Analysis
- max time kernel
151s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
27/03/2022, 17:10
General
- Target 6e69a6b673cbe7b72ff6e3684adc74eb.exe
- Size 230KB
- Sample220327-vppczaaff6
- SHA256 998d503aa5e68830d7f981490108d44dc12f331bd5ad9ea9f207a99e6d06afbb
Malware Config
Extracted
-
smokeloader
-
2020
-
http://coralee.at/upload/
-
http://ducvietcao.com/upload/
-
http://biz-acc.ru/upload/
-
http://toimap.com/upload/
-
http://bbb7d.com/upload/
-
http://piratia-life.ru/upload/
-
http://curvreport.com/upload/
-
http://viagratos.com/upload/
-
http://mordo.ru/upload/
-
http://pkodev.net/upload/
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Blocklisted process makes network request 5 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Program crash 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e69a6b673cbe7b72ff6e3684adc74eb.exe"C:\Users\Admin\AppData\Local\Temp\6e69a6b673cbe7b72ff6e3684adc74eb.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\CACF.exeC:\Users\Admin\AppData\Local\Temp\CACF.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Blocklisted process makes network request
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 6042⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4324 -ip 43241⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
CACF.exe
CACF.exe
memory/1580-149-0x00000000006C0000-0x00000000006C3000-memory.dmp
memory/1580-147-0x00000000006A0000-0x00000000006A3000-memory.dmp
memory/1580-148-0x00000000006B0000-0x00000000006B3000-memory.dmp
memory/1580-152-0x00000000006F0000-0x00000000006F3000-memory.dmp
memory/1580-153-0x0000000000700000-0x0000000000703000-memory.dmp
memory/1580-151-0x00000000006E0000-0x00000000006E3000-memory.dmp
memory/1580-150-0x00000000006D0000-0x00000000006D3000-memory.dmp
memory/1580-146-0x0000000000690000-0x0000000000693000-memory.dmp
memory/1580-145-0x0000000000680000-0x0000000000683000-memory.dmp
memory/1580-144-0x0000000000670000-0x0000000000673000-memory.dmp
memory/1580-143-0x0000000000660000-0x0000000000663000-memory.dmp
memory/2216-134-0x0000000000900000-0x0000000000916000-memory.dmp
memory/2564-133-0x0000000000400000-0x000000000047C000-memory.dmp
memory/2564-130-0x000000000064C000-0x0000000000655000-memory.dmp
memory/2564-131-0x000000000064C000-0x0000000000655000-memory.dmp
memory/2564-132-0x00000000005D0000-0x00000000005D9000-memory.dmp
memory/4324-141-0x0000000000400000-0x0000000000630000-memory.dmp
memory/4324-140-0x0000000002390000-0x00000000025B3000-memory.dmp
memory/4324-139-0x00000000022A3000-0x0000000002380000-memory.dmp
memory/4324-138-0x0000000000400000-0x0000000000630000-memory.dmp