Analysis
- max time kernel
150s - max time network
120s - platform
windows10_x64 - resource
win10v20201028 - submitted
18/02/2021, 15:31
Static task
static1
Behavioral task
behavioral1
Sample
451020a5a64f39d8d434b37e039f4057.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
451020a5a64f39d8d434b37e039f4057.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 451020a5a64f39d8d434b37e039f4057.exe
- Size 251KB
- Sample210218-knlfnegq7x
- SHA256 c684906ca32b3dd720ecc86aa54ca56a69f8300e112bd3af5f54d569e9e5ba27
- MD5 451020a5a64f39d8d434b37e039f4057
- SHA1 e021710294d396e8d36f6e51f3e4506fc232ab5d
- SHA512 be0293a9599cabd1b662f4bab27efc6abad724dbb60b968f0e900fcf77fd1df66ddd8472784de965200ee710543f4f0495804ea63bfdffdbce176802fc7c4590
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://smbproperty.ru/
-
http://gmbshop.ru/
-
http://baksproperty.gov.ug/
-
http://magistralpsw.ru/
-
http://mpmanagertzz.ru/
-
http://powerglasspot.ru/
-
http://autopartswarehouses.ru/
-
http://memoloves.ru/
-
http://alfavanilin.ru/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Deletes itself 1 IoCs
pid Process 2968 Process not Found - Loads dropped DLL 1 IoCs
pid Process 732 451020a5a64f39d8d434b37e039f4057.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 451020a5a64f39d8d434b37e039f4057.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 451020a5a64f39d8d434b37e039f4057.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 451020a5a64f39d8d434b37e039f4057.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 732 451020a5a64f39d8d434b37e039f4057.exe 732 451020a5a64f39d8d434b37e039f4057.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 732 451020a5a64f39d8d434b37e039f4057.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2968 Process not Found