Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    15-02-2024 23:57

General

  • Target

    8a0cc572475268a9ca1e1f9f65bbcd875b3aeb0522014d627e780e615092cd9a.exe

  • Size

    240KB

  • MD5

    32e42bd81cfc8ea5fc638a5f43a749f0

  • SHA1

    37df03feda3f4da9ef7c5d2bdc308bda6d1a9b49

  • SHA256

    8a0cc572475268a9ca1e1f9f65bbcd875b3aeb0522014d627e780e615092cd9a

  • SHA512

    8a531a29a39b663fb17ccd0c6a72d17635254d3e8061b1ee949f8f9b4cace6106e6d9363f5a8d7b4b42119233c7edfac3a9a3bb5be9c3846617c26e692944e15

  • SSDEEP

    6144:6Ofqv2ATm/X4b0jtNqrqokT6MbiZ44WR:6OfhAwowKgsZ6

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

smokeloader

Version

2022

C2

http://sjyey.com/tmp/index.php

http://babonwo.ru/tmp/index.php

http://mth.com.ua/tmp/index.php

http://piratia.pw/tmp/index.php

http://go-piratia.ru/tmp/index.php

rc4.i32
rc4.i32

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Downloads MZ/PE file
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8a0cc572475268a9ca1e1f9f65bbcd875b3aeb0522014d627e780e615092cd9a.exe
    "C:\Users\Admin\AppData\Local\Temp\8a0cc572475268a9ca1e1f9f65bbcd875b3aeb0522014d627e780e615092cd9a.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:3000
  • C:\Users\Admin\AppData\Local\Temp\1B1F.exe
    C:\Users\Admin\AppData\Local\Temp\1B1F.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1396
    • C:\Users\Admin\AppData\Local\Temp\1B1F.exe
      C:\Users\Admin\AppData\Local\Temp\1B1F.exe
      2⤵
        PID:2612
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {302ADBBB-324C-41DF-A6B5-B0F2CDEAD367} S-1-5-21-3427588347-1492276948-3422228430-1000:QVMRJQQO\Admin:Interactive:[1]
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1712
      • C:\Users\Admin\AppData\Roaming\afrrbdj
        C:\Users\Admin\AppData\Roaming\afrrbdj
        2⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        • Suspicious behavior: MapViewOfSection
        PID:2552

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\1B1F.exe

      Filesize

      389KB

      MD5

      57a16daebdf4113651b1d0a1af3ebf96

      SHA1

      bf2dec1b7cdbe8548020f6e9c3002151fe6a20ee

      SHA256

      54fe7416808922eb895d5a5b56aa62db6c404bf95d9d689e4e6d464b2f9e58b4

      SHA512

      a20f4c5e9e3f3656171201e509d80dfc61b962c141512cd05945dad0129b181cc3516b21c43a76d1a04c13208760362187e894db198ecfc81664b75f744d58b6

    • C:\Users\Admin\AppData\Local\Temp\1B1F.exe

      Filesize

      145KB

      MD5

      cd509076d6e471194363cfecc06c46b6

      SHA1

      d50dfba7b2ce5037145bc545172c887431f26da1

      SHA256

      de874c7f06632d5bf1556fa21ee917915d00e7143d6fe3721128c575fe4ac82c

      SHA512

      390d0b7b6a6eb0b879a29194e228c86c16a91a408ca9149a2065487fc7bfa66ecc65d4cffe4b39eda18e4ea51f71afe49ffbd5220135da5f56b889142ab66076

    • C:\Users\Admin\AppData\Roaming\afrrbdj

      Filesize

      240KB

      MD5

      32e42bd81cfc8ea5fc638a5f43a749f0

      SHA1

      37df03feda3f4da9ef7c5d2bdc308bda6d1a9b49

      SHA256

      8a0cc572475268a9ca1e1f9f65bbcd875b3aeb0522014d627e780e615092cd9a

      SHA512

      8a531a29a39b663fb17ccd0c6a72d17635254d3e8061b1ee949f8f9b4cace6106e6d9363f5a8d7b4b42119233c7edfac3a9a3bb5be9c3846617c26e692944e15

    • \Users\Admin\AppData\Local\Temp\1B1F.exe

      Filesize

      192KB

      MD5

      b4149b4a35e02013e81f173b6e1c2c35

      SHA1

      7cd2908d39d22d3615b18c848941c3a6b39cc58c

      SHA256

      119cd393ce755ceae61df6fed0e80c135cc988b972307db5e19e4ee1955c9886

      SHA512

      a7de6b5cd059b13894266a02f4b05328add5dc3d9da449ec57a37f94844b32639b06d46df229b456c52177c9cd14fff95a8062be9f31223aefa68c8c3f78f77d

    • memory/1272-4-0x0000000002AA0000-0x0000000002AB6000-memory.dmp

      Filesize

      88KB

    • memory/1272-31-0x0000000002CB0000-0x0000000002CC6000-memory.dmp

      Filesize

      88KB

    • memory/1396-23-0x00000000004E0000-0x000000000054F000-memory.dmp

      Filesize

      444KB

    • memory/1396-25-0x00000000002F0000-0x00000000003F0000-memory.dmp

      Filesize

      1024KB

    • memory/1396-21-0x00000000002F0000-0x00000000003F0000-memory.dmp

      Filesize

      1024KB

    • memory/2552-30-0x0000000000400000-0x000000000044C000-memory.dmp

      Filesize

      304KB

    • memory/2552-29-0x0000000000270000-0x0000000000370000-memory.dmp

      Filesize

      1024KB

    • memory/2552-34-0x0000000000400000-0x000000000044C000-memory.dmp

      Filesize

      304KB

    • memory/2612-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/3000-3-0x0000000000400000-0x000000000044C000-memory.dmp

      Filesize

      304KB

    • memory/3000-5-0x0000000000400000-0x000000000044C000-memory.dmp

      Filesize

      304KB

    • memory/3000-2-0x00000000001B0000-0x00000000001BB000-memory.dmp

      Filesize

      44KB

    • memory/3000-8-0x00000000001B0000-0x00000000001BB000-memory.dmp

      Filesize

      44KB

    • memory/3000-1-0x00000000002F0000-0x00000000003F0000-memory.dmp

      Filesize

      1024KB