Analysis
-
max time kernel
151s -
max time network
148s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
18-11-2021 09:38
Static task
static1
Behavioral task
behavioral1
Sample
8696a4269e30ddb34a7e0e84629ede03.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
8696a4269e30ddb34a7e0e84629ede03.exe
Resource
win10-en-20211104
General
-
Target
8696a4269e30ddb34a7e0e84629ede03.exe
-
Size
278KB
-
MD5
8696a4269e30ddb34a7e0e84629ede03
-
SHA1
125198e1f636ef118e468145d02e801a3ffe2a97
-
SHA256
47ec411eab0aa15619f24caa6256ed4ca5cfc695a26f5b71830b53b07c22b05b
-
SHA512
481ae35ec056de3c08ae167e7b2fea9352c82a7cd47ebbc46047270e1a0f518b3feece8ad6900d0a5ac5ca1b44c80da0e916504809e93e176933931d940cad96
Malware Config
Extracted
smokeloader
2020
http://rsuehfidvdkfvk.top/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1300 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
8696a4269e30ddb34a7e0e84629ede03.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8696a4269e30ddb34a7e0e84629ede03.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8696a4269e30ddb34a7e0e84629ede03.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8696a4269e30ddb34a7e0e84629ede03.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
8696a4269e30ddb34a7e0e84629ede03.exepid process 1684 8696a4269e30ddb34a7e0e84629ede03.exe 1684 8696a4269e30ddb34a7e0e84629ede03.exe 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 1300 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1300 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
8696a4269e30ddb34a7e0e84629ede03.exepid process 1684 8696a4269e30ddb34a7e0e84629ede03.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 1300 1300 -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
pid process 1300 1300
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1300-59-0x0000000002200000-0x0000000002216000-memory.dmpFilesize
88KB
-
memory/1684-55-0x000000000030D000-0x000000000031E000-memory.dmpFilesize
68KB
-
memory/1684-56-0x00000000758C1000-0x00000000758C3000-memory.dmpFilesize
8KB
-
memory/1684-57-0x00000000001B0000-0x00000000001B9000-memory.dmpFilesize
36KB
-
memory/1684-58-0x0000000000400000-0x0000000001FCC000-memory.dmpFilesize
27.8MB