Analysis
-
max time kernel
188s -
max time network
194s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
25-06-2022 04:11
Static task
static1
Behavioral task
behavioral1
Sample
3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe
Resource
win10v2004-20220414-en
General
-
Target
3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe
-
Size
229KB
-
MD5
c9ab19e59a63d2c1923400cd76791526
-
SHA1
bb66f2e13660565cd91e7e72ad181a90ca477331
-
SHA256
3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196
-
SHA512
de03a0ade42c8edf0daa41f9b5bf77ec31677b712e864639fa89f3410558abd678090c9e35d47a9ba9d4c7c18bb67fffbdcda28b07a9a695f13d287f0ae23783
Malware Config
Extracted
smokeloader
2017
http://bbank.bit/
http://abank.bit/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
suricata: ET MALWARE Sharik/Smoke Loader Java Connectivity Check
suricata: ET MALWARE Sharik/Smoke Loader Java Connectivity Check
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Classes = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\hvgufdtv\\ecuftbad.exe" explorer.exe -
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 31.3.135.232 Destination IP 139.59.208.246 Destination IP 130.255.73.90 -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exepid process 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exepid process 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exedescription pid process target process PID 4448 wrote to memory of 2136 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe splwow64.exe PID 4448 wrote to memory of 2136 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe splwow64.exe PID 4448 wrote to memory of 808 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe explorer.exe PID 4448 wrote to memory of 808 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe explorer.exe PID 4448 wrote to memory of 808 4448 3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe"C:\Users\Admin\AppData\Local\Temp\3a60c7303e66283c4535a0c85a8bd754aafdfddb7753d5afc182dbd4f3af8196.exe"1⤵
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵
- Adds policy Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/808-134-0x0000000000000000-mapping.dmp
-
memory/808-136-0x0000000000480000-0x000000000048A000-memory.dmpFilesize
40KB
-
memory/808-135-0x0000000000F40000-0x0000000001373000-memory.dmpFilesize
4.2MB
-
memory/2136-130-0x0000000000000000-mapping.dmp
-
memory/4448-131-0x00000000028E0000-0x0000000002908000-memory.dmpFilesize
160KB
-
memory/4448-132-0x0000000000400000-0x0000000000445000-memory.dmpFilesize
276KB
-
memory/4448-133-0x0000000002460000-0x000000000246A000-memory.dmpFilesize
40KB
-
memory/4448-137-0x0000000002460000-0x000000000246A000-memory.dmpFilesize
40KB