Analysis
- max time kernel
150s - max time network
136s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
- submitted
08/02/2024, 11:41
General
- Target 18e41c088abac684c090592bc7df4305.exe
- Size 169KB
- Sample240208-ntewrsed78
- SHA256 2aa5a9c9059070191dcf750e2db3860dfd4803b5d50c8d71edc17fe3c3ef2994
Malware Config
Extracted
-
smokeloader
-
pub1
Extracted
-
smokeloader
-
2022
-
http://trad-einmyus.com/index.php
-
http://tradein-myus.com/index.php
-
http://trade-inmyus.com/index.php
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Deletes itself 1 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 5 IoCs
- Program crash 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\18e41c088abac684c090592bc7df4305.exe"C:\Users\Admin\AppData\Local\Temp\18e41c088abac684c090592bc7df4305.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\9F8A.exeC:\Users\Admin\AppData\Local\Temp\9F8A.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\AD50.exeC:\Users\Admin\AppData\Local\Temp\AD50.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 962⤵
- Loads dropped DLL
- Program crash
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
94308059B57B3142E455B38A6EB92015
F0ACCF77CDCBFF39F6191887F6D2D357
94308059B57B3142E455B38A6EB92015
F0ACCF77CDCBFF39F6191887F6D2D357
9F8A.exe
AD50.exe
Tar1DD4.tmp
AD50.exe
AD50.exe
AD50.exe
memory/1368-4-0x0000000002910000-0x0000000002926000-memory.dmp
memory/1368-20-0x0000000004100000-0x0000000004116000-memory.dmp
memory/2668-18-0x0000000000290000-0x0000000000390000-memory.dmp
memory/2668-21-0x0000000000400000-0x0000000002BD6000-memory.dmp
memory/2668-19-0x0000000000400000-0x0000000002BD6000-memory.dmp
memory/2688-43-0x00000000000A0000-0x00000000000A1000-memory.dmp
memory/2688-64-0x00000000001F0000-0x0000000000D4B000-memory.dmp
memory/2688-41-0x00000000000A0000-0x00000000000A1000-memory.dmp
memory/2688-29-0x0000000000080000-0x0000000000081000-memory.dmp
memory/2688-46-0x0000000000160000-0x0000000000161000-memory.dmp
memory/2688-48-0x00000000001F0000-0x0000000000D4B000-memory.dmp
memory/2688-49-0x0000000000160000-0x0000000000161000-memory.dmp
memory/2688-52-0x0000000000170000-0x0000000000171000-memory.dmp
memory/2688-54-0x0000000000170000-0x0000000000171000-memory.dmp
memory/2688-59-0x0000000000180000-0x0000000000181000-memory.dmp
memory/2688-57-0x0000000000180000-0x0000000000181000-memory.dmp
memory/2688-38-0x0000000000090000-0x0000000000091000-memory.dmp
memory/2688-65-0x0000000000190000-0x0000000000191000-memory.dmp
memory/2688-36-0x0000000000090000-0x0000000000091000-memory.dmp
memory/2688-34-0x0000000000090000-0x0000000000091000-memory.dmp
memory/2688-33-0x0000000000080000-0x0000000000081000-memory.dmp
memory/2688-71-0x00000000001F0000-0x0000000000D4B000-memory.dmp
memory/2688-31-0x0000000000080000-0x0000000000081000-memory.dmp
memory/2932-2-0x0000000000220000-0x000000000022B000-memory.dmp
memory/2932-5-0x0000000000400000-0x0000000000434000-memory.dmp
memory/2932-3-0x0000000000400000-0x0000000000434000-memory.dmp
memory/2932-1-0x0000000000530000-0x0000000000630000-memory.dmp