Analysis
- max time kernel
151s - max time network
151s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
25/09/2021, 10:16
Static task
static1
Behavioral task
behavioral1
Sample
de17db0528befd61dc23638a2ba135c8.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
de17db0528befd61dc23638a2ba135c8.exe
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
General
- Target de17db0528befd61dc23638a2ba135c8.exe
- Size 244KB
- Sample210925-mat1xaback
- SHA256 c631cb26f2e253d64adb3caf2ef5f15930caf089a6dc9fa7e0ac2e9512cd57d3
- MD5 de17db0528befd61dc23638a2ba135c8
- SHA1 25c17db05b9349749659e5b709c06acc1b156505
- SHA512 dcbf76729ac38881925f81c042f24c093a8fe371b6b17819d841b376f23966706bd69168e13aedd200765d41a0ad30457a9188db114a0273c5b03fc6116d5c28
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://varmisende.com/upload/
-
http://fernandomayol.com/upload/
-
http://nextlytm.com/upload/
-
http://people4jan.com/upload/
-
http://asfaltwerk.com/upload/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Deletes itself 1 IoCs
pid Process 3032 Process not Found - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI de17db0528befd61dc23638a2ba135c8.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI de17db0528befd61dc23638a2ba135c8.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI de17db0528befd61dc23638a2ba135c8.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2668 de17db0528befd61dc23638a2ba135c8.exe 2668 de17db0528befd61dc23638a2ba135c8.exe 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3032 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2668 de17db0528befd61dc23638a2ba135c8.exe