Analysis
-
max time kernel
43s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
01-07-2022 04:12
Static task
static1
Behavioral task
behavioral1
Sample
ad5575b868f6e3ae0471dc7c846aaee2a4fb496c16740cb69ae63576047e4d90.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
ad5575b868f6e3ae0471dc7c846aaee2a4fb496c16740cb69ae63576047e4d90.exe
Resource
win10v2004-20220414-en
General
-
Target
ad5575b868f6e3ae0471dc7c846aaee2a4fb496c16740cb69ae63576047e4d90.exe
-
Size
259KB
-
MD5
e78a17b913abb7f5b276e993a4fbfa39
-
SHA1
9af3fa3a1d3db32ebdb0fef5d47ebc87c1d7d9a3
-
SHA256
ad5575b868f6e3ae0471dc7c846aaee2a4fb496c16740cb69ae63576047e4d90
-
SHA512
c938a1541dd102e13f87ce5344d013c73a2177c40a5268b042ba2780600feb0bc23ff9f71aacba7aaab093d9d17c3bbcf0ca53216b9f9cd374318435f00f9b87
Malware Config
Extracted
smokeloader
2018
http://taj.co.ug/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
ad5575b868f6e3ae0471dc7c846aaee2a4fb496c16740cb69ae63576047e4d90.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum ad5575b868f6e3ae0471dc7c846aaee2a4fb496c16740cb69ae63576047e4d90.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 ad5575b868f6e3ae0471dc7c846aaee2a4fb496c16740cb69ae63576047e4d90.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ad5575b868f6e3ae0471dc7c846aaee2a4fb496c16740cb69ae63576047e4d90.exedescription pid process target process PID 1992 set thread context of 1708 1992 ad5575b868f6e3ae0471dc7c846aaee2a4fb496c16740cb69ae63576047e4d90.exe ad5575b868f6e3ae0471dc7c846aaee2a4fb496c16740cb69ae63576047e4d90.exe -
Checks SCSI registry key(s) 3 TTPs 2 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
ad5575b868f6e3ae0471dc7c846aaee2a4fb496c16740cb69ae63576047e4d90.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ad5575b868f6e3ae0471dc7c846aaee2a4fb496c16740cb69ae63576047e4d90.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ad5575b868f6e3ae0471dc7c846aaee2a4fb496c16740cb69ae63576047e4d90.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
ad5575b868f6e3ae0471dc7c846aaee2a4fb496c16740cb69ae63576047e4d90.exepid process 1708 ad5575b868f6e3ae0471dc7c846aaee2a4fb496c16740cb69ae63576047e4d90.exe 1708 ad5575b868f6e3ae0471dc7c846aaee2a4fb496c16740cb69ae63576047e4d90.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
ad5575b868f6e3ae0471dc7c846aaee2a4fb496c16740cb69ae63576047e4d90.exedescription pid process target process PID 1992 wrote to memory of 1708 1992 ad5575b868f6e3ae0471dc7c846aaee2a4fb496c16740cb69ae63576047e4d90.exe ad5575b868f6e3ae0471dc7c846aaee2a4fb496c16740cb69ae63576047e4d90.exe PID 1992 wrote to memory of 1708 1992 ad5575b868f6e3ae0471dc7c846aaee2a4fb496c16740cb69ae63576047e4d90.exe ad5575b868f6e3ae0471dc7c846aaee2a4fb496c16740cb69ae63576047e4d90.exe PID 1992 wrote to memory of 1708 1992 ad5575b868f6e3ae0471dc7c846aaee2a4fb496c16740cb69ae63576047e4d90.exe ad5575b868f6e3ae0471dc7c846aaee2a4fb496c16740cb69ae63576047e4d90.exe PID 1992 wrote to memory of 1708 1992 ad5575b868f6e3ae0471dc7c846aaee2a4fb496c16740cb69ae63576047e4d90.exe ad5575b868f6e3ae0471dc7c846aaee2a4fb496c16740cb69ae63576047e4d90.exe PID 1992 wrote to memory of 1708 1992 ad5575b868f6e3ae0471dc7c846aaee2a4fb496c16740cb69ae63576047e4d90.exe ad5575b868f6e3ae0471dc7c846aaee2a4fb496c16740cb69ae63576047e4d90.exe PID 1992 wrote to memory of 1708 1992 ad5575b868f6e3ae0471dc7c846aaee2a4fb496c16740cb69ae63576047e4d90.exe ad5575b868f6e3ae0471dc7c846aaee2a4fb496c16740cb69ae63576047e4d90.exe PID 1992 wrote to memory of 1708 1992 ad5575b868f6e3ae0471dc7c846aaee2a4fb496c16740cb69ae63576047e4d90.exe ad5575b868f6e3ae0471dc7c846aaee2a4fb496c16740cb69ae63576047e4d90.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad5575b868f6e3ae0471dc7c846aaee2a4fb496c16740cb69ae63576047e4d90.exe"C:\Users\Admin\AppData\Local\Temp\ad5575b868f6e3ae0471dc7c846aaee2a4fb496c16740cb69ae63576047e4d90.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ad5575b868f6e3ae0471dc7c846aaee2a4fb496c16740cb69ae63576047e4d90.exe"C:\Users\Admin\AppData\Local\Temp\ad5575b868f6e3ae0471dc7c846aaee2a4fb496c16740cb69ae63576047e4d90.exe"2⤵
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1288-59-0x0000000002AA0000-0x0000000002AB5000-memory.dmpFilesize
84KB
-
memory/1708-55-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1708-56-0x0000000000402AB0-mapping.dmp
-
memory/1708-57-0x0000000074E91000-0x0000000074E93000-memory.dmpFilesize
8KB
-
memory/1708-58-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1992-54-0x000000000050B000-0x0000000000516000-memory.dmpFilesize
44KB