Analysis
-
max time kernel
160s -
max time network
141s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
12-11-2021 16:36
Static task
static1
Behavioral task
behavioral1
Sample
38cbd9820e8528708c24ea761f0de8fe.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
38cbd9820e8528708c24ea761f0de8fe.exe
Resource
win10-en-20211104
General
-
Target
38cbd9820e8528708c24ea761f0de8fe.exe
-
Size
336KB
-
MD5
38cbd9820e8528708c24ea761f0de8fe
-
SHA1
17238afe79a445baf45cb5395a7a192b20beab01
-
SHA256
8dda40a5568292661c1157e6edf3454e9fbf6d2215085b2ac39731276f1e83e3
-
SHA512
c5342a02d6dd9719ebdf7399163efd6d8aec683e85397ac422ace0baa42a1ff04ce60c080f2068eee4fc7fea35aed998e037c63030bf208c05d5043c9767eb29
Malware Config
Extracted
smokeloader
2020
http://nalirou70.top/
http://xacokuo80.top/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 2156 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
38cbd9820e8528708c24ea761f0de8fe.exedescription pid process target process PID 2684 set thread context of 1472 2684 38cbd9820e8528708c24ea761f0de8fe.exe 38cbd9820e8528708c24ea761f0de8fe.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
38cbd9820e8528708c24ea761f0de8fe.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 38cbd9820e8528708c24ea761f0de8fe.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 38cbd9820e8528708c24ea761f0de8fe.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 38cbd9820e8528708c24ea761f0de8fe.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
38cbd9820e8528708c24ea761f0de8fe.exepid process 1472 38cbd9820e8528708c24ea761f0de8fe.exe 1472 38cbd9820e8528708c24ea761f0de8fe.exe 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 2156 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2156 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
38cbd9820e8528708c24ea761f0de8fe.exepid process 1472 38cbd9820e8528708c24ea761f0de8fe.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
38cbd9820e8528708c24ea761f0de8fe.exedescription pid process target process PID 2684 wrote to memory of 1472 2684 38cbd9820e8528708c24ea761f0de8fe.exe 38cbd9820e8528708c24ea761f0de8fe.exe PID 2684 wrote to memory of 1472 2684 38cbd9820e8528708c24ea761f0de8fe.exe 38cbd9820e8528708c24ea761f0de8fe.exe PID 2684 wrote to memory of 1472 2684 38cbd9820e8528708c24ea761f0de8fe.exe 38cbd9820e8528708c24ea761f0de8fe.exe PID 2684 wrote to memory of 1472 2684 38cbd9820e8528708c24ea761f0de8fe.exe 38cbd9820e8528708c24ea761f0de8fe.exe PID 2684 wrote to memory of 1472 2684 38cbd9820e8528708c24ea761f0de8fe.exe 38cbd9820e8528708c24ea761f0de8fe.exe PID 2684 wrote to memory of 1472 2684 38cbd9820e8528708c24ea761f0de8fe.exe 38cbd9820e8528708c24ea761f0de8fe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\38cbd9820e8528708c24ea761f0de8fe.exe"C:\Users\Admin\AppData\Local\Temp\38cbd9820e8528708c24ea761f0de8fe.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\38cbd9820e8528708c24ea761f0de8fe.exe"C:\Users\Admin\AppData\Local\Temp\38cbd9820e8528708c24ea761f0de8fe.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1472-119-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/1472-120-0x0000000000402DC6-mapping.dmp
-
memory/2156-122-0x0000000001120000-0x0000000001136000-memory.dmpFilesize
88KB
-
memory/2684-121-0x0000000002BA0000-0x0000000002BA9000-memory.dmpFilesize
36KB