Analysis
- max time kernel
146s - max time network
159s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
28/03/2022, 08:13
General
- Target 9568547bd4692d7d6e06e107ebed3863.exe
- Size 232KB
- Sample220328-j4earsdchl
- SHA256 93fc4f2ee5e58547ba2073c5475e846a13f9e98209732bd160f9f5b355b41bca
Malware Config
Extracted
-
smokeloader
-
2020
-
http://coralee.at/upload/
-
http://ducvietcao.com/upload/
-
http://biz-acc.ru/upload/
-
http://toimap.com/upload/
-
http://bbb7d.com/upload/
-
http://piratia-life.ru/upload/
-
http://curvreport.com/upload/
-
http://viagratos.com/upload/
-
http://mordo.ru/upload/
-
http://pkodev.net/upload/
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- suricata: ET MALWARE Danabot Key Exchange Request
suricata: ET MALWARE Danabot Key Exchange Request
- Blocklisted process makes network request 2 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 5 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 41 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 26 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9568547bd4692d7d6e06e107ebed3863.exe"C:\Users\Admin\AppData\Local\Temp\9568547bd4692d7d6e06e107ebed3863.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\EB67.exeC:\Users\Admin\AppData\Local\Temp\EB67.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Blocklisted process makes network request
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 6042⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 9122⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 9122⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 10042⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 10402⤵
- Program crash
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Blocklisted process makes network request
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4824 -ip 48241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4824 -ip 48241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4824 -ip 48241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4824 -ip 48241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4824 -ip 48241⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
Deaffwhwqqtuyww.tmp
EB67.exe
EB67.exe
memory/1956-131-0x000000000077C000-0x0000000000785000-memory.dmp
memory/1956-132-0x00000000006D0000-0x00000000006D9000-memory.dmp
memory/1956-133-0x0000000000400000-0x000000000047D000-memory.dmp
memory/1956-130-0x000000000077C000-0x0000000000785000-memory.dmp
memory/2188-145-0x0000000000D10000-0x0000000000D13000-memory.dmp
memory/2188-144-0x0000000000D00000-0x0000000000D03000-memory.dmp
memory/3024-134-0x0000000001420000-0x0000000001436000-memory.dmp
memory/3540-170-0x0000000000A00000-0x0000000001314000-memory.dmp
memory/3540-166-0x0000000002E90000-0x00000000038C4000-memory.dmp
memory/3540-167-0x0000000004020000-0x0000000004021000-memory.dmp
memory/3540-168-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/3540-169-0x00000000039A0000-0x0000000003AE0000-memory.dmp
memory/3540-171-0x0000000002E90000-0x00000000038C4000-memory.dmp
memory/3540-165-0x0000000003C90000-0x0000000003C91000-memory.dmp
memory/4824-150-0x0000000002E60000-0x0000000003894000-memory.dmp
memory/4824-160-0x0000000003C50000-0x0000000003C51000-memory.dmp
memory/4824-151-0x0000000002770000-0x0000000002771000-memory.dmp
memory/4824-152-0x00000000039F0000-0x0000000003B30000-memory.dmp
memory/4824-153-0x00000000039F0000-0x0000000003B30000-memory.dmp
memory/4824-155-0x00000000039F0000-0x0000000003B30000-memory.dmp
memory/4824-154-0x0000000002790000-0x0000000002791000-memory.dmp
memory/4824-156-0x00000000039F0000-0x0000000003B30000-memory.dmp
memory/4824-158-0x00000000039F0000-0x0000000003B30000-memory.dmp
memory/4824-157-0x00000000027A0000-0x00000000027A1000-memory.dmp
memory/4824-159-0x00000000039F0000-0x0000000003B30000-memory.dmp
memory/4824-149-0x00000000039D0000-0x00000000039D1000-memory.dmp
memory/4824-162-0x00000000039F0000-0x0000000003B30000-memory.dmp
memory/4824-161-0x00000000039F0000-0x0000000003B30000-memory.dmp
memory/4824-148-0x0000000002E60000-0x0000000003894000-memory.dmp
memory/4824-147-0x0000000002E60000-0x0000000003894000-memory.dmp
memory/4824-142-0x0000000000400000-0x000000000062E000-memory.dmp
memory/4824-141-0x0000000000400000-0x000000000062E000-memory.dmp
memory/4824-140-0x0000000000400000-0x000000000062E000-memory.dmp
memory/4824-139-0x00000000023E0000-0x0000000002601000-memory.dmp
memory/4824-138-0x0000000002302000-0x00000000023DF000-memory.dmp