Analysis
-
max time kernel
150s -
max time network
110s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
05-03-2021 17:05
General
-
Target
25959cfe4619126ab554d3111b875218f1dbfadd79eed1ed0f6a8c1900fa36e0.exe
-
Size
308KB
-
MD5
c067e0a2d7fc6092bb77abc7f7156b60
-
SHA1
52f68073caec0fd424c7cbaaed5f5221d7103d20
-
SHA256
25959cfe4619126ab554d3111b875218f1dbfadd79eed1ed0f6a8c1900fa36e0
-
SHA512
685145c679413f82101c328ce4264c5f84d0347db1c5170e16d8a459b9ad12a87bf5e718e049e5c9c639e22197ee26d4aa33fac8c133b9d86772dfe1a8068dfc
Score
10/10
Malware Config
Extracted
Family
smokeloader
Version
2020
C2
http://pukupoko.top/
http://halyavapridi.top/
http://holofrew.me/
rc4.i32
rc4.i32
Signatures
-
Detected Netwalker Ransomware 2 IoCs
Detected unpacked Netwalker executable.
-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
CryptOne packer 2 IoCs
Detects CryptOne packer defined in NCC blogpost.
-
Executes dropped EXE 1 IoCs
-
Deletes itself 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\25959cfe4619126ab554d3111b875218f1dbfadd79eed1ed0f6a8c1900fa36e0.exe"C:\Users\Admin\AppData\Local\Temp\25959cfe4619126ab554d3111b875218f1dbfadd79eed1ed0f6a8c1900fa36e0.exe"1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\jgcttjjC:\Users\Admin\AppData\Roaming\jgcttjj1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
-
Filesize
152KB
-
Filesize
88KB