Analysis
-
max time kernel
13s -
max time network
110s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
13-04-2021 08:49
Static task
static1
Behavioral task
behavioral1
Sample
3cf58ec9de521b32015552ca3024d1cd.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
3cf58ec9de521b32015552ca3024d1cd.exe
Resource
win10v20210410
General
-
Target
3cf58ec9de521b32015552ca3024d1cd.exe
-
Size
32KB
-
MD5
3cf58ec9de521b32015552ca3024d1cd
-
SHA1
539236ecd9d859f82f89311bfd564906aa98451e
-
SHA256
ae3e0639c29e82ba61932616457bae4100c939c281643dacfaa1bd5ba2dc9ace
-
SHA512
25d7bdc0c80b886bfdbf2d00fac9628899656bf56d6213e0ef75c2bd4f88117f34c7edd6f46caba291f7d64655ff486cb5bbf0fd6f8ea0996525b02b42f78599
Malware Config
Extracted
smokeloader
2018
http://94.140.114.59/1/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
3cf58ec9de521b32015552ca3024d1cd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 3cf58ec9de521b32015552ca3024d1cd.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 3cf58ec9de521b32015552ca3024d1cd.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
3cf58ec9de521b32015552ca3024d1cd.exepid process 3904 3cf58ec9de521b32015552ca3024d1cd.exe 3904 3cf58ec9de521b32015552ca3024d1cd.exe