 860 f240a0240746af43de96ce02bc9fb5c8.exe f240a0240746af43de96ce02bc9fb5c8.exe PID 860 wrote to memory of 1100 860 f240a0240746af43de96ce02bc9fb5c8.exe f240a0240746af43de96ce02bc9fb5c8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f240a0240746af43de96ce02bc9fb5c8.exe"C:\Users\Admin\AppData\Local\Temp\f240a0240746af43de96ce02bc9fb5c8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f240a0240746af43de96ce02bc9fb5c8.exe"C:\Users\Admin\AppData\Local\Temp\f240a0240746af43de96ce02bc9fb5c8.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/860-54-0x0000000000020000-0x0000000000028000-memory.dmpFilesize
32KB
-
memory/860-56-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/1100-55-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1100-57-0x0000000000402DF8-mapping.dmp
-
memory/1100-58-0x0000000075651000-0x0000000075653000-memory.dmpFilesize
8KB
-
memory/1212-59-0x0000000002940000-0x0000000002956000-memory.dmpFilesize
88KB