Analysis
- max time kernel
150s - max time network
111s - platform
windows7_x64 - resource
win7v20201028 - submitted
02/04/2021, 09:36
Static task
static1
Behavioral task
behavioral1
Sample
e564ffc635a7c73751b8eaf78fda310b.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
e564ffc635a7c73751b8eaf78fda310b.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target e564ffc635a7c73751b8eaf78fda310b.exe
- Size 175KB
- Sample210402-71ra7wpy6a
- SHA256 0f32500a74e76831740141dfc69676b97a72f9f66da30dfa3aa8648b836373cf
- MD5 e564ffc635a7c73751b8eaf78fda310b
- SHA1 9da683f27d5abc76be2ea9fc2d09f9e230c86287
- SHA512 67f4d4bc73677376f59de401b9b917efd58bc318c8169b770ec980cf3d79f0aee81ba39e066af66347c2ece152c78f047530db4316c10510d98662c1c7ae66a7
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://smbproperty.ru/
-
http://gmbshop.ru/
-
http://baksproperty.gov.ug/
-
http://magistralpsw.ru/
-
http://mpmanagertzz.ru/
-
http://powerglasspot.ru/
-
http://autopartswarehouses.ru/
-
http://memoloves.ru/
-
http://alfavanilin.ru/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Deletes itself 1 IoCs
pid Process 1272 Process not Found - Loads dropped DLL 1 IoCs
pid Process 1632 e564ffc635a7c73751b8eaf78fda310b.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e564ffc635a7c73751b8eaf78fda310b.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e564ffc635a7c73751b8eaf78fda310b.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e564ffc635a7c73751b8eaf78fda310b.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1632 e564ffc635a7c73751b8eaf78fda310b.exe 1632 e564ffc635a7c73751b8eaf78fda310b.exe 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1632 e564ffc635a7c73751b8eaf78fda310b.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1272 Process not Found 1272 Process not Found 1272 Process not Found 1272 Process not Found