Analysis
- max time kernel
153s - max time network
153s - platform
windows7_x64 - resource
win7v20210408 - submitted
24/06/2021, 09:22
Static task
static1
Behavioral task
behavioral1
Sample
78c7b0f66663fb9fffb5c008158152cc.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
78c7b0f66663fb9fffb5c008158152cc.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target 78c7b0f66663fb9fffb5c008158152cc.exe
- Size 346KB
- Sample210624-4kca63xpaa
- SHA256 3d4bdebbec823f327133e07e846db7b30ad625215cc273d9af272c5fde02fb0c
- MD5 78c7b0f66663fb9fffb5c008158152cc
- SHA1 b191a2f3cd5ad870310964b4751222bdd2dabafa
- SHA512 78fe4125b028bf87ab59ce84ed89c4fafc446ff3d8fc5a12f62ea3e703721f4bd60ec23d452b3c1c23e392e96a0010f53c01f87cb192c17242b264fa1ba682c2
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://ppcspb.com/upload/
-
http://mebbing.com/upload/
-
http://twcamel.com/upload/
-
http://howdycash.com/upload/
-
http://lahuertasonora.com/upload/
-
http://kpotiques.com/upload/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Deletes itself 1 IoCs
pid Process 1220 Process not Found - Loads dropped DLL 1 IoCs
pid Process 1080 78c7b0f66663fb9fffb5c008158152cc.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 78c7b0f66663fb9fffb5c008158152cc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 78c7b0f66663fb9fffb5c008158152cc.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 78c7b0f66663fb9fffb5c008158152cc.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1080 78c7b0f66663fb9fffb5c008158152cc.exe 1080 78c7b0f66663fb9fffb5c008158152cc.exe 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1220 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1080 78c7b0f66663fb9fffb5c008158152cc.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found