Analysis
- max time kernel
152s - max time network
119s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
20/01/2022, 19:57
Static task
static1
Behavioral task
behavioral1
Sample
f7d20815bbea0abc9ff627f501620048.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
f7d20815bbea0abc9ff627f501620048.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target f7d20815bbea0abc9ff627f501620048.exe
- Size 229KB
- Sample220120-yn9jasbdd6
- SHA256 328a8b05fbe3718e41a3e3ec07593e68de43cfb1ca77fb8f29e1d3d79ea87f05
- MD5 f7d20815bbea0abc9ff627f501620048
- SHA1 5b6bc54abc45667f1baf12eb43230322af1df22c
- SHA512 4c5ed161c21a8b97ccf5c2746b683334edb2921e3e5f9a8f13f6decdce98efc28652a21dc636cd0e6d87694ad7bec604f1db87b06a83a3b679ab43e5d5528a6f
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://abpa.at/upload/
-
http://emaratghajari.com/upload/
-
http://d7qw.cn/upload/
-
http://alumik-group.ru/upload/
-
http://zamkikurgan.ru/upload/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Deletes itself 1 IoCs
pid Process 1208 Process not Found - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f7d20815bbea0abc9ff627f501620048.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f7d20815bbea0abc9ff627f501620048.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f7d20815bbea0abc9ff627f501620048.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1588 f7d20815bbea0abc9ff627f501620048.exe 1588 f7d20815bbea0abc9ff627f501620048.exe 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1208 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1588 f7d20815bbea0abc9ff627f501620048.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1208 Process not Found 1208 Process not Found - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1208 Process not Found 1208 Process not Found