Analysis
-
max time kernel
149s -
max time network
24s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
02-11-2021 05:54
Static task
static1
Behavioral task
behavioral1
Sample
cee70bbff7252de60edb252375f04c75.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
cee70bbff7252de60edb252375f04c75.exe
Resource
win10-en-20211014
General
-
Target
cee70bbff7252de60edb252375f04c75.exe
-
Size
156KB
-
MD5
cee70bbff7252de60edb252375f04c75
-
SHA1
266da1b345e211152f3a154972b9f33cc7ae35c4
-
SHA256
c1deab06872502529f51206d579ff41c674cc993b02d8db5f5c57620ff202cb6
-
SHA512
c0f04dc4961784a5dde0e150dd24dc6105051f0d1e7f35516eb56494ddfe10ee28e18f5f55c0b13caac3bc8169ef5af7bb0a815cf61ad488b2727a6c92f6fa31
Malware Config
Extracted
smokeloader
2020
http://honawey70.top/
http://wijibui00.top/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
cee70bbff7252de60edb252375f04c75.exedescription pid process target process PID 1112 set thread context of 1544 1112 cee70bbff7252de60edb252375f04c75.exe cee70bbff7252de60edb252375f04c75.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
cee70bbff7252de60edb252375f04c75.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cee70bbff7252de60edb252375f04c75.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cee70bbff7252de60edb252375f04c75.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cee70bbff7252de60edb252375f04c75.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
cee70bbff7252de60edb252375f04c75.exepid process 1544 cee70bbff7252de60edb252375f04c75.exe 1544 cee70bbff7252de60edb252375f04c75.exe 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 1400 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
cee70bbff7252de60edb252375f04c75.exepid process 1544 cee70bbff7252de60edb252375f04c75.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cee70bbff7252de60edb252375f04c75.exedescription pid process target process PID 1112 wrote to memory of 1544 1112 cee70bbff7252de60edb252375f04c75.exe cee70bbff7252de60edb252375f04c75.exe PID 1112 wrote to memory of 1544 1112 cee70bbff7252de60edb252375f04c75.exe cee70bbff7252de60edb252375f04c75.exe PID 1112 wrote to memory of 1544 1112 cee70bbff7252de60edb252375f04c75.exe cee70bbff7252de60edb252375f04c75.exe PID 1112 wrote to memory of 1544 1112 cee70bbff7252de60edb252375f04c75.exe cee70bbff7252de60edb252375f04c75.exe PID 1112 wrote to memory of 1544 1112 cee70bbff7252de60edb252375f04c75.exe cee70bbff7252de60edb252375f04c75.exe PID 1112 wrote to memory of 1544 1112 cee70bbff7252de60edb252375f04c75.exe cee70bbff7252de60edb252375f04c75.exe PID 1112 wrote to memory of 1544 1112 cee70bbff7252de60edb252375f04c75.exe cee70bbff7252de60edb252375f04c75.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cee70bbff7252de60edb252375f04c75.exe"C:\Users\Admin\AppData\Local\Temp\cee70bbff7252de60edb252375f04c75.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cee70bbff7252de60edb252375f04c75.exe"C:\Users\Admin\AppData\Local\Temp\cee70bbff7252de60edb252375f04c75.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1112-56-0x0000000000220000-0x0000000000228000-memory.dmpFilesize
32KB
-
memory/1112-57-0x0000000000230000-0x0000000000239000-memory.dmpFilesize
36KB
-
memory/1400-58-0x0000000002580000-0x0000000002596000-memory.dmpFilesize
88KB
-
memory/1544-53-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1544-54-0x0000000000402DF8-mapping.dmp
-
memory/1544-55-0x00000000751A1000-0x00000000751A3000-memory.dmpFilesize
8KB