Analysis
- max time kernel
150s - max time network
123s - platform
windows10_x64 - resource
win10v20210408 - submitted
09/08/2021, 11:33
Static task
static1
Behavioral task
behavioral1
Sample
e56fcd770011e421671e0139c91c5a1f.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
e56fcd770011e421671e0139c91c5a1f.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target e56fcd770011e421671e0139c91c5a1f.exe
- Size 222KB
- Sample210809-he4tkpzjpn
- SHA256 5074213bdad4f70a772ff9da9ef5d64d5ebdb1b85f894c82523f75cc8dee9903
- MD5 e56fcd770011e421671e0139c91c5a1f
- SHA1 7e241a390ba4225cb7284a3f4c3508984c2b7b3b
- SHA512 09c175099cb546a63e70849c341bd4c2528943cf08ab11d816a40c6dc68b91a174a6b0b17b1a60598a13faf86a9d331c677415685e97a7d2042aed74e5b12c3a
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://aucmoney.com/upload/
-
http://thegymmum.com/upload/
-
http://atvcampingtrips.com/upload/
-
http://kuapakualaman.com/upload/
-
http://renatazarazua.com/upload/
-
http://nasufmutlu.com/upload/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Deletes itself 1 IoCs
pid Process 3000 Process not Found - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e56fcd770011e421671e0139c91c5a1f.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e56fcd770011e421671e0139c91c5a1f.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e56fcd770011e421671e0139c91c5a1f.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3492 e56fcd770011e421671e0139c91c5a1f.exe 3492 e56fcd770011e421671e0139c91c5a1f.exe 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found 3000 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3000 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3492 e56fcd770011e421671e0139c91c5a1f.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3000 Process not Found