Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 19:28
Static task
static1
Behavioral task
behavioral1
Sample
d3f6217f66716d1b253b60365db8aa4c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d3f6217f66716d1b253b60365db8aa4c.exe
Resource
win10v2004-20240226-en
General
-
Target
d3f6217f66716d1b253b60365db8aa4c.exe
-
Size
209KB
-
MD5
d3f6217f66716d1b253b60365db8aa4c
-
SHA1
d1e2bf928bce0f5a913b0de81a22272d1f051f5a
-
SHA256
5c0bfb5d5f155f64c1af3cc3cd610fa6e3495ae2c3a8660c96ac9a7fb73eb749
-
SHA512
5edaa19f69971e5201ba9f378fb19ba6e5fa481f9dded8eb9c1912db0a6ae87f8dcb75da49b428f1b48617423558a2d7ddc1dedfd8847fdc97189f6f9d25a98e
-
SSDEEP
3072:VsUFZW1zxw2PfoScast12esP9+mSjiN69BibwQ8dsN7BrV0ncwmKqx7I1YS:lFw1ljPfojast12FFv69BrQPdtKoAY
Malware Config
Extracted
smokeloader
sel2
Extracted
smokeloader
2022
https://airwide-land.com/calcroom.php
https://summerwaterhall.com/calcroom.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1364 -
Executes dropped EXE 1 IoCs
Processes:
ijtjduepid process 2828 ijtjdue -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
d3f6217f66716d1b253b60365db8aa4c.exeijtjduedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d3f6217f66716d1b253b60365db8aa4c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ijtjdue Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ijtjdue Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ijtjdue Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d3f6217f66716d1b253b60365db8aa4c.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d3f6217f66716d1b253b60365db8aa4c.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
d3f6217f66716d1b253b60365db8aa4c.exepid process 1720 d3f6217f66716d1b253b60365db8aa4c.exe 1720 d3f6217f66716d1b253b60365db8aa4c.exe 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
d3f6217f66716d1b253b60365db8aa4c.exeijtjduepid process 1720 d3f6217f66716d1b253b60365db8aa4c.exe 2828 ijtjdue -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
taskeng.exedescription pid process target process PID 2856 wrote to memory of 2828 2856 taskeng.exe ijtjdue PID 2856 wrote to memory of 2828 2856 taskeng.exe ijtjdue PID 2856 wrote to memory of 2828 2856 taskeng.exe ijtjdue PID 2856 wrote to memory of 2828 2856 taskeng.exe ijtjdue
Processes
-
C:\Users\Admin\AppData\Local\Temp\d3f6217f66716d1b253b60365db8aa4c.exe"C:\Users\Admin\AppData\Local\Temp\d3f6217f66716d1b253b60365db8aa4c.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\taskeng.exetaskeng.exe {E0D5BDC5-0F68-4B9A-BB4D-449662478CBD} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\ijtjdueC:\Users\Admin\AppData\Roaming\ijtjdue2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ijtjdueFilesize
209KB
MD5d3f6217f66716d1b253b60365db8aa4c
SHA1d1e2bf928bce0f5a913b0de81a22272d1f051f5a
SHA2565c0bfb5d5f155f64c1af3cc3cd610fa6e3495ae2c3a8660c96ac9a7fb73eb749
SHA5125edaa19f69971e5201ba9f378fb19ba6e5fa481f9dded8eb9c1912db0a6ae87f8dcb75da49b428f1b48617423558a2d7ddc1dedfd8847fdc97189f6f9d25a98e
-
memory/1364-4-0x00000000025B0000-0x00000000025C6000-memory.dmpFilesize
88KB
-
memory/1364-16-0x00000000025E0000-0x00000000025F6000-memory.dmpFilesize
88KB
-
memory/1720-1-0x0000000002E40000-0x0000000002F40000-memory.dmpFilesize
1024KB
-
memory/1720-2-0x0000000000220000-0x000000000022B000-memory.dmpFilesize
44KB
-
memory/1720-3-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1720-8-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1720-5-0x0000000000400000-0x0000000002C93000-memory.dmpFilesize
40.6MB
-
memory/2828-15-0x0000000000400000-0x0000000002C93000-memory.dmpFilesize
40.6MB
-
memory/2828-17-0x0000000000400000-0x0000000002C93000-memory.dmpFilesize
40.6MB