General
-
Target
454db6cd57478f184108ce2d5a9a9f8032ff784be1b79fddfecc57e9bd6b3855
-
Size
316KB
-
Sample
220125-v5lxsacbe7
-
MD5
a3c870847b4131ad8320eba44d0b3013
-
SHA1
4be979a1d12e4d7deaff5165ce14e6d8449d0302
-
SHA256
454db6cd57478f184108ce2d5a9a9f8032ff784be1b79fddfecc57e9bd6b3855
-
SHA512
e7495fb42f109d402ef46eee2ed6edb1b2a4b8549a8883e5b884c3cc0c0d0b8a38888d4cc4d72583eaa79de78d4517ae8a56dee90403e5af94978f46f165d86f
Static task
static1
Behavioral task
behavioral1
Sample
454db6cd57478f184108ce2d5a9a9f8032ff784be1b79fddfecc57e9bd6b3855.exe
Resource
win10v2004-en-20220112
Malware Config
Extracted
smokeloader
2020
https://oakland-studio.video/search.php
https://seattle-university.video/search.php
Targets
-
-
Target
454db6cd57478f184108ce2d5a9a9f8032ff784be1b79fddfecc57e9bd6b3855
-
Size
316KB
-
MD5
a3c870847b4131ad8320eba44d0b3013
-
SHA1
4be979a1d12e4d7deaff5165ce14e6d8449d0302
-
SHA256
454db6cd57478f184108ce2d5a9a9f8032ff784be1b79fddfecc57e9bd6b3855
-
SHA512
e7495fb42f109d402ef46eee2ed6edb1b2a4b8549a8883e5b884c3cc0c0d0b8a38888d4cc4d72583eaa79de78d4517ae8a56dee90403e5af94978f46f165d86f
Score10/10-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Sets service image path in registry
-