Overview
overview
10Static
static
10Dropper/Berbew.exe
windows7-x64
10Dropper/Berbew.exe
windows10-2004-x64
10Dropper/Phorphiex.exe
windows7-x64
10Dropper/Phorphiex.exe
windows10-2004-x64
10RAT/31.exe
windows7-x64
10RAT/31.exe
windows10-2004-x64
10RAT/XClient.exe
windows7-x64
10RAT/XClient.exe
windows10-2004-x64
10RAT/file.exe
windows7-x64
7RAT/file.exe
windows10-2004-x64
7Ransomware...-2.exe
windows7-x64
10Ransomware...-2.exe
windows10-2004-x64
10Ransomware...01.exe
windows7-x64
10Ransomware...01.exe
windows10-2004-x64
10Ransomware...lt.exe
windows7-x64
10Ransomware...lt.exe
windows10-2004-x64
10Stealers/Azorult.exe
windows7-x64
10Stealers/Azorult.exe
windows10-2004-x64
10Stealers/B...on.exe
windows7-x64
10Stealers/B...on.exe
windows10-2004-x64
10Stealers/Dridex.dll
windows7-x64
10Stealers/Dridex.dll
windows10-2004-x64
10Stealers/M..._2.exe
windows7-x64
10Stealers/M..._2.exe
windows10-2004-x64
10Stealers/lumma.exe
windows7-x64
1Stealers/lumma.exe
windows10-2004-x64
10Trojan/BetaBot.exe
windows7-x64
10Trojan/BetaBot.exe
windows10-2004-x64
10Trojan/Smo...er.exe
windows7-x64
10Trojan/Smo...er.exe
windows10-2004-x64
10Resubmissions
03-09-2024 14:02
240903-rb57sazdqf 1003-09-2024 13:51
240903-q59avszclf 1002-09-2024 19:51
240902-yk8gtsxbpd 1002-09-2024 02:27
240902-cxh7tazflg 1002-09-2024 02:26
240902-cwxc2sygll 1021-06-2024 19:37
240621-yca7cszgnd 1009-06-2024 17:07
240609-vm7rjadd73 1013-05-2024 17:36
240513-v6qblafe3y 1012-05-2024 17:17
240512-vty3zafh5s 10Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
12-05-2024 16:15
Behavioral task
behavioral1
Sample
Dropper/Berbew.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Dropper/Berbew.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Dropper/Phorphiex.exe
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
Dropper/Phorphiex.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
RAT/31.exe
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
RAT/31.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
RAT/XClient.exe
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
RAT/XClient.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
RAT/file.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
RAT/file.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
Ransomware/Client-2.exe
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
Ransomware/Client-2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
Ransomware/criticalupdate01.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
Ransomware/criticalupdate01.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
Ransomware/default.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
Ransomware/default.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
Stealers/Azorult.exe
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
Stealers/Azorult.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
Stealers/BlackMoon.exe
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
Stealers/BlackMoon.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
Stealers/Dridex.dll
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
Stealers/Dridex.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
Stealers/Masslogger/mouse_2.exe
Resource
win7-20240220-en
Behavioral task
behavioral24
Sample
Stealers/Masslogger/mouse_2.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral25
Sample
Stealers/lumma.exe
Resource
win7-20240419-en
Behavioral task
behavioral26
Sample
Stealers/lumma.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
Trojan/BetaBot.exe
Resource
win7-20240508-en
Behavioral task
behavioral28
Sample
Trojan/BetaBot.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral29
Sample
Trojan/SmokeLoader.exe
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
Trojan/SmokeLoader.exe
Resource
win10v2004-20240508-en
General
-
Target
Trojan/SmokeLoader.exe
-
Size
251KB
-
MD5
924aa6c26f6f43e0893a40728eac3b32
-
SHA1
baa9b4c895b09d315ed747b3bd087f4583aa84fc
-
SHA256
30f9db1f5838abb6c1580fdfb7f5dcfd7c2ac8cfac50c2edd0c8415d66212c95
-
SHA512
3cb6fd659aff46eaa62b0e647ccebeecb070ba0bb27e1cc037b33caf23c417e75f476e1c08e1b5f3b232c4640995ae5afa43bfd09252d318fe5eec0d18de830a
-
SSDEEP
6144:2E5sHpScP2xeQhp4wGoqPKNDF50AsurB:PsHIiQv4gBNDFiTuF
Malware Config
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Loads dropped DLL 1 IoCs
Processes:
SmokeLoader.exepid process 1712 SmokeLoader.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SmokeLoader.exedescription pid process target process PID 1740 set thread context of 1712 1740 SmokeLoader.exe SmokeLoader.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
SmokeLoader.exedescription pid process target process PID 1740 wrote to memory of 1712 1740 SmokeLoader.exe SmokeLoader.exe PID 1740 wrote to memory of 1712 1740 SmokeLoader.exe SmokeLoader.exe PID 1740 wrote to memory of 1712 1740 SmokeLoader.exe SmokeLoader.exe PID 1740 wrote to memory of 1712 1740 SmokeLoader.exe SmokeLoader.exe PID 1740 wrote to memory of 1712 1740 SmokeLoader.exe SmokeLoader.exe PID 1740 wrote to memory of 1712 1740 SmokeLoader.exe SmokeLoader.exe PID 1740 wrote to memory of 1712 1740 SmokeLoader.exe SmokeLoader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Trojan\SmokeLoader.exe"C:\Users\Admin\AppData\Local\Temp\Trojan\SmokeLoader.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Trojan\SmokeLoader.exe"C:\Users\Admin\AppData\Local\Temp\Trojan\SmokeLoader.exe"2⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\D47F.tmpFilesize
1.2MB
MD5d124f55b9393c976963407dff51ffa79
SHA12c7bbedd79791bfb866898c85b504186db610b5d
SHA256ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef
SHA512278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06
-
memory/1712-1-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1712-6-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1712-8-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1712-13-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1740-5-0x0000000000AB0000-0x0000000000BB0000-memory.dmpFilesize
1024KB
-
memory/1740-4-0x0000000000020000-0x000000000002B000-memory.dmpFilesize
44KB
-
memory/1740-14-0x0000000000AB0000-0x0000000000BB0000-memory.dmpFilesize
1024KB