Analysis
-
max time kernel
90s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
15-06-2022 13:21
Static task
static1
Behavioral task
behavioral1
Sample
29bd4ef84c9cd950f396b4e46a06f56775bf2272104c6b868187a3bce40cf724.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
29bd4ef84c9cd950f396b4e46a06f56775bf2272104c6b868187a3bce40cf724.exe
Resource
win10v2004-20220414-en
General
-
Target
29bd4ef84c9cd950f396b4e46a06f56775bf2272104c6b868187a3bce40cf724.exe
-
Size
180KB
-
MD5
33853c2fe24684a7211293ccc4747bf1
-
SHA1
6ef73fd47628c650ea4c028e833c4fb399ceab67
-
SHA256
29bd4ef84c9cd950f396b4e46a06f56775bf2272104c6b868187a3bce40cf724
-
SHA512
7f9060902747dcc6e3eb2e7e9bbae3146ec8c9228aeff16a47a07ad1e2c749d50143d289a81755a17dba8f561b718ec6b188df55e11c5f4582e48b94a1eb9ac5
Malware Config
Extracted
smokeloader
2018
http://jo15y.xyz/br/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
29bd4ef84c9cd950f396b4e46a06f56775bf2272104c6b868187a3bce40cf724.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 29bd4ef84c9cd950f396b4e46a06f56775bf2272104c6b868187a3bce40cf724.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 29bd4ef84c9cd950f396b4e46a06f56775bf2272104c6b868187a3bce40cf724.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
29bd4ef84c9cd950f396b4e46a06f56775bf2272104c6b868187a3bce40cf724.exedescription pid process target process PID 816 set thread context of 2160 816 29bd4ef84c9cd950f396b4e46a06f56775bf2272104c6b868187a3bce40cf724.exe 29bd4ef84c9cd950f396b4e46a06f56775bf2272104c6b868187a3bce40cf724.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
29bd4ef84c9cd950f396b4e46a06f56775bf2272104c6b868187a3bce40cf724.exepid process 2160 29bd4ef84c9cd950f396b4e46a06f56775bf2272104c6b868187a3bce40cf724.exe 2160 29bd4ef84c9cd950f396b4e46a06f56775bf2272104c6b868187a3bce40cf724.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
29bd4ef84c9cd950f396b4e46a06f56775bf2272104c6b868187a3bce40cf724.exepid process 816 29bd4ef84c9cd950f396b4e46a06f56775bf2272104c6b868187a3bce40cf724.exe 816 29bd4ef84c9cd950f396b4e46a06f56775bf2272104c6b868187a3bce40cf724.exe 816 29bd4ef84c9cd950f396b4e46a06f56775bf2272104c6b868187a3bce40cf724.exe 816 29bd4ef84c9cd950f396b4e46a06f56775bf2272104c6b868187a3bce40cf724.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
29bd4ef84c9cd950f396b4e46a06f56775bf2272104c6b868187a3bce40cf724.exedescription pid process target process PID 816 wrote to memory of 2160 816 29bd4ef84c9cd950f396b4e46a06f56775bf2272104c6b868187a3bce40cf724.exe 29bd4ef84c9cd950f396b4e46a06f56775bf2272104c6b868187a3bce40cf724.exe PID 816 wrote to memory of 2160 816 29bd4ef84c9cd950f396b4e46a06f56775bf2272104c6b868187a3bce40cf724.exe 29bd4ef84c9cd950f396b4e46a06f56775bf2272104c6b868187a3bce40cf724.exe PID 816 wrote to memory of 2160 816 29bd4ef84c9cd950f396b4e46a06f56775bf2272104c6b868187a3bce40cf724.exe 29bd4ef84c9cd950f396b4e46a06f56775bf2272104c6b868187a3bce40cf724.exe PID 816 wrote to memory of 2160 816 29bd4ef84c9cd950f396b4e46a06f56775bf2272104c6b868187a3bce40cf724.exe 29bd4ef84c9cd950f396b4e46a06f56775bf2272104c6b868187a3bce40cf724.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\29bd4ef84c9cd950f396b4e46a06f56775bf2272104c6b868187a3bce40cf724.exe"C:\Users\Admin\AppData\Local\Temp\29bd4ef84c9cd950f396b4e46a06f56775bf2272104c6b868187a3bce40cf724.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\29bd4ef84c9cd950f396b4e46a06f56775bf2272104c6b868187a3bce40cf724.exe"C:\Users\Admin\AppData\Local\Temp\29bd4ef84c9cd950f396b4e46a06f56775bf2272104c6b868187a3bce40cf724.exe"2⤵
- Maps connected drives based on registry
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/816-130-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2160-131-0x0000000000000000-mapping.dmp
-
memory/2160-133-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2684-132-0x0000000000E60000-0x0000000000E75000-memory.dmpFilesize
84KB