Analysis
- max time kernel
4294211s - max time network
123s - platform
windows7_x64 - resource
win7-20220311-en - submitted
12/04/2022, 12:45
Static task
static1
Behavioral task
behavioral1
Sample
39e50abfbe53394397416303df0c99d6.exe
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
39e50abfbe53394397416303df0c99d6.exe
Resource
win10v2004-20220331-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target 39e50abfbe53394397416303df0c99d6.exe
- Size 412KB
- Sample220412-py23jabdfm
- SHA256 733aa27b3ca43c299f47ff800e1e2b99bfe58a09f4807ca6227047a2abd3f552
- MD5 39e50abfbe53394397416303df0c99d6
- SHA1 ff7b47fe6f7a10b00ab539dece9d625364d8b5c5
- SHA512 c665294af3151fc108963046cc273d7266279976aaf317ff65fd5ad53d24669dc50e48a2b66c25f1b6562fd2cf73dd637e38d8b72f9658179f2cda8c32ac547d
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
https://oakland-studio.video/search.php
-
https://seattle-university.video/search.php
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Deletes itself 1 IoCs
pid Process 1284 Process not Found - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 39e50abfbe53394397416303df0c99d6.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 39e50abfbe53394397416303df0c99d6.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 39e50abfbe53394397416303df0c99d6.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1900 39e50abfbe53394397416303df0c99d6.exe 1900 39e50abfbe53394397416303df0c99d6.exe 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found 1284 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1284 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1900 39e50abfbe53394397416303df0c99d6.exe