Analysis

  • max time kernel
    37s
  • max time network
    41s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    08-07-2022 06:05

General

  • Target

    41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe

  • Size

    240KB

  • MD5

    491bf48093ce883bc2caf2e7d37f91a5

  • SHA1

    388f82016f77a1809e73162c447d1d3d34288b29

  • SHA256

    41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9

  • SHA512

    223cb619a9598ffd1f33197bd25c8208a3792a46b7062945ec320e2f499fe86a40f17720b8140cfc936f2b0b1d58620bb31dba1b0fa25935cb65e404ae90c7c0

Malware Config

Extracted

Family

smokeloader

Version

2017

C2

http://derevo.bit/1/

http://ds12.ng/1/

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe
    "C:\Users\Admin\AppData\Local\Temp\41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2000
    • C:\Users\Admin\AppData\Local\Temp\41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe
      "C:\Users\Admin\AppData\Local\Temp\41552ff80f1fa54ced4bcd15edf0f10c498a5b4ab699451322970c2d230d6ce9.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1976
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 260
        3⤵
        • Program crash
        PID:1460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1460-60-0x0000000000000000-mapping.dmp
  • memory/1976-54-0x0000000000400000-0x0000000000404000-memory.dmp
    Filesize

    16KB

  • memory/1976-55-0x000000000040147C-mapping.dmp
  • memory/1976-56-0x0000000075221000-0x0000000075223000-memory.dmp
    Filesize

    8KB

  • memory/1976-58-0x0000000000400000-0x0000000000404000-memory.dmp
    Filesize

    16KB

  • memory/1976-59-0x0000000000030000-0x000000000003A000-memory.dmp
    Filesize

    40KB

  • memory/1976-61-0x0000000000030000-0x000000000003A000-memory.dmp
    Filesize

    40KB

  • memory/2000-57-0x0000000000491000-0x0000000000496000-memory.dmp
    Filesize

    20KB