Analysis
-
max time kernel
186s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 07:04
Behavioral task
behavioral1
Sample
9af532248c2db561580f9a451a072a9863d03650924e83c1451bb3d4471ad97b.exe
Resource
win7-20220414-en
General
-
Target
9af532248c2db561580f9a451a072a9863d03650924e83c1451bb3d4471ad97b.exe
-
Size
87KB
-
MD5
79c2c4246b1db86c53592afcf57a6ce4
-
SHA1
f37eb98147abae0a8fa5d27d9f0d43b276ebda84
-
SHA256
9af532248c2db561580f9a451a072a9863d03650924e83c1451bb3d4471ad97b
-
SHA512
6dafe326c3251aef997d39ca2c4dd2c4abfc05ff13b3a86e852d3267f1275167eebdda9c3a1779602a053ddaa3e8f044bbcadacf382547fec1d21d87b198809d
Malware Config
Extracted
smokeloader
2020
http://lendojekam.xyz/index.php
http://lpequdeliren.fun/index.php
http://lgrarcosbann.club/index.php
http://flablenitev.site/index.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Loads dropped DLL 1 IoCs
Processes:
9af532248c2db561580f9a451a072a9863d03650924e83c1451bb3d4471ad97b.exepid process 1720 9af532248c2db561580f9a451a072a9863d03650924e83c1451bb3d4471ad97b.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
9af532248c2db561580f9a451a072a9863d03650924e83c1451bb3d4471ad97b.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9af532248c2db561580f9a451a072a9863d03650924e83c1451bb3d4471ad97b.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9af532248c2db561580f9a451a072a9863d03650924e83c1451bb3d4471ad97b.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9af532248c2db561580f9a451a072a9863d03650924e83c1451bb3d4471ad97b.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
9af532248c2db561580f9a451a072a9863d03650924e83c1451bb3d4471ad97b.exepid process 1720 9af532248c2db561580f9a451a072a9863d03650924e83c1451bb3d4471ad97b.exe 1720 9af532248c2db561580f9a451a072a9863d03650924e83c1451bb3d4471ad97b.exe 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
9af532248c2db561580f9a451a072a9863d03650924e83c1451bb3d4471ad97b.exepid process 1720 9af532248c2db561580f9a451a072a9863d03650924e83c1451bb3d4471ad97b.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 1244
Processes
-
C:\Users\Admin\AppData\Local\Temp\9af532248c2db561580f9a451a072a9863d03650924e83c1451bb3d4471ad97b.exe"C:\Users\Admin\AppData\Local\Temp\9af532248c2db561580f9a451a072a9863d03650924e83c1451bb3d4471ad97b.exe"1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\9A26.tmpFilesize
1.2MB
MD5d124f55b9393c976963407dff51ffa79
SHA12c7bbedd79791bfb866898c85b504186db610b5d
SHA256ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef
SHA512278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06
-
memory/1244-58-0x0000000002970000-0x0000000002986000-memory.dmpFilesize
88KB
-
memory/1720-54-0x0000000076191000-0x0000000076193000-memory.dmpFilesize
8KB
-
memory/1720-56-0x0000000000220000-0x000000000022A000-memory.dmpFilesize
40KB
-
memory/1720-57-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB