Resubmissions

06-11-2021 17:27

211106-v1eynsegh5 10

06-11-2021 17:14

211106-vr22vaegg2 10

06-11-2021 16:59

211106-vhd9escbfk 10

Analysis

  • max time kernel
    600s
  • max time network
    360s
  • platform
    windows7_x64
  • resource
    win7-de-20211104
  • submitted
    06-11-2021 17:14

General

  • Target

    0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exe

  • Size

    201KB

  • MD5

    2f026a4e714a11325ce22490c0558e53

  • SHA1

    89d742acc48ec9a94b2670925cfd31934b022a51

  • SHA256

    0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f

  • SHA512

    512f3d8f193116f67994c34ff8a95b71f032cb2a04be7efb910ebe1460c01e77e2619172f1522ea2de146858a86b0c12982b009ccde20ff46611dc7f1dadee2f

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://hefahei60.top/

http://pipevai40.top/

rc4.i32
rc4.i32

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Executes dropped EXE 2 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exe
    "C:\Users\Admin\AppData\Local\Temp\0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1316
    • C:\Users\Admin\AppData\Local\Temp\0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exe
      "C:\Users\Admin\AppData\Local\Temp\0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:1876
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {0F425055-15FC-4724-B163-3C9738C0CD83} S-1-5-21-103686315-404690609-2047157615-1000:EDWYFHKN\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1740
    • C:\Users\Admin\AppData\Roaming\uuuejts
      C:\Users\Admin\AppData\Roaming\uuuejts
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1548
      • C:\Users\Admin\AppData\Roaming\uuuejts
        C:\Users\Admin\AppData\Roaming\uuuejts
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        • Suspicious behavior: MapViewOfSection
        PID:2028

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\uuuejts
    MD5

    2f026a4e714a11325ce22490c0558e53

    SHA1

    89d742acc48ec9a94b2670925cfd31934b022a51

    SHA256

    0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f

    SHA512

    512f3d8f193116f67994c34ff8a95b71f032cb2a04be7efb910ebe1460c01e77e2619172f1522ea2de146858a86b0c12982b009ccde20ff46611dc7f1dadee2f

  • C:\Users\Admin\AppData\Roaming\uuuejts
    MD5

    2f026a4e714a11325ce22490c0558e53

    SHA1

    89d742acc48ec9a94b2670925cfd31934b022a51

    SHA256

    0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f

    SHA512

    512f3d8f193116f67994c34ff8a95b71f032cb2a04be7efb910ebe1460c01e77e2619172f1522ea2de146858a86b0c12982b009ccde20ff46611dc7f1dadee2f

  • C:\Users\Admin\AppData\Roaming\uuuejts
    MD5

    2f026a4e714a11325ce22490c0558e53

    SHA1

    89d742acc48ec9a94b2670925cfd31934b022a51

    SHA256

    0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f

    SHA512

    512f3d8f193116f67994c34ff8a95b71f032cb2a04be7efb910ebe1460c01e77e2619172f1522ea2de146858a86b0c12982b009ccde20ff46611dc7f1dadee2f

  • \Users\Admin\AppData\Roaming\uuuejts
    MD5

    2f026a4e714a11325ce22490c0558e53

    SHA1

    89d742acc48ec9a94b2670925cfd31934b022a51

    SHA256

    0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f

    SHA512

    512f3d8f193116f67994c34ff8a95b71f032cb2a04be7efb910ebe1460c01e77e2619172f1522ea2de146858a86b0c12982b009ccde20ff46611dc7f1dadee2f

  • memory/1316-59-0x00000000001C0000-0x00000000001C9000-memory.dmp
    Filesize

    36KB

  • memory/1316-58-0x00000000001B0000-0x00000000001B8000-memory.dmp
    Filesize

    32KB

  • memory/1376-60-0x00000000026F0000-0x0000000002706000-memory.dmp
    Filesize

    88KB

  • memory/1376-69-0x0000000002BD0000-0x0000000002BE6000-memory.dmp
    Filesize

    88KB

  • memory/1548-62-0x0000000000000000-mapping.dmp
  • memory/1876-57-0x0000000076141000-0x0000000076143000-memory.dmp
    Filesize

    8KB

  • memory/1876-55-0x0000000000400000-0x0000000000409000-memory.dmp
    Filesize

    36KB

  • memory/1876-56-0x0000000000402EFA-mapping.dmp
  • memory/2028-66-0x0000000000402EFA-mapping.dmp