Analysis
- max time kernel
152s - max time network
119s - platform
windows7_x64 - resource
win7-en-20211104 - submitted
13/11/2021, 07:36
Static task
static1
Behavioral task
behavioral1
Sample
d985b4cfdceecc3c0fe4f3e4fda4e416.exe
Resource
win7-en-20211104
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
d985b4cfdceecc3c0fe4f3e4fda4e416.exe
Resource
win10-en-20211014
windows10_x64
0 signatures
0 seconds
General
- Target d985b4cfdceecc3c0fe4f3e4fda4e416.exe
- Size 168KB
- Sample211113-je9elsegb8
- SHA256 a8b37d6b073ee045ae63473cb1a592c974e896b19e3db06d552f955901c06db7
- MD5 d985b4cfdceecc3c0fe4f3e4fda4e416
- SHA1 f3c14a4d87569e54faaf0eac73ec1aafa2621dfa
- SHA512 560a056c076db6893f6407807d9a10d1078c148aa588d9de6ce1874eeac0a4feaf2102b656ba96316a32c89df97986f20cf77e55117e2c9bf97e52ef3381335c
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://srtuiyhuali.at/
-
http://fufuiloirtu.com/
-
http://amogohuigotuli.at/
-
http://novohudosovu.com/
-
http://brutuilionust.com/
-
http://bubushkalioua.com/
-
http://dumuilistrati.at/
-
http://verboliatsiaeeees.com/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Deletes itself 1 IoCs
pid Process 1380 Process not Found - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d985b4cfdceecc3c0fe4f3e4fda4e416.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d985b4cfdceecc3c0fe4f3e4fda4e416.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d985b4cfdceecc3c0fe4f3e4fda4e416.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 524 d985b4cfdceecc3c0fe4f3e4fda4e416.exe 524 d985b4cfdceecc3c0fe4f3e4fda4e416.exe 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found 1380 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1380 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 524 d985b4cfdceecc3c0fe4f3e4fda4e416.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1380 Process not Found 1380 Process not Found - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1380 Process not Found 1380 Process not Found