Resubmissions
06-11-2021 17:27
211106-v1eynsegh5 1006-11-2021 17:14
211106-vr22vaegg2 1006-11-2021 16:59
211106-vhd9escbfk 10Analysis
-
max time kernel
600s -
max time network
360s -
platform
windows7_x64 -
resource
win7-de-20211104 -
submitted
06-11-2021 17:14
Static task
static1
Behavioral task
behavioral1
Sample
0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exe
Resource
win7-ja-20211104
Behavioral task
behavioral2
Sample
0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exe
Resource
win7-en-20211014
Behavioral task
behavioral3
Sample
0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exe
Resource
win7-de-20211104
Behavioral task
behavioral4
Sample
0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exe
Resource
win11
Behavioral task
behavioral5
Sample
0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exe
Resource
win10-ja-20211014
Behavioral task
behavioral6
Sample
0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exe
Resource
win10-en-20211014
Behavioral task
behavioral7
Sample
0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exe
Resource
win10-de-20211104
General
-
Target
0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exe
-
Size
201KB
-
MD5
2f026a4e714a11325ce22490c0558e53
-
SHA1
89d742acc48ec9a94b2670925cfd31934b022a51
-
SHA256
0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f
-
SHA512
512f3d8f193116f67994c34ff8a95b71f032cb2a04be7efb910ebe1460c01e77e2619172f1522ea2de146858a86b0c12982b009ccde20ff46611dc7f1dadee2f
Malware Config
Extracted
smokeloader
2020
http://hefahei60.top/
http://pipevai40.top/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 2 IoCs
Processes:
uuuejtsuuuejtspid process 1548 uuuejts 2028 uuuejts -
Deletes itself 1 IoCs
Processes:
pid process 1376 -
Loads dropped DLL 1 IoCs
Processes:
uuuejtspid process 1548 uuuejts -
Suspicious use of SetThreadContext 2 IoCs
Processes:
0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exeuuuejtsdescription pid process target process PID 1316 set thread context of 1876 1316 0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exe 0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exe PID 1548 set thread context of 2028 1548 uuuejts uuuejts -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exeuuuejtsdescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI uuuejts Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI uuuejts Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI uuuejts Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exepid process 1876 0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exe 1876 0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exe 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1376 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exeuuuejtspid process 1876 0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exe 2028 uuuejts -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 1376 Token: SeShutdownPrivilege 1376 -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 1376 1376 -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
pid process 1376 1376 -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exetaskeng.exeuuuejtsdescription pid process target process PID 1316 wrote to memory of 1876 1316 0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exe 0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exe PID 1316 wrote to memory of 1876 1316 0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exe 0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exe PID 1316 wrote to memory of 1876 1316 0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exe 0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exe PID 1316 wrote to memory of 1876 1316 0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exe 0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exe PID 1316 wrote to memory of 1876 1316 0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exe 0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exe PID 1316 wrote to memory of 1876 1316 0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exe 0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exe PID 1316 wrote to memory of 1876 1316 0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exe 0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exe PID 1740 wrote to memory of 1548 1740 taskeng.exe uuuejts PID 1740 wrote to memory of 1548 1740 taskeng.exe uuuejts PID 1740 wrote to memory of 1548 1740 taskeng.exe uuuejts PID 1740 wrote to memory of 1548 1740 taskeng.exe uuuejts PID 1548 wrote to memory of 2028 1548 uuuejts uuuejts PID 1548 wrote to memory of 2028 1548 uuuejts uuuejts PID 1548 wrote to memory of 2028 1548 uuuejts uuuejts PID 1548 wrote to memory of 2028 1548 uuuejts uuuejts PID 1548 wrote to memory of 2028 1548 uuuejts uuuejts PID 1548 wrote to memory of 2028 1548 uuuejts uuuejts PID 1548 wrote to memory of 2028 1548 uuuejts uuuejts
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exe"C:\Users\Admin\AppData\Local\Temp\0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exe"C:\Users\Admin\AppData\Local\Temp\0f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\taskeng.exetaskeng.exe {0F425055-15FC-4724-B163-3C9738C0CD83} S-1-5-21-103686315-404690609-2047157615-1000:EDWYFHKN\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\uuuejtsC:\Users\Admin\AppData\Roaming\uuuejts2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\uuuejtsC:\Users\Admin\AppData\Roaming\uuuejts3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\uuuejtsMD5
2f026a4e714a11325ce22490c0558e53
SHA189d742acc48ec9a94b2670925cfd31934b022a51
SHA2560f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f
SHA512512f3d8f193116f67994c34ff8a95b71f032cb2a04be7efb910ebe1460c01e77e2619172f1522ea2de146858a86b0c12982b009ccde20ff46611dc7f1dadee2f
-
C:\Users\Admin\AppData\Roaming\uuuejtsMD5
2f026a4e714a11325ce22490c0558e53
SHA189d742acc48ec9a94b2670925cfd31934b022a51
SHA2560f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f
SHA512512f3d8f193116f67994c34ff8a95b71f032cb2a04be7efb910ebe1460c01e77e2619172f1522ea2de146858a86b0c12982b009ccde20ff46611dc7f1dadee2f
-
C:\Users\Admin\AppData\Roaming\uuuejtsMD5
2f026a4e714a11325ce22490c0558e53
SHA189d742acc48ec9a94b2670925cfd31934b022a51
SHA2560f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f
SHA512512f3d8f193116f67994c34ff8a95b71f032cb2a04be7efb910ebe1460c01e77e2619172f1522ea2de146858a86b0c12982b009ccde20ff46611dc7f1dadee2f
-
\Users\Admin\AppData\Roaming\uuuejtsMD5
2f026a4e714a11325ce22490c0558e53
SHA189d742acc48ec9a94b2670925cfd31934b022a51
SHA2560f7361229bd8aa3f5a812eaa812bb2289d97b9f7d82b103d1c90dc333c0be10f
SHA512512f3d8f193116f67994c34ff8a95b71f032cb2a04be7efb910ebe1460c01e77e2619172f1522ea2de146858a86b0c12982b009ccde20ff46611dc7f1dadee2f
-
memory/1316-59-0x00000000001C0000-0x00000000001C9000-memory.dmpFilesize
36KB
-
memory/1316-58-0x00000000001B0000-0x00000000001B8000-memory.dmpFilesize
32KB
-
memory/1376-60-0x00000000026F0000-0x0000000002706000-memory.dmpFilesize
88KB
-
memory/1376-69-0x0000000002BD0000-0x0000000002BE6000-memory.dmpFilesize
88KB
-
memory/1548-62-0x0000000000000000-mapping.dmp
-
memory/1876-57-0x0000000076141000-0x0000000076143000-memory.dmpFilesize
8KB
-
memory/1876-55-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1876-56-0x0000000000402EFA-mapping.dmp
-
memory/2028-66-0x0000000000402EFA-mapping.dmp