Analysis
- max time kernel
153s - max time network
135s - platform
windows10_x64 - resource
win10v20210408 - submitted
24/08/2021, 06:26
Static task
static1
Behavioral task
behavioral1
Sample
9cb0f10770d10bb5fe00d502dfa9a754.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
9cb0f10770d10bb5fe00d502dfa9a754.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 9cb0f10770d10bb5fe00d502dfa9a754.exe
- Size 274KB
- Sample210824-dmrvgqpgex
- SHA256 1d56c98200907afafa8a54f802c21ed824e1827162fb19d8f73cf8a8bb61b7f2
- MD5 9cb0f10770d10bb5fe00d502dfa9a754
- SHA1 b7d7cf699d6a43c631c6b3065e4f50d70e7a8179
- SHA512 b3e7f42da697f16efb8e42896c30d53250ef1423f51d5f6a29c575b7bffe90906bbfbd9061f701cc71dec7d157ba61eddcc0fb460b630cd012dff198aa552bc9
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://aucmoney.com/upload/
-
http://thegymmum.com/upload/
-
http://atvcampingtrips.com/upload/
-
http://kuapakualaman.com/upload/
-
http://renatazarazua.com/upload/
-
http://nasufmutlu.com/upload/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Deletes itself 1 IoCs
pid Process 2568 Process not Found - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9cb0f10770d10bb5fe00d502dfa9a754.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9cb0f10770d10bb5fe00d502dfa9a754.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9cb0f10770d10bb5fe00d502dfa9a754.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 800 9cb0f10770d10bb5fe00d502dfa9a754.exe 800 9cb0f10770d10bb5fe00d502dfa9a754.exe 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found 2568 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2568 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 800 9cb0f10770d10bb5fe00d502dfa9a754.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2568 Process not Found