Analysis
- max time kernel
152s - max time network
119s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
21/01/2022, 11:32
Static task
static1
Behavioral task
behavioral1
Sample
dd7c20843584693c36f9134acb464df4.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
dd7c20843584693c36f9134acb464df4.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
- Target dd7c20843584693c36f9134acb464df4.exe
- Size 328KB
- Sample220121-nna1maggc2
- SHA256 9ad3050367fc8aab3996eedb6bd086731288c5401b587cce63fda64f6732fa93
- MD5 dd7c20843584693c36f9134acb464df4
- SHA1 fa8a11198d9232e58c9853fd609e956be3e0be14
- SHA512 e0a6d981b3e75c7f095888fdce1205d421213411bcf7bdd3692ed04830228548c95334c524c5881d2bf9771c635f5d8ec7e5ab7b895c8c2a20be65cfae7321be
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://abpa.at/upload/
-
http://emaratghajari.com/upload/
-
http://d7qw.cn/upload/
-
http://alumik-group.ru/upload/
-
http://zamkikurgan.ru/upload/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Deletes itself 1 IoCs
pid Process 1408 Process not Found - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dd7c20843584693c36f9134acb464df4.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dd7c20843584693c36f9134acb464df4.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dd7c20843584693c36f9134acb464df4.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1536 dd7c20843584693c36f9134acb464df4.exe 1536 dd7c20843584693c36f9134acb464df4.exe 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found 1408 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1408 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1536 dd7c20843584693c36f9134acb464df4.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1408 Process not Found 1408 Process not Found - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1408 Process not Found 1408 Process not Found