Analysis
-
max time kernel
112s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
07-07-2022 10:38
Static task
static1
Behavioral task
behavioral1
Sample
45d98cc3717877368dfd239949a424619f702c1c6170528b619815a2f00a78c0.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
45d98cc3717877368dfd239949a424619f702c1c6170528b619815a2f00a78c0.exe
Resource
win10v2004-20220414-en
General
-
Target
45d98cc3717877368dfd239949a424619f702c1c6170528b619815a2f00a78c0.exe
-
Size
184KB
-
MD5
ff120b666660d1159602b401d183bbc6
-
SHA1
c9e61809982b255c61e0240720c50979a0a8be8f
-
SHA256
45d98cc3717877368dfd239949a424619f702c1c6170528b619815a2f00a78c0
-
SHA512
d2e95f076757d3af0215e5591569b61ec6c666b451ffba003b67fac9d5bb9f9c8551592f83b65c2901577ff3383467d0e1dd8fd1b1742ecbbf74ed5063df827c
Malware Config
Extracted
smokeloader
2018
http://klub11n.us/my/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
45d98cc3717877368dfd239949a424619f702c1c6170528b619815a2f00a78c0.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 45d98cc3717877368dfd239949a424619f702c1c6170528b619815a2f00a78c0.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 45d98cc3717877368dfd239949a424619f702c1c6170528b619815a2f00a78c0.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
45d98cc3717877368dfd239949a424619f702c1c6170528b619815a2f00a78c0.exedescription pid process target process PID 2796 set thread context of 484 2796 45d98cc3717877368dfd239949a424619f702c1c6170528b619815a2f00a78c0.exe 45d98cc3717877368dfd239949a424619f702c1c6170528b619815a2f00a78c0.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
45d98cc3717877368dfd239949a424619f702c1c6170528b619815a2f00a78c0.exepid process 484 45d98cc3717877368dfd239949a424619f702c1c6170528b619815a2f00a78c0.exe 484 45d98cc3717877368dfd239949a424619f702c1c6170528b619815a2f00a78c0.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
45d98cc3717877368dfd239949a424619f702c1c6170528b619815a2f00a78c0.exepid process 2796 45d98cc3717877368dfd239949a424619f702c1c6170528b619815a2f00a78c0.exe 2796 45d98cc3717877368dfd239949a424619f702c1c6170528b619815a2f00a78c0.exe 2796 45d98cc3717877368dfd239949a424619f702c1c6170528b619815a2f00a78c0.exe 2796 45d98cc3717877368dfd239949a424619f702c1c6170528b619815a2f00a78c0.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
45d98cc3717877368dfd239949a424619f702c1c6170528b619815a2f00a78c0.exedescription pid process target process PID 2796 wrote to memory of 484 2796 45d98cc3717877368dfd239949a424619f702c1c6170528b619815a2f00a78c0.exe 45d98cc3717877368dfd239949a424619f702c1c6170528b619815a2f00a78c0.exe PID 2796 wrote to memory of 484 2796 45d98cc3717877368dfd239949a424619f702c1c6170528b619815a2f00a78c0.exe 45d98cc3717877368dfd239949a424619f702c1c6170528b619815a2f00a78c0.exe PID 2796 wrote to memory of 484 2796 45d98cc3717877368dfd239949a424619f702c1c6170528b619815a2f00a78c0.exe 45d98cc3717877368dfd239949a424619f702c1c6170528b619815a2f00a78c0.exe PID 2796 wrote to memory of 484 2796 45d98cc3717877368dfd239949a424619f702c1c6170528b619815a2f00a78c0.exe 45d98cc3717877368dfd239949a424619f702c1c6170528b619815a2f00a78c0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\45d98cc3717877368dfd239949a424619f702c1c6170528b619815a2f00a78c0.exe"C:\Users\Admin\AppData\Local\Temp\45d98cc3717877368dfd239949a424619f702c1c6170528b619815a2f00a78c0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\45d98cc3717877368dfd239949a424619f702c1c6170528b619815a2f00a78c0.exe"C:\Users\Admin\AppData\Local\Temp\45d98cc3717877368dfd239949a424619f702c1c6170528b619815a2f00a78c0.exe"2⤵
- Maps connected drives based on registry
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/484-131-0x0000000000000000-mapping.dmp
-
memory/484-133-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2092-132-0x0000000000780000-0x0000000000795000-memory.dmpFilesize
84KB
-
memory/2796-130-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB