Analysis
- max time kernel
4294218s - max time network
132s - platform
windows7_x64 - resource
win7-20220311-en - submitted
28/03/2022, 08:13
General
- Target 9568547bd4692d7d6e06e107ebed3863.exe
- Size 232KB
- Sample220328-j4earsdchl
- SHA256 93fc4f2ee5e58547ba2073c5475e846a13f9e98209732bd160f9f5b355b41bca
Malware Config
Extracted
-
smokeloader
-
2020
-
http://coralee.at/upload/
-
http://ducvietcao.com/upload/
-
http://biz-acc.ru/upload/
-
http://toimap.com/upload/
-
http://bbb7d.com/upload/
-
http://piratia-life.ru/upload/
-
http://curvreport.com/upload/
-
http://viagratos.com/upload/
-
http://mordo.ru/upload/
-
http://pkodev.net/upload/
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Deletes itself 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of FindShellTrayWindow 6 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9568547bd4692d7d6e06e107ebed3863.exe"C:\Users\Admin\AppData\Local\Temp\9568547bd4692d7d6e06e107ebed3863.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\D5A7.exeC:\Users\Admin\AppData\Local\Temp\D5A7.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
D5A7.exe
memory/1224-59-0x0000000002910000-0x0000000002926000-memory.dmp
memory/1824-57-0x0000000000220000-0x0000000000229000-memory.dmp
memory/1824-54-0x00000000005FE000-0x0000000000607000-memory.dmp
memory/1824-58-0x0000000000400000-0x000000000047D000-memory.dmp
memory/1824-56-0x00000000005FE000-0x0000000000607000-memory.dmp
memory/1824-55-0x0000000075E51000-0x0000000075E53000-memory.dmp
memory/1984-62-0x0000000001F90000-0x000000000206D000-memory.dmp
memory/1984-63-0x0000000001F90000-0x000000000206D000-memory.dmp
memory/1984-65-0x0000000000400000-0x000000000062E000-memory.dmp
memory/1984-64-0x0000000002070000-0x0000000002291000-memory.dmp
memory/1984-66-0x0000000000400000-0x000000000062E000-memory.dmp
memory/1984-67-0x0000000000400000-0x000000000062E000-memory.dmp