Analysis
- max time kernel
150s - max time network
195s - platform
windows7_x64 - resource
win7v20210410 - submitted
26/06/2021, 07:17
Static task
static1
Behavioral task
behavioral1
Sample
44da3ea381b7c499288c8af03cb2f273.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
44da3ea381b7c499288c8af03cb2f273.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target 44da3ea381b7c499288c8af03cb2f273.exe
- Size 344KB
- Sample210626-t6barrdpy2
- SHA256 9a6df8254125afdaf645dd3e76100f3ed825f2a4e18b39ac8a5c5f8e0cfb56ef
- MD5 44da3ea381b7c499288c8af03cb2f273
- SHA1 de79f31cf5f64084f5f5d21bcc05784e51be855a
- SHA512 fd086d88a015892cf06092f52f76334b086a9329b054df30fe98c0aa12ed9e1a61e671f4d277bb5b01c7502e3790ce658b012de8a8397fcd1629a29a9d5932b3
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://ppcspb.com/upload/
-
http://mebbing.com/upload/
-
http://twcamel.com/upload/
-
http://howdycash.com/upload/
-
http://lahuertasonora.com/upload/
-
http://kpotiques.com/upload/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Deletes itself 1 IoCs
pid Process 1288 Process not Found - Loads dropped DLL 1 IoCs
pid Process 1920 44da3ea381b7c499288c8af03cb2f273.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 44da3ea381b7c499288c8af03cb2f273.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 44da3ea381b7c499288c8af03cb2f273.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 44da3ea381b7c499288c8af03cb2f273.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1920 44da3ea381b7c499288c8af03cb2f273.exe 1920 44da3ea381b7c499288c8af03cb2f273.exe 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1288 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1920 44da3ea381b7c499288c8af03cb2f273.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found