Analysis
- max time kernel
153s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
20/01/2022, 14:00
Static task
static1
Behavioral task
behavioral1
Sample
0c4d308254cea8285969f26023123a46.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
0c4d308254cea8285969f26023123a46.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
- Target 0c4d308254cea8285969f26023123a46.exe
- Size 250KB
- Sample220120-ra1kxaaccm
- SHA256 b6f3db88b8c6070f8d31d9c36caa59ac7fbdf99b9eeb741ec3e25c73b23bc822
- MD5 0c4d308254cea8285969f26023123a46
- SHA1 54ffda34ec3766b837d04b36987c01facf183098
- SHA512 8bea7e137f9de38254bf0fe7dbb4d02e4ed1f9ad83be608d0441b8116108ea3a1aa8158aa37a45fdaa38ad9386cbfa50123238deb6afcb03f371df501c36a661
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://abpa.at/upload/
-
http://emaratghajari.com/upload/
-
http://d7qw.cn/upload/
-
http://alumik-group.ru/upload/
-
http://zamkikurgan.ru/upload/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Executes dropped EXE 1 IoCs
pid Process 796 deuwdcg - Sets service image path in registry 2 TTPs
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0c4d308254cea8285969f26023123a46.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0c4d308254cea8285969f26023123a46.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0c4d308254cea8285969f26023123a46.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI deuwdcg Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI deuwdcg Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI deuwdcg - Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2160 0c4d308254cea8285969f26023123a46.exe 2160 0c4d308254cea8285969f26023123a46.exe 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2412 Process not Found - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2160 0c4d308254cea8285969f26023123a46.exe 796 deuwdcg - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 2412 Process not Found Token: SeCreatePagefilePrivilege 2412 Process not Found
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c4d308254cea8285969f26023123a46.exe"C:\Users\Admin\AppData\Local\Temp\0c4d308254cea8285969f26023123a46.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2160
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 22775dcd17642b89ba76b7ef35ce4549 2z7RaX39akSrjXexiKglTQ.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
PID:832
-
C:\Users\Admin\AppData\Roaming\deuwdcgC:\Users\Admin\AppData\Roaming\deuwdcg1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:796
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k wusvcs -p1⤵PID:1308