Analysis
-
max time kernel
153s -
max time network
155s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
16-11-2021 18:36
Static task
static1
Behavioral task
behavioral1
Sample
05da40ffe5334fa39912829056a041ae.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
05da40ffe5334fa39912829056a041ae.exe
Resource
win10-en-20211014
General
-
Target
05da40ffe5334fa39912829056a041ae.exe
-
Size
325KB
-
MD5
05da40ffe5334fa39912829056a041ae
-
SHA1
a0fbf5bd01a664440bf3ed50d0fdb570871aee36
-
SHA256
b5a2bb540684ed8d76719289fb97b63eab089cf39350e06e728ec13e84c81340
-
SHA512
ca51116c37f7ae0d9a6e1d2491a0fba9554bbb26cfaf89e69f3001ca851d95dda16df629b87bf64796cfb988e2e97d925caed0d618272c90ff913ecc95c6c9f7
Malware Config
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Deletes itself 1 IoCs
Processes:
pid process 1304 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
05da40ffe5334fa39912829056a041ae.exedescription pid process target process PID 1552 set thread context of 1240 1552 05da40ffe5334fa39912829056a041ae.exe 05da40ffe5334fa39912829056a041ae.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
05da40ffe5334fa39912829056a041ae.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 05da40ffe5334fa39912829056a041ae.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 05da40ffe5334fa39912829056a041ae.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 05da40ffe5334fa39912829056a041ae.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
05da40ffe5334fa39912829056a041ae.exepid process 1240 05da40ffe5334fa39912829056a041ae.exe 1240 05da40ffe5334fa39912829056a041ae.exe 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1304 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
05da40ffe5334fa39912829056a041ae.exepid process 1240 05da40ffe5334fa39912829056a041ae.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 1304 1304 -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
pid process 1304 1304 -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
05da40ffe5334fa39912829056a041ae.exedescription pid process target process PID 1552 wrote to memory of 1240 1552 05da40ffe5334fa39912829056a041ae.exe 05da40ffe5334fa39912829056a041ae.exe PID 1552 wrote to memory of 1240 1552 05da40ffe5334fa39912829056a041ae.exe 05da40ffe5334fa39912829056a041ae.exe PID 1552 wrote to memory of 1240 1552 05da40ffe5334fa39912829056a041ae.exe 05da40ffe5334fa39912829056a041ae.exe PID 1552 wrote to memory of 1240 1552 05da40ffe5334fa39912829056a041ae.exe 05da40ffe5334fa39912829056a041ae.exe PID 1552 wrote to memory of 1240 1552 05da40ffe5334fa39912829056a041ae.exe 05da40ffe5334fa39912829056a041ae.exe PID 1552 wrote to memory of 1240 1552 05da40ffe5334fa39912829056a041ae.exe 05da40ffe5334fa39912829056a041ae.exe PID 1552 wrote to memory of 1240 1552 05da40ffe5334fa39912829056a041ae.exe 05da40ffe5334fa39912829056a041ae.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\05da40ffe5334fa39912829056a041ae.exe"C:\Users\Admin\AppData\Local\Temp\05da40ffe5334fa39912829056a041ae.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\05da40ffe5334fa39912829056a041ae.exe"C:\Users\Admin\AppData\Local\Temp\05da40ffe5334fa39912829056a041ae.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1240-57-0x0000000000402DD8-mapping.dmp
-
memory/1240-56-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1240-58-0x0000000075B71000-0x0000000075B73000-memory.dmpFilesize
8KB
-
memory/1304-60-0x00000000029B0000-0x00000000029C6000-memory.dmpFilesize
88KB
-
memory/1552-55-0x000000000250B000-0x000000000251C000-memory.dmpFilesize
68KB
-
memory/1552-59-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB