Analysis
- max time kernel
150s - max time network
116s - platform
windows10_x64 - resource
win10v20210410 - submitted
09/08/2021, 11:37
Static task
static1
Behavioral task
behavioral1
Sample
ee54bfb1645819dc424bc88f2d9631db.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ee54bfb1645819dc424bc88f2d9631db.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target ee54bfb1645819dc424bc88f2d9631db.exe
- Size 223KB
- Sample210809-e6ll9yn4yn
- SHA256 5849cb66f97165b80e0ea4d049558bea07d1e98ebb820fe74ff450ee8acdbcd2
- MD5 ee54bfb1645819dc424bc88f2d9631db
- SHA1 4b62a331337771b8d5ce0c60edbfa31b89f3b266
- SHA512 66ee4850dd742bbee6470c2fba71a8921ed1d2dd361f57ed8494aea5f993343fca5975fb0ef3e4588f30e47c0719b332553475ecc507f1fdab79183ca8fa9df0
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://aucmoney.com/upload/
-
http://thegymmum.com/upload/
-
http://atvcampingtrips.com/upload/
-
http://kuapakualaman.com/upload/
-
http://renatazarazua.com/upload/
-
http://nasufmutlu.com/upload/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Deletes itself 1 IoCs
pid Process 2984 Process not Found - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ee54bfb1645819dc424bc88f2d9631db.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ee54bfb1645819dc424bc88f2d9631db.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ee54bfb1645819dc424bc88f2d9631db.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3172 ee54bfb1645819dc424bc88f2d9631db.exe 3172 ee54bfb1645819dc424bc88f2d9631db.exe 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2984 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3172 ee54bfb1645819dc424bc88f2d9631db.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2984 Process not Found