Analysis
- max time kernel
154s - max time network
120s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
24/01/2022, 07:01
Static task
static1
Behavioral task
behavioral1
Sample
05f70f02dc8c7054afd3ff2b7b730921.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
05f70f02dc8c7054afd3ff2b7b730921.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
- Target 05f70f02dc8c7054afd3ff2b7b730921.exe
- Size 251KB
- Sample220124-hs782aded4
- SHA256 fc0ca51fbc6a446ee39b3cdfc49a571c75ba7398ebb3b1a212882608061bb1e4
- MD5 05f70f02dc8c7054afd3ff2b7b730921
- SHA1 e5ba4df60e3327e683def0a05307b8777ffca3b5
- SHA512 5c7fa50a0347a2e4d16daced180f926b96e00fdba3a5a102f736cecc432598189c64b38e44ce34fa21f28743e102c7d59cb5a182f93f18169911a83e6cecc4a5
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://abpa.at/upload/
-
http://emaratghajari.com/upload/
-
http://d7qw.cn/upload/
-
http://alumik-group.ru/upload/
-
http://zamkikurgan.ru/upload/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Deletes itself 1 IoCs
pid Process 1376 Process not Found - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 05f70f02dc8c7054afd3ff2b7b730921.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 05f70f02dc8c7054afd3ff2b7b730921.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 05f70f02dc8c7054afd3ff2b7b730921.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1892 05f70f02dc8c7054afd3ff2b7b730921.exe 1892 05f70f02dc8c7054afd3ff2b7b730921.exe 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found 1376 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1376 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1892 05f70f02dc8c7054afd3ff2b7b730921.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1376 Process not Found 1376 Process not Found - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1376 Process not Found 1376 Process not Found