Analysis
-
max time kernel
40s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-06-2022 04:35
Static task
static1
Behavioral task
behavioral1
Sample
32e59da764725e6adbc7a2f84689e8404bd91edd9a5e5950550e002e45f69801.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
32e59da764725e6adbc7a2f84689e8404bd91edd9a5e5950550e002e45f69801.exe
Resource
win10v2004-20220414-en
General
-
Target
32e59da764725e6adbc7a2f84689e8404bd91edd9a5e5950550e002e45f69801.exe
-
Size
210KB
-
MD5
90168486e14502fd04ce3df2c4bacd17
-
SHA1
82f51f53c6832b0c535aaf2fa57478856453fdc2
-
SHA256
32e59da764725e6adbc7a2f84689e8404bd91edd9a5e5950550e002e45f69801
-
SHA512
5e8d7b0fbece683ebad61b31991d140c49e06874f00c53cbc95705c7c96c36005c4900822f3d014f6d7e92c88997df93c09f5b4507d2ff1e4d52a9f1dfe351d1
Malware Config
Extracted
smokeloader
2018
http://lufdx2.com/2/
http://gvs1.in/2/
http://jdcbhs.ru/2/
http://m21ch.com/2/
http://gdlvw1.com/2/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
32e59da764725e6adbc7a2f84689e8404bd91edd9a5e5950550e002e45f69801.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 32e59da764725e6adbc7a2f84689e8404bd91edd9a5e5950550e002e45f69801.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 32e59da764725e6adbc7a2f84689e8404bd91edd9a5e5950550e002e45f69801.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
32e59da764725e6adbc7a2f84689e8404bd91edd9a5e5950550e002e45f69801.exedescription pid process target process PID 1048 set thread context of 916 1048 32e59da764725e6adbc7a2f84689e8404bd91edd9a5e5950550e002e45f69801.exe 32e59da764725e6adbc7a2f84689e8404bd91edd9a5e5950550e002e45f69801.exe -
Checks SCSI registry key(s) 3 TTPs 2 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
32e59da764725e6adbc7a2f84689e8404bd91edd9a5e5950550e002e45f69801.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 32e59da764725e6adbc7a2f84689e8404bd91edd9a5e5950550e002e45f69801.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 32e59da764725e6adbc7a2f84689e8404bd91edd9a5e5950550e002e45f69801.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
32e59da764725e6adbc7a2f84689e8404bd91edd9a5e5950550e002e45f69801.exepid process 916 32e59da764725e6adbc7a2f84689e8404bd91edd9a5e5950550e002e45f69801.exe 916 32e59da764725e6adbc7a2f84689e8404bd91edd9a5e5950550e002e45f69801.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
32e59da764725e6adbc7a2f84689e8404bd91edd9a5e5950550e002e45f69801.exedescription pid process target process PID 1048 wrote to memory of 916 1048 32e59da764725e6adbc7a2f84689e8404bd91edd9a5e5950550e002e45f69801.exe 32e59da764725e6adbc7a2f84689e8404bd91edd9a5e5950550e002e45f69801.exe PID 1048 wrote to memory of 916 1048 32e59da764725e6adbc7a2f84689e8404bd91edd9a5e5950550e002e45f69801.exe 32e59da764725e6adbc7a2f84689e8404bd91edd9a5e5950550e002e45f69801.exe PID 1048 wrote to memory of 916 1048 32e59da764725e6adbc7a2f84689e8404bd91edd9a5e5950550e002e45f69801.exe 32e59da764725e6adbc7a2f84689e8404bd91edd9a5e5950550e002e45f69801.exe PID 1048 wrote to memory of 916 1048 32e59da764725e6adbc7a2f84689e8404bd91edd9a5e5950550e002e45f69801.exe 32e59da764725e6adbc7a2f84689e8404bd91edd9a5e5950550e002e45f69801.exe PID 1048 wrote to memory of 916 1048 32e59da764725e6adbc7a2f84689e8404bd91edd9a5e5950550e002e45f69801.exe 32e59da764725e6adbc7a2f84689e8404bd91edd9a5e5950550e002e45f69801.exe PID 1048 wrote to memory of 916 1048 32e59da764725e6adbc7a2f84689e8404bd91edd9a5e5950550e002e45f69801.exe 32e59da764725e6adbc7a2f84689e8404bd91edd9a5e5950550e002e45f69801.exe PID 1048 wrote to memory of 916 1048 32e59da764725e6adbc7a2f84689e8404bd91edd9a5e5950550e002e45f69801.exe 32e59da764725e6adbc7a2f84689e8404bd91edd9a5e5950550e002e45f69801.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\32e59da764725e6adbc7a2f84689e8404bd91edd9a5e5950550e002e45f69801.exe"C:\Users\Admin\AppData\Local\Temp\32e59da764725e6adbc7a2f84689e8404bd91edd9a5e5950550e002e45f69801.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\32e59da764725e6adbc7a2f84689e8404bd91edd9a5e5950550e002e45f69801.exe"C:\Users\Admin\AppData\Local\Temp\32e59da764725e6adbc7a2f84689e8404bd91edd9a5e5950550e002e45f69801.exe"2⤵
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/916-55-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/916-56-0x0000000000402B10-mapping.dmp
-
memory/916-57-0x0000000075DF1000-0x0000000075DF3000-memory.dmpFilesize
8KB
-
memory/916-58-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1048-54-0x0000000005467000-0x0000000005472000-memory.dmpFilesize
44KB
-
memory/1232-59-0x00000000029D0000-0x00000000029E5000-memory.dmpFilesize
84KB