Analysis
- max time kernel
43s - max time network
154s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
- submitted
12/01/2024, 10:51
General
- Target 6e8775e8089cba93802f59d506afa09a.exe
- Size 207KB
- Sample240112-mxtnnafcc4
- SHA256 14bf7a5b4420073171f0cb75ee7f7bbab035ec7a0695ff0f1493c1a648f29a5b
Malware Config
Extracted
-
smokeloader
-
2022
-
http://selebration17io.io/index.php
-
http://vacantion18ffeu.cc/index.php
-
http://valarioulinity1.net/index.php
-
http://buriatiarutuhuob.net/index.php
-
http://cassiosssionunu.me/index.php
-
http://sulugilioiu19.net/index.php
-
http://goodfooggooftool.net/index.php
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Deletes itself 2 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 2 IoCs
- UPX packed file 12 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of WriteProcessMemory 32 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e8775e8089cba93802f59d506afa09a.exe"C:\Users\Admin\AppData\Local\Temp\6e8775e8089cba93802f59d506afa09a.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\CBE7.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\CBE7.dll2⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\F4DB.exeC:\Users\Admin\AppData\Local\Temp\F4DB.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\F4DB.exeC:\Users\Admin\AppData\Local\Temp\F4DB.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\F9AC.exeC:\Users\Admin\AppData\Local\Temp\F9AC.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\6e8775e8089cba93802f59d506afa09a.exe"C:\Users\Admin\AppData\Local\Temp\6e8775e8089cba93802f59d506afa09a.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\CBE7.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\CBE7.dll2⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\F4DB.exeC:\Users\Admin\AppData\Local\Temp\F4DB.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\F4DB.exeC:\Users\Admin\AppData\Local\Temp\F4DB.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\13A3.exeC:\Users\Admin\AppData\Local\Temp\13A3.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\F9AC.exeC:\Users\Admin\AppData\Local\Temp\F9AC.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\13A3.exeC:\Users\Admin\AppData\Local\Temp\13A3.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
13A3.exe
13A3.exe
CBE7.dll
F4DB.exe
F4DB.exe
F4DB.exe
F4DB.exe
F9AC.exe
F9AC.exe
F9AC.exe
CBE7.dll
CBE7.dll
F4DB.exe
memory/1244-4-0x0000000002A70000-0x0000000002A86000-memory.dmp
memory/1244-4-0x0000000002A70000-0x0000000002A86000-memory.dmp
memory/1324-42-0x0000000000400000-0x0000000000848000-memory.dmp
memory/1324-41-0x0000000000400000-0x0000000000848000-memory.dmp
memory/1324-46-0x0000000000300000-0x0000000000306000-memory.dmp
memory/1324-33-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/1324-36-0x0000000000400000-0x0000000000848000-memory.dmp
memory/1324-40-0x0000000000400000-0x0000000000848000-memory.dmp
memory/1324-36-0x0000000000400000-0x0000000000848000-memory.dmp
memory/1324-46-0x0000000000300000-0x0000000000306000-memory.dmp
memory/1324-43-0x0000000000400000-0x0000000000848000-memory.dmp
memory/1324-40-0x0000000000400000-0x0000000000848000-memory.dmp
memory/1324-39-0x0000000000400000-0x0000000000848000-memory.dmp
memory/1324-33-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/1324-39-0x0000000000400000-0x0000000000848000-memory.dmp
memory/1324-42-0x0000000000400000-0x0000000000848000-memory.dmp
memory/1324-43-0x0000000000400000-0x0000000000848000-memory.dmp
memory/1324-41-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2164-1-0x0000000000580000-0x0000000000680000-memory.dmp
memory/2164-5-0x0000000000400000-0x0000000000439000-memory.dmp
memory/2164-1-0x0000000000580000-0x0000000000680000-memory.dmp
memory/2164-2-0x0000000000220000-0x000000000022B000-memory.dmp
memory/2164-3-0x0000000000400000-0x0000000000439000-memory.dmp
memory/2164-3-0x0000000000400000-0x0000000000439000-memory.dmp
memory/2164-5-0x0000000000400000-0x0000000000439000-memory.dmp
memory/2164-2-0x0000000000220000-0x000000000022B000-memory.dmp
memory/2328-34-0x0000000002090000-0x0000000002247000-memory.dmp
memory/2328-29-0x0000000000670000-0x0000000000828000-memory.dmp
memory/2328-34-0x0000000002090000-0x0000000002247000-memory.dmp
memory/2328-32-0x0000000000670000-0x0000000000828000-memory.dmp
memory/2328-32-0x0000000000670000-0x0000000000828000-memory.dmp
memory/2328-29-0x0000000000670000-0x0000000000828000-memory.dmp
memory/2604-22-0x00000000024B0000-0x00000000025CE000-memory.dmp
memory/2604-17-0x0000000002370000-0x00000000024AD000-memory.dmp
memory/2604-15-0x0000000010000000-0x0000000010227000-memory.dmp
memory/2604-21-0x00000000024B0000-0x00000000025CE000-memory.dmp
memory/2604-14-0x00000000001B0000-0x00000000001B6000-memory.dmp
memory/2604-14-0x00000000001B0000-0x00000000001B6000-memory.dmp
memory/2604-15-0x0000000010000000-0x0000000010227000-memory.dmp
memory/2604-17-0x0000000002370000-0x00000000024AD000-memory.dmp
memory/2604-18-0x00000000024B0000-0x00000000025CE000-memory.dmp
memory/2604-19-0x00000000024B0000-0x00000000025CE000-memory.dmp
memory/2604-21-0x00000000024B0000-0x00000000025CE000-memory.dmp
memory/2604-22-0x00000000024B0000-0x00000000025CE000-memory.dmp
memory/2604-19-0x00000000024B0000-0x00000000025CE000-memory.dmp
memory/2604-18-0x00000000024B0000-0x00000000025CE000-memory.dmp