Analysis
-
max time kernel
152s -
max time network
123s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
25-01-2022 12:17
Static task
static1
Behavioral task
behavioral1
Sample
4c5349fce32c77e9ae731a7b745b7006aec55d0bf56e6dd3f7621dec0d387428.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
4c5349fce32c77e9ae731a7b745b7006aec55d0bf56e6dd3f7621dec0d387428.exe
Resource
win10-en-20211208
General
-
Target
4c5349fce32c77e9ae731a7b745b7006aec55d0bf56e6dd3f7621dec0d387428.exe
-
Size
234KB
-
MD5
cc5f35947be6d112c2f8625b30fecb2a
-
SHA1
98cc827e5347513a7a1f5f65ff9217c28ce1bccb
-
SHA256
4c5349fce32c77e9ae731a7b745b7006aec55d0bf56e6dd3f7621dec0d387428
-
SHA512
6ed0966d9c86f73751965b6a198fc59ecdbf218ee231d40b9c9e7f5b73d0db1d72091bfafcf896bc034042e801303ecca8aad7689274f2802f611ca6eaff5992
Malware Config
Extracted
smokeloader
2020
https://olobus.casa/feedback.php
https://trusho.online/feedback.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 1 IoCs
Processes:
ttgwevapid process 1552 ttgweva -
Deletes itself 1 IoCs
Processes:
pid process 1416 -
Loads dropped DLL 1 IoCs
Processes:
4c5349fce32c77e9ae731a7b745b7006aec55d0bf56e6dd3f7621dec0d387428.exepid process 1072 4c5349fce32c77e9ae731a7b745b7006aec55d0bf56e6dd3f7621dec0d387428.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
4c5349fce32c77e9ae731a7b745b7006aec55d0bf56e6dd3f7621dec0d387428.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4c5349fce32c77e9ae731a7b745b7006aec55d0bf56e6dd3f7621dec0d387428.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4c5349fce32c77e9ae731a7b745b7006aec55d0bf56e6dd3f7621dec0d387428.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4c5349fce32c77e9ae731a7b745b7006aec55d0bf56e6dd3f7621dec0d387428.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
4c5349fce32c77e9ae731a7b745b7006aec55d0bf56e6dd3f7621dec0d387428.exepid process 1072 4c5349fce32c77e9ae731a7b745b7006aec55d0bf56e6dd3f7621dec0d387428.exe 1072 4c5349fce32c77e9ae731a7b745b7006aec55d0bf56e6dd3f7621dec0d387428.exe 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 1416 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1416 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
4c5349fce32c77e9ae731a7b745b7006aec55d0bf56e6dd3f7621dec0d387428.exepid process 1072 4c5349fce32c77e9ae731a7b745b7006aec55d0bf56e6dd3f7621dec0d387428.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
taskeng.exedescription pid process target process PID 676 wrote to memory of 1552 676 taskeng.exe ttgweva PID 676 wrote to memory of 1552 676 taskeng.exe ttgweva PID 676 wrote to memory of 1552 676 taskeng.exe ttgweva PID 676 wrote to memory of 1552 676 taskeng.exe ttgweva
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c5349fce32c77e9ae731a7b745b7006aec55d0bf56e6dd3f7621dec0d387428.exe"C:\Users\Admin\AppData\Local\Temp\4c5349fce32c77e9ae731a7b745b7006aec55d0bf56e6dd3f7621dec0d387428.exe"1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1072
-
C:\Windows\system32\taskeng.exetaskeng.exe {372A5A57-1DC4-4C6F-926F-CA6359723CD7} S-1-5-21-2329389628-4064185017-3901522362-1000:QSKGHMYQ\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Users\Admin\AppData\Roaming\ttgwevaC:\Users\Admin\AppData\Roaming\ttgweva2⤵
- Executes dropped EXE
PID:1552
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\5C1B.tmpMD5
d124f55b9393c976963407dff51ffa79
SHA12c7bbedd79791bfb866898c85b504186db610b5d
SHA256ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef
SHA512278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06
-
C:\Users\Admin\AppData\Roaming\ttgwevaMD5
cc5f35947be6d112c2f8625b30fecb2a
SHA198cc827e5347513a7a1f5f65ff9217c28ce1bccb
SHA2564c5349fce32c77e9ae731a7b745b7006aec55d0bf56e6dd3f7621dec0d387428
SHA5126ed0966d9c86f73751965b6a198fc59ecdbf218ee231d40b9c9e7f5b73d0db1d72091bfafcf896bc034042e801303ecca8aad7689274f2802f611ca6eaff5992
-
C:\Users\Admin\AppData\Roaming\ttgwevaMD5
cc5f35947be6d112c2f8625b30fecb2a
SHA198cc827e5347513a7a1f5f65ff9217c28ce1bccb
SHA2564c5349fce32c77e9ae731a7b745b7006aec55d0bf56e6dd3f7621dec0d387428
SHA5126ed0966d9c86f73751965b6a198fc59ecdbf218ee231d40b9c9e7f5b73d0db1d72091bfafcf896bc034042e801303ecca8aad7689274f2802f611ca6eaff5992
-
\Users\Admin\AppData\Local\Temp\5C1B.tmpMD5
d124f55b9393c976963407dff51ffa79
SHA12c7bbedd79791bfb866898c85b504186db610b5d
SHA256ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef
SHA512278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06
-
memory/1072-55-0x0000000075F81000-0x0000000075F83000-memory.dmpFilesize
8KB
-
memory/1072-57-0x0000000000090000-0x0000000000091000-memory.dmpFilesize
4KB
-
memory/1072-58-0x00000000000F0000-0x00000000000FA000-memory.dmpFilesize
40KB
-
memory/1072-59-0x0000000000230000-0x000000000023A000-memory.dmpFilesize
40KB
-
memory/1416-60-0x00000000029C0000-0x00000000029D6000-memory.dmpFilesize
88KB
-
memory/1552-65-0x0000000000120000-0x000000000012A000-memory.dmpFilesize
40KB