Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
05-03-2021 17:05
Behavioral task
behavioral1
Sample
25959cfe4619126ab554d3111b875218f1dbfadd79eed1ed0f6a8c1900fa36e0.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
25959cfe4619126ab554d3111b875218f1dbfadd79eed1ed0f6a8c1900fa36e0.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
25959cfe4619126ab554d3111b875218f1dbfadd79eed1ed0f6a8c1900fa36e0.exe
-
Size
308KB
-
MD5
c067e0a2d7fc6092bb77abc7f7156b60
-
SHA1
52f68073caec0fd424c7cbaaed5f5221d7103d20
-
SHA256
25959cfe4619126ab554d3111b875218f1dbfadd79eed1ed0f6a8c1900fa36e0
-
SHA512
685145c679413f82101c328ce4264c5f84d0347db1c5170e16d8a459b9ad12a87bf5e718e049e5c9c639e22197ee26d4aa33fac8c133b9d86772dfe1a8068dfc
Score
10/10
Malware Config
Extracted
Family
smokeloader
Version
2020
C2
http://pukupoko.top/
http://halyavapridi.top/
http://holofrew.me/
rc4.i32
rc4.i32
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
pid Process 1236 Process not Found -
Loads dropped DLL 1 IoCs
pid Process 1904 25959cfe4619126ab554d3111b875218f1dbfadd79eed1ed0f6a8c1900fa36e0.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 25959cfe4619126ab554d3111b875218f1dbfadd79eed1ed0f6a8c1900fa36e0.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 25959cfe4619126ab554d3111b875218f1dbfadd79eed1ed0f6a8c1900fa36e0.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 25959cfe4619126ab554d3111b875218f1dbfadd79eed1ed0f6a8c1900fa36e0.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1236 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1904 25959cfe4619126ab554d3111b875218f1dbfadd79eed1ed0f6a8c1900fa36e0.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found -
Suspicious use of SendNotifyMessage 7 IoCs
pid Process 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found
Processes
-
C:\Users\Admin\AppData\Local\Temp\25959cfe4619126ab554d3111b875218f1dbfadd79eed1ed0f6a8c1900fa36e0.exe"C:\Users\Admin\AppData\Local\Temp\25959cfe4619126ab554d3111b875218f1dbfadd79eed1ed0f6a8c1900fa36e0.exe"1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1904