Analysis
- max time kernel
152s - max time network
145s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
16/10/2021, 02:57
Static task
static1
Behavioral task
behavioral1
Sample
g1UitnVSXkY82jcpWYJ4Y9yL.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
g1UitnVSXkY82jcpWYJ4Y9yL.exe
Resource
win10-en-20211014
windows10_x64
0 signatures
0 seconds
General
- Target g1UitnVSXkY82jcpWYJ4Y9yL.exe
- Size 294KB
- Sample211016-dflr2sbfe4
- SHA256 5eff7e99184b9c8352125aaf8aa9d72e33049c52dc4eb7a69d509da3e7004cb2
- MD5 78674b261fbad461ebb0375ccae004b6
- SHA1 34cd2e8ff2528e3b766e0da7c08102c0bcee638c
- SHA512 f54f0b9378f83860d36719dcde8801262c8986ceec363d75b3bbfbff0e152625bf5c7b3a937d7653bb09d6deaf042550d9a82e35cab0ff3572b1b0277790a831
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://directorycart.com/upload/
-
http://tierzahnarzt.at/upload/
-
http://streetofcards.com/upload/
-
http://ycdfzd.com/upload/
-
http://successcoachceo.com/upload/
-
http://uhvu.cn/upload/
-
http://japanarticle.com/upload/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Deletes itself 1 IoCs
pid Process 3024 Process not Found - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI g1UitnVSXkY82jcpWYJ4Y9yL.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI g1UitnVSXkY82jcpWYJ4Y9yL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI g1UitnVSXkY82jcpWYJ4Y9yL.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2528 g1UitnVSXkY82jcpWYJ4Y9yL.exe 2528 g1UitnVSXkY82jcpWYJ4Y9yL.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3024 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2528 g1UitnVSXkY82jcpWYJ4Y9yL.exe