Analysis
- max time kernel
150s - max time network
118s - submitted
01/01/1970, 00:00
Static task
static1
Behavioral task
behavioral1
Sample
36f662b3c9a54c0c2427602f1463eb69.exe
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
36f662b3c9a54c0c2427602f1463eb69.exe
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
General
- Target 36f662b3c9a54c0c2427602f1463eb69.exe
- Size 185KB
- Sample211027-nt141aefa7
- SHA256 d836a03e0b7eeabbc971de7d3e6fcc11bf06e13e633d11118c7429b3abb3c4ed
- MD5 36f662b3c9a54c0c2427602f1463eb69
- SHA1 7e46615097282ac51ef08d3e4ac7d65ce6684a07
- SHA512 35b60c6da50b94484a77f40c3446beb1d5562128f5585731a09328140c68c7b57f1727cc0783b439dafb5660c93ca1bd4e1c3f443261545aaa9b22c0de9a1599
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://gejajoo7.top/
-
http://sysaheu9.top/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Deletes itself 1 IoCs
pid Process 1216 Process not Found - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 820 set thread context of 1176 820 36f662b3c9a54c0c2427602f1463eb69.exe 28 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 36f662b3c9a54c0c2427602f1463eb69.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 36f662b3c9a54c0c2427602f1463eb69.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 36f662b3c9a54c0c2427602f1463eb69.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1176 36f662b3c9a54c0c2427602f1463eb69.exe 1176 36f662b3c9a54c0c2427602f1463eb69.exe 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found 1216 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1216 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1176 36f662b3c9a54c0c2427602f1463eb69.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1216 Process not Found 1216 Process not Found - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1216 Process not Found 1216 Process not Found - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 820 wrote to memory of 1176 820 36f662b3c9a54c0c2427602f1463eb69.exe 28 PID 820 wrote to memory of 1176 820 36f662b3c9a54c0c2427602f1463eb69.exe 28 PID 820 wrote to memory of 1176 820 36f662b3c9a54c0c2427602f1463eb69.exe 28 PID 820 wrote to memory of 1176 820 36f662b3c9a54c0c2427602f1463eb69.exe 28 PID 820 wrote to memory of 1176 820 36f662b3c9a54c0c2427602f1463eb69.exe 28 PID 820 wrote to memory of 1176 820 36f662b3c9a54c0c2427602f1463eb69.exe 28 PID 820 wrote to memory of 1176 820 36f662b3c9a54c0c2427602f1463eb69.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\36f662b3c9a54c0c2427602f1463eb69.exe"C:\Users\Admin\AppData\Local\Temp\36f662b3c9a54c0c2427602f1463eb69.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Users\Admin\AppData\Local\Temp\36f662b3c9a54c0c2427602f1463eb69.exe"C:\Users\Admin\AppData\Local\Temp\36f662b3c9a54c0c2427602f1463eb69.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1176
-