Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
25-09-2021 10:03
Static task
static1
Behavioral task
behavioral1
Sample
61167F2BE099B7BF668E25A470119ADFA0C409C2E5C05.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
61167F2BE099B7BF668E25A470119ADFA0C409C2E5C05.exe
Resource
win10-en-20210920
General
-
Target
61167F2BE099B7BF668E25A470119ADFA0C409C2E5C05.exe
-
Size
214KB
-
MD5
8cd6a0f9c54968b2003415a62a6ce8b7
-
SHA1
ea5bacbba4ebceacf4f7c547fc840d03fb8654f7
-
SHA256
61167f2be099b7bf668e25a470119adfa0c409c2e5c059ad1a016c14dd168f3f
-
SHA512
b7a988cf8218a3ff0c13cd58953b4e4b7e4b641d18380bb03a37aa39628d336adac80c8d6d526389d8b2197228813c4b12593fdc5514f633cee0ee856f3ec915
Malware Config
Extracted
smokeloader
2020
http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1220 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
61167F2BE099B7BF668E25A470119ADFA0C409C2E5C05.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 61167F2BE099B7BF668E25A470119ADFA0C409C2E5C05.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 61167F2BE099B7BF668E25A470119ADFA0C409C2E5C05.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 61167F2BE099B7BF668E25A470119ADFA0C409C2E5C05.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
61167F2BE099B7BF668E25A470119ADFA0C409C2E5C05.exepid process 1840 61167F2BE099B7BF668E25A470119ADFA0C409C2E5C05.exe 1840 61167F2BE099B7BF668E25A470119ADFA0C409C2E5C05.exe 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1220 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
61167F2BE099B7BF668E25A470119ADFA0C409C2E5C05.exepid process 1840 61167F2BE099B7BF668E25A470119ADFA0C409C2E5C05.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
pid process 1220 1220 1220 1220 1220 -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
pid process 1220 1220 1220 1220
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1220-62-0x0000000002730000-0x0000000002746000-memory.dmpFilesize
88KB
-
memory/1220-63-0x0000000003AB0000-0x0000000003AC0000-memory.dmpFilesize
64KB
-
memory/1840-59-0x00000000762C1000-0x00000000762C3000-memory.dmpFilesize
8KB
-
memory/1840-60-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/1840-61-0x0000000000400000-0x0000000002C6C000-memory.dmpFilesize
40.4MB