Analysis
- max time kernel
153s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
19/01/2022, 22:46
Static task
static1
Behavioral task
behavioral1
Sample
efe5918fa8bd24bdfb7bb1dcc581c7b8.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
efe5918fa8bd24bdfb7bb1dcc581c7b8.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
- Target efe5918fa8bd24bdfb7bb1dcc581c7b8.exe
- Size 255KB
- Sample220119-2pzbhadgcj
- SHA256 ede12e010ddaffd96dbc21854ff8a5f24d75cd9766d6eb41fce18824c5c18889
- MD5 efe5918fa8bd24bdfb7bb1dcc581c7b8
- SHA1 00cf4d6741a628f200914d191ae5cdadf03b3d60
- SHA512 a457a025967baa05814fe46e4a9b9eb86961782aea900dc784f51b3e0e4b86db53d6acf482b03c1873a43f5b3b145c211ed26e9f22bbe88ae81cd005f34621cb
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://abpa.at/upload/
-
http://emaratghajari.com/upload/
-
http://d7qw.cn/upload/
-
http://alumik-group.ru/upload/
-
http://zamkikurgan.ru/upload/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Executes dropped EXE 1 IoCs
pid Process 908 whjbcbs - Sets service image path in registry 2 TTPs
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI efe5918fa8bd24bdfb7bb1dcc581c7b8.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI efe5918fa8bd24bdfb7bb1dcc581c7b8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI whjbcbs Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI whjbcbs Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI whjbcbs Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI efe5918fa8bd24bdfb7bb1dcc581c7b8.exe - Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2436 efe5918fa8bd24bdfb7bb1dcc581c7b8.exe 2436 efe5918fa8bd24bdfb7bb1dcc581c7b8.exe 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found 2384 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2384 Process not Found - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2436 efe5918fa8bd24bdfb7bb1dcc581c7b8.exe 908 whjbcbs - Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeSystemtimePrivilege 1924 svchost.exe Token: SeSystemtimePrivilege 1924 svchost.exe Token: SeIncBasePriorityPrivilege 1924 svchost.exe Token: SeSystemtimePrivilege 1924 svchost.exe Token: SeSystemtimePrivilege 3528 svchost.exe Token: SeSystemtimePrivilege 3528 svchost.exe Token: SeIncBasePriorityPrivilege 3528 svchost.exe Token: SeShutdownPrivilege 2384 Process not Found Token: SeCreatePagefilePrivilege 2384 Process not Found
Processes
-
C:\Users\Admin\AppData\Local\Temp\efe5918fa8bd24bdfb7bb1dcc581c7b8.exe"C:\Users\Admin\AppData\Local\Temp\efe5918fa8bd24bdfb7bb1dcc581c7b8.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2436
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe d6b8f7269d74aed9461a6f733abfd173 6Eo/quQvI0GfXKhB/KjJeQ.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
PID:3128
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1924
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3528
-
C:\Users\Admin\AppData\Roaming\whjbcbsC:\Users\Admin\AppData\Roaming\whjbcbs1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:908
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k wusvcs -p1⤵PID:2552