General
-
Target
E24E.exe
-
Size
118KB
-
Sample
210213-4fa6h12tva
-
MD5
9fa583c32c39c0b668f044668d1265a6
-
SHA1
e144d568e7c7876409ea8566e1fe00d2aba092db
-
SHA256
3f9e4250ff4d4161bb408b982e2ca0979380110b32a255c11a4df15e21534acc
-
SHA512
7aef7aa6176f8a9e2f7f208cebe5e45d03cfd6cbfe55fd4599151eaa8d0dba4dbdd4738910e1df985d6c004aae5eca2948b6dc5f82d8fea3fabf5618dde4a7b4
Static task
static1
Behavioral task
behavioral1
Sample
E24E.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
E24E.exe
Resource
win10v20201028
Malware Config
Extracted
smokeloader
2019
http://10022020newfolder1002002131-service1002.space/
http://10022020newfolder1002002231-service1002.space/
http://10022020newfolder3100231-service1002.space/
http://10022020newfolder1002002431-service1002.space/
http://10022020newfolder1002002531-service1002.space/
http://10022020newfolder33417-01242510022020.space/
http://10022020test125831-service1002012510022020.space/
http://10022020test136831-service1002012510022020.space/
http://10022020test147831-service1002012510022020.space/
http://10022020test146831-service1002012510022020.space/
http://10022020test134831-service1002012510022020.space/
http://10022020est213531-service100201242510022020.ru/
http://10022020yes1t3481-service1002012510022020.ru/
http://10022020test13561-service1002012510022020.su/
http://10022020test14781-service1002012510022020.info/
http://10022020test13461-service1002012510022020.net/
http://10022020test15671-service1002012510022020.tech/
http://10022020test12671-service1002012510022020.online/
http://10022020utest1341-service1002012510022020.ru/
http://10022020uest71-service100201dom2510022020.ru/
http://10022020test61-service1002012510022020.website/
http://10022020test51-service1002012510022020.xyz/
http://10022020test41-service100201pro2510022020.ru/
http://10022020yest31-service100201rus2510022020.ru/
http://10022020rest21-service1002012510022020.eu/
http://10022020test11-service1002012510022020.press/
http://10022020newfolder4561-service1002012510022020.ru/
http://10022020rustest213-service1002012510022020.ru/
http://10022020test281-service1002012510022020.ru/
http://10022020test261-service1002012510022020.space/
http://10022020yomtest251-service1002012510022020.ru/
http://10022020yirtest231-service1002012510022020.ru/
Extracted
raccoon
9ba64f4b6fe448911470a88f09d6e7d5b92ff0ab
-
url4cnc
https://telete.in/jagressor_kz
Targets
-
-
Target
E24E.exe
-
Size
118KB
-
MD5
9fa583c32c39c0b668f044668d1265a6
-
SHA1
e144d568e7c7876409ea8566e1fe00d2aba092db
-
SHA256
3f9e4250ff4d4161bb408b982e2ca0979380110b32a255c11a4df15e21534acc
-
SHA512
7aef7aa6176f8a9e2f7f208cebe5e45d03cfd6cbfe55fd4599151eaa8d0dba4dbdd4738910e1df985d6c004aae5eca2948b6dc5f82d8fea3fabf5618dde4a7b4
-
Executes dropped EXE
-
Deletes itself
-
Loads dropped DLL
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-