Analysis
- max time kernel
150s - max time network
29s - platform
windows7_x64 - resource
win7-20230220-en - resource tags
- submitted
30/03/2023, 07:31
General
- Target 22f50ef32d23e0f441da489071ca1ecb.exe
- Size 597KB
- Sample230330-jcegfsbe39
- SHA256 50ae1cc086fc3faeeb453c5923097b9328b63bbe19ed9f9c226bbb1b49a1917d
Malware Config
Extracted
-
smokeloader
-
swo
Extracted
-
smokeloader
-
2020
-
http://akmedia.in/js/k/index.php
-
http://bethesdaserukam.org/setting/k/index.php
-
http://stemschools.in/js/k/index.php
-
http://dejarestaurant.com/wp-admin/js/k/index.php
-
http://moabscript.ir/wp-admin/js/k/index.php
-
http://nicehybridseeds.com/image/catalog/k/index.php
-
http://imaker.io/picktail/js/k/index.php
-
http://nanavatisworld.com/assets/js/k/index.php
-
http://smartbubox.com/img/k/index.php
-
http://krigenpharmaceuticals.com/js/k/index.php
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Suspicious use of SetThreadContext 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\22f50ef32d23e0f441da489071ca1ecb.exe"C:\Users\Admin\AppData\Local\Temp\22f50ef32d23e0f441da489071ca1ecb.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\22f50ef32d23e0f441da489071ca1ecb.exe"{path}"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/472-63-0x0000000000400000-0x0000000000409000-memory.dmp
memory/472-60-0x0000000000400000-0x0000000000409000-memory.dmp
memory/472-61-0x0000000000400000-0x0000000000409000-memory.dmp
memory/472-62-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/472-64-0x0000000000400000-0x0000000000409000-memory.dmp
memory/472-66-0x0000000000400000-0x0000000000409000-memory.dmp
memory/1196-65-0x00000000029E0000-0x00000000029F6000-memory.dmp
memory/1972-55-0x0000000004E30000-0x0000000004E70000-memory.dmp
memory/1972-56-0x00000000004B0000-0x00000000004BC000-memory.dmp
memory/1972-57-0x0000000004E30000-0x0000000004E70000-memory.dmp
memory/1972-58-0x0000000001090000-0x00000000010F6000-memory.dmp
memory/1972-59-0x0000000000A10000-0x0000000000A1E000-memory.dmp
memory/1972-54-0x00000000012D0000-0x000000000136C000-memory.dmp