Analysis
- max time kernel
157s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
08/03/2022, 13:24
Static task
static1
Behavioral task
behavioral1
Sample
abe4fa8e21a441660b1028b4479e984c.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
abe4fa8e21a441660b1028b4479e984c.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
- Target abe4fa8e21a441660b1028b4479e984c.exe
- Size 211KB
- Sample220308-qndsmafbc8
- SHA256 780aee300d0f8eba4233484b475aa6a0109e40d0bec49d1d7fd4435846ca6608
- MD5 abe4fa8e21a441660b1028b4479e984c
- SHA1 8352ea5eac1bd69f235bc775d8b79fb005cc9ef2
- SHA512 f7b0ca28dad200d0dd25a1aa200ff777330e139cc7de714c04351fea0949e8c3e74eda66be52c280f85c471d2275767697971e9d69793a96d1665b14adb9adb1
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://afrocalite.ga/
-
http://clasique.ga/
-
http://cretenom.ga/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Vgipwdx = "\"C:\\Users\\Admin\\AppData\\Roaming\\Nljodry\\Vgipwdx.exe\"" abe4fa8e21a441660b1028b4479e984c.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3500 set thread context of 2808 3500 abe4fa8e21a441660b1028b4479e984c.exe 65 - Program crash 1 IoCs
pid pid_target Process procid_target 3008 2064 WerFault.exe 66 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI abe4fa8e21a441660b1028b4479e984c.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI abe4fa8e21a441660b1028b4479e984c.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI abe4fa8e21a441660b1028b4479e984c.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3500 abe4fa8e21a441660b1028b4479e984c.exe 3500 abe4fa8e21a441660b1028b4479e984c.exe 2808 abe4fa8e21a441660b1028b4479e984c.exe 2808 abe4fa8e21a441660b1028b4479e984c.exe 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found - Suspicious behavior: MapViewOfSection 19 IoCs
pid Process 2808 abe4fa8e21a441660b1028b4479e984c.exe 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3500 abe4fa8e21a441660b1028b4479e984c.exe Token: SeShutdownPrivilege 2412 Process not Found Token: SeCreatePagefilePrivilege 2412 Process not Found Token: SeShutdownPrivilege 2412 Process not Found Token: SeCreatePagefilePrivilege 2412 Process not Found - Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 3500 wrote to memory of 2808 3500 abe4fa8e21a441660b1028b4479e984c.exe 65 PID 3500 wrote to memory of 2808 3500 abe4fa8e21a441660b1028b4479e984c.exe 65 PID 3500 wrote to memory of 2808 3500 abe4fa8e21a441660b1028b4479e984c.exe 65 PID 3500 wrote to memory of 2808 3500 abe4fa8e21a441660b1028b4479e984c.exe 65 PID 3500 wrote to memory of 2808 3500 abe4fa8e21a441660b1028b4479e984c.exe 65 PID 3500 wrote to memory of 2808 3500 abe4fa8e21a441660b1028b4479e984c.exe 65 PID 2412 wrote to memory of 2064 2412 Process not Found 66 PID 2412 wrote to memory of 2064 2412 Process not Found 66 PID 2412 wrote to memory of 2064 2412 Process not Found 66 PID 2412 wrote to memory of 2064 2412 Process not Found 66 PID 2412 wrote to memory of 3264 2412 Process not Found 67 PID 2412 wrote to memory of 3264 2412 Process not Found 67 PID 2412 wrote to memory of 3264 2412 Process not Found 67 PID 2412 wrote to memory of 3768 2412 Process not Found 68 PID 2412 wrote to memory of 3768 2412 Process not Found 68 PID 2412 wrote to memory of 3768 2412 Process not Found 68 PID 2412 wrote to memory of 3768 2412 Process not Found 68 PID 2412 wrote to memory of 676 2412 Process not Found 69 PID 2412 wrote to memory of 676 2412 Process not Found 69 PID 2412 wrote to memory of 676 2412 Process not Found 69 PID 2412 wrote to memory of 676 2412 Process not Found 69 PID 2412 wrote to memory of 1124 2412 Process not Found 70 PID 2412 wrote to memory of 1124 2412 Process not Found 70 PID 2412 wrote to memory of 1124 2412 Process not Found 70 PID 2412 wrote to memory of 3648 2412 Process not Found 71 PID 2412 wrote to memory of 3648 2412 Process not Found 71 PID 2412 wrote to memory of 3648 2412 Process not Found 71 PID 2412 wrote to memory of 3648 2412 Process not Found 71 PID 2412 wrote to memory of 3908 2412 Process not Found 72 PID 2412 wrote to memory of 3908 2412 Process not Found 72 PID 2412 wrote to memory of 3908 2412 Process not Found 72 PID 2412 wrote to memory of 3188 2412 Process not Found 74 PID 2412 wrote to memory of 3188 2412 Process not Found 74 PID 2412 wrote to memory of 3188 2412 Process not Found 74 PID 2412 wrote to memory of 3188 2412 Process not Found 74 PID 2412 wrote to memory of 1732 2412 Process not Found 75 PID 2412 wrote to memory of 1732 2412 Process not Found 75 PID 2412 wrote to memory of 1732 2412 Process not Found 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\abe4fa8e21a441660b1028b4479e984c.exe"C:\Users\Admin\AppData\Local\Temp\abe4fa8e21a441660b1028b4479e984c.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\abe4fa8e21a441660b1028b4479e984c.exeC:\Users\Admin\AppData\Local\Temp\abe4fa8e21a441660b1028b4479e984c.exe2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2808
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2064
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 8722⤵
- Program crash
PID:3008
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3264
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3768
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:676
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1124
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3648
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3908
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3188
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1732
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2064 -ip 20641⤵PID:1568