Analysis
-
max time kernel
122s -
max time network
133s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 21:49
Static task
static1
Behavioral task
behavioral1
Sample
2b5eefc4bc2d34cbe5093332c47b5405cf5c32e8156767fc8bc9ddd9cdcf3018.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
2b5eefc4bc2d34cbe5093332c47b5405cf5c32e8156767fc8bc9ddd9cdcf3018.exe
Resource
win10-en-20211208
General
-
Target
2b5eefc4bc2d34cbe5093332c47b5405cf5c32e8156767fc8bc9ddd9cdcf3018.exe
-
Size
441KB
-
MD5
a8c805792a954ca0664221acde199f48
-
SHA1
248a4be7db6485f85920b15a5cf21df68b800159
-
SHA256
2b5eefc4bc2d34cbe5093332c47b5405cf5c32e8156767fc8bc9ddd9cdcf3018
-
SHA512
9b54be9fb046cde9c3a6107bd2100268e179e8ae15756cfb0c134e3d3a37735121445c348192562a23148a57ded6f4e32a141161dc78fc711fd28e5a619e69ab
Malware Config
Extracted
smokeloader
2019
http://topdalescotty.top/xsmkld/index.php
http://billyjimmyer.top/xsmkld/index.php
http://angelmariotti.xyz/xsmkld/index.php
http://tommyhalfigero.top/xsmkld/index.php
http://dannysannyer.top/xsmkld/index.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Loads dropped DLL 1 IoCs
Processes:
2b5eefc4bc2d34cbe5093332c47b5405cf5c32e8156767fc8bc9ddd9cdcf3018.exepid process 2420 2b5eefc4bc2d34cbe5093332c47b5405cf5c32e8156767fc8bc9ddd9cdcf3018.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
2b5eefc4bc2d34cbe5093332c47b5405cf5c32e8156767fc8bc9ddd9cdcf3018.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2b5eefc4bc2d34cbe5093332c47b5405cf5c32e8156767fc8bc9ddd9cdcf3018.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2b5eefc4bc2d34cbe5093332c47b5405cf5c32e8156767fc8bc9ddd9cdcf3018.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2b5eefc4bc2d34cbe5093332c47b5405cf5c32e8156767fc8bc9ddd9cdcf3018.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
2b5eefc4bc2d34cbe5093332c47b5405cf5c32e8156767fc8bc9ddd9cdcf3018.exepid process 2420 2b5eefc4bc2d34cbe5093332c47b5405cf5c32e8156767fc8bc9ddd9cdcf3018.exe 2420 2b5eefc4bc2d34cbe5093332c47b5405cf5c32e8156767fc8bc9ddd9cdcf3018.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2b5eefc4bc2d34cbe5093332c47b5405cf5c32e8156767fc8bc9ddd9cdcf3018.exedescription pid process Token: SeShutdownPrivilege 2420 2b5eefc4bc2d34cbe5093332c47b5405cf5c32e8156767fc8bc9ddd9cdcf3018.exe Token: SeRemoteShutdownPrivilege 2420 2b5eefc4bc2d34cbe5093332c47b5405cf5c32e8156767fc8bc9ddd9cdcf3018.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b5eefc4bc2d34cbe5093332c47b5405cf5c32e8156767fc8bc9ddd9cdcf3018.exe"C:\Users\Admin\AppData\Local\Temp\2b5eefc4bc2d34cbe5093332c47b5405cf5c32e8156767fc8bc9ddd9cdcf3018.exe"1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\1D86.tmpMD5
50741b3f2d7debf5d2bed63d88404029
SHA156210388a627b926162b36967045be06ffb1aad3
SHA256f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c
SHA512fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3
-
memory/2420-118-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/2420-120-0x0000000002270000-0x000000000229D000-memory.dmpFilesize
180KB
-
memory/2984-121-0x0000000000E00000-0x0000000000E01000-memory.dmpFilesize
4KB
-
memory/2984-122-0x0000000000E60000-0x0000000000E76000-memory.dmpFilesize
88KB