Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
04-12-2021 01:06
Static task
static1
Behavioral task
behavioral1
Sample
7807ae2f5d4c1c497ef541b09ef8c85f.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
7807ae2f5d4c1c497ef541b09ef8c85f.exe
Resource
win10-en-20211104
General
-
Target
7807ae2f5d4c1c497ef541b09ef8c85f.exe
-
Size
334KB
-
MD5
7807ae2f5d4c1c497ef541b09ef8c85f
-
SHA1
d3fc1cdec9c424511261335cc144bb80bd8e6229
-
SHA256
29d358633a06305d5facd9d1e290254a4a925f0b50f61473e4094fd8ca7a0a70
-
SHA512
83dce014813d70dc634385069a79e5cd3f8ec8276950220863ee64258218b900a758156f74bbc5b71e91ae55b4496d2595e4a43cae4b74df5d9a0291de3343cf
Malware Config
Extracted
smokeloader
2020
http://membro.at/upload/
http://jeevanpunetha.com/upload/
http://misipu.cn/upload/
http://zavodooo.ru/upload/
http://targiko.ru/upload/
http://vues3d.com/upload/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1220 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
7807ae2f5d4c1c497ef541b09ef8c85f.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 7807ae2f5d4c1c497ef541b09ef8c85f.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 7807ae2f5d4c1c497ef541b09ef8c85f.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 7807ae2f5d4c1c497ef541b09ef8c85f.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
7807ae2f5d4c1c497ef541b09ef8c85f.exepid process 792 7807ae2f5d4c1c497ef541b09ef8c85f.exe 792 7807ae2f5d4c1c497ef541b09ef8c85f.exe 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1220 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
7807ae2f5d4c1c497ef541b09ef8c85f.exepid process 792 7807ae2f5d4c1c497ef541b09ef8c85f.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 1220 1220 -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
pid process 1220 1220
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/792-55-0x00000000032DA000-0x00000000032EA000-memory.dmpFilesize
64KB
-
memory/792-56-0x0000000075A01000-0x0000000075A03000-memory.dmpFilesize
8KB
-
memory/792-58-0x0000000000400000-0x000000000322E000-memory.dmpFilesize
46.2MB
-
memory/792-57-0x0000000000020000-0x0000000000029000-memory.dmpFilesize
36KB
-
memory/1220-59-0x0000000002130000-0x0000000002146000-memory.dmpFilesize
88KB