General
-
Target
2021lk049459.doc
-
Size
2MB
-
Sample
210413-pfkjm2xd9x
-
MD5
40f9df41effa8762858974452db083d9
-
SHA1
fd382c2ae4ad3545b5d198d8c51735045584f8ce
-
SHA256
06b686985f4246819d7fed52a2b9fc1dbed7406d80f902d655866aed61392cbd
-
SHA512
f09b0b5415ac3f1c9af5f13774bb01675540a3238ac23301b404f13fb847f62725e7ad03f7de7b0fbecf19c90ee2be53b5e7b09aada12780f7685258b54f58f2
Static task
static1
Behavioral task
behavioral1
Sample
2021lk049459.doc
Resource
win7v20210410
Behavioral task
behavioral2
Sample
2021lk049459.doc
Resource
win10v20210408
Malware Config
Extracted
https://u.teknik.io/bHrgG.jpg
Extracted
smokeloader
2018
http://94.140.114.59/1/
Targets
-
-
Target
2021lk049459.doc
-
Size
2MB
-
MD5
40f9df41effa8762858974452db083d9
-
SHA1
fd382c2ae4ad3545b5d198d8c51735045584f8ce
-
SHA256
06b686985f4246819d7fed52a2b9fc1dbed7406d80f902d655866aed61392cbd
-
SHA512
f09b0b5415ac3f1c9af5f13774bb01675540a3238ac23301b404f13fb847f62725e7ad03f7de7b0fbecf19c90ee2be53b5e7b09aada12780f7685258b54f58f2
Score10/10-
Blocklisted process makes network request
-
Executes dropped EXE
-
Loads dropped DLL
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory
-