Analysis
-
max time kernel
37s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
08-07-2022 06:05
Static task
static1
Behavioral task
behavioral1
Sample
41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe
Resource
win10v2004-20220414-en
General
-
Target
41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe
-
Size
240KB
-
MD5
491bf48093ce883bc2caf2e7d37f91a5
-
SHA1
388f82016f77a1809e73162c447d1d3d34288b29
-
SHA256
41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9
-
SHA512
223cb619a9598ffd1f33197bd25c8208a3792a46b7062945ec320e2f499fe86a40f17720b8140cfc936f2b0b1d58620bb31dba1b0fa25935cb65e404ae90c7c0
Malware Config
Extracted
smokeloader
2017
http://derevo.bit/1/
http://ds12.ng/1/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exedescription pid process target process PID 2000 set thread context of 1976 2000 41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe 41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1460 1976 WerFault.exe 41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exepid process 1976 41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exedescription pid process target process PID 2000 wrote to memory of 1976 2000 41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe 41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe PID 2000 wrote to memory of 1976 2000 41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe 41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe PID 2000 wrote to memory of 1976 2000 41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe 41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe PID 2000 wrote to memory of 1976 2000 41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe 41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe PID 2000 wrote to memory of 1976 2000 41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe 41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe PID 2000 wrote to memory of 1976 2000 41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe 41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe PID 2000 wrote to memory of 1976 2000 41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe 41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe PID 1976 wrote to memory of 1460 1976 41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe WerFault.exe PID 1976 wrote to memory of 1460 1976 41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe WerFault.exe PID 1976 wrote to memory of 1460 1976 41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe WerFault.exe PID 1976 wrote to memory of 1460 1976 41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe"C:\Users\Admin\AppData\Local\Temp\41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe"C:\Users\Admin\AppData\Local\Temp\41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 2603⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1460-60-0x0000000000000000-mapping.dmp
-
memory/1976-54-0x0000000000400000-0x0000000000404000-memory.dmpFilesize
16KB
-
memory/1976-55-0x000000000040147C-mapping.dmp
-
memory/1976-56-0x0000000075221000-0x0000000075223000-memory.dmpFilesize
8KB
-
memory/1976-58-0x0000000000400000-0x0000000000404000-memory.dmpFilesize
16KB
-
memory/1976-59-0x0000000000030000-0x000000000003A000-memory.dmpFilesize
40KB
-
memory/1976-61-0x0000000000030000-0x000000000003A000-memory.dmpFilesize
40KB
-
memory/2000-57-0x0000000000491000-0x0000000000496000-memory.dmpFilesize
20KB