Analysis
-
max time kernel
168s -
max time network
162s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
25-01-2022 16:55
Static task
static1
Behavioral task
behavioral1
Sample
21f409a6ed024798e48e7eaae2b8b04b2d3c1786f69461136d930f273fcaed25.exe
Resource
win10-en-20211208
General
-
Target
21f409a6ed024798e48e7eaae2b8b04b2d3c1786f69461136d930f273fcaed25.exe
-
Size
263KB
-
MD5
debf1f79bca4e4945d490e36dfdd5978
-
SHA1
30a93271b70660f548ac3a07346fa966c6fa13c2
-
SHA256
21f409a6ed024798e48e7eaae2b8b04b2d3c1786f69461136d930f273fcaed25
-
SHA512
25f1bb52736400e4eba82dd61bdc65f44d81e0a5100ad8b02143345a8400f88b41ebd76acdbb588a53851096f7a64c2ec63b478440daab7d562212f710e7c956
Malware Config
Extracted
smokeloader
2020
https://oakland-studio.video/search.php
https://seattle-university.video/search.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3020 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
21f409a6ed024798e48e7eaae2b8b04b2d3c1786f69461136d930f273fcaed25.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 21f409a6ed024798e48e7eaae2b8b04b2d3c1786f69461136d930f273fcaed25.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 21f409a6ed024798e48e7eaae2b8b04b2d3c1786f69461136d930f273fcaed25.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 21f409a6ed024798e48e7eaae2b8b04b2d3c1786f69461136d930f273fcaed25.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
21f409a6ed024798e48e7eaae2b8b04b2d3c1786f69461136d930f273fcaed25.exepid process 3544 21f409a6ed024798e48e7eaae2b8b04b2d3c1786f69461136d930f273fcaed25.exe 3544 21f409a6ed024798e48e7eaae2b8b04b2d3c1786f69461136d930f273fcaed25.exe 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3020 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
21f409a6ed024798e48e7eaae2b8b04b2d3c1786f69461136d930f273fcaed25.exepid process 3544 21f409a6ed024798e48e7eaae2b8b04b2d3c1786f69461136d930f273fcaed25.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\21f409a6ed024798e48e7eaae2b8b04b2d3c1786f69461136d930f273fcaed25.exe"C:\Users\Admin\AppData\Local\Temp\21f409a6ed024798e48e7eaae2b8b04b2d3c1786f69461136d930f273fcaed25.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3544
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3020-121-0x0000000000DA0000-0x0000000000DB6000-memory.dmpFilesize
88KB
-
memory/3544-118-0x0000000000030000-0x0000000000038000-memory.dmpFilesize
32KB
-
memory/3544-119-0x0000000000520000-0x0000000000529000-memory.dmpFilesize
36KB
-
memory/3544-120-0x0000000000400000-0x0000000000449000-memory.dmpFilesize
292KB