Overview

overview

10

Static

static

78c4d267a2...0b.exe

windows7-x64

10

78c4d267a2...0b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    78c4d267a2b4d59ad56c102f05e666bbc8a5eeefb9b3c577705b8d944c593a0b

  • Size

    176KB

  • Sample

    221206-cecx3sbb2z

  • MD5

    3136e1f54e171ad861a24a1c28ecdf1a

  • SHA1

    74c4be39acba5ecc145912fcb6f1473eaaf8b744

  • SHA256

    288ffc1cf4ec86e2f7c781b9344d6a3f514bf1d820df50fd348442fd19eba527

  • SHA512

    1ddcb03cdb2a0a1bc0560fb19e9aa62be12243cce3f9f3a0c353aaeea98c60555c2d8e1d39b58540b27ecee0f8c2343ec9c21802243e94beb7d72c3b30bcd8e5

  • SSDEEP

    3072:+sQiNHejJS/VcBEEhYs+yZplTJgrcz4pDNvIjzvcAWThmyKsguhBT9FTf0BcTKX7:ZvejtCkYDyZHwbVKjzvcAWTbJTl9J0kK

Score
10/10
smokeloaderbackdoorcollectiondiscoveryspywarestealertrojan

Malware Config

Targets

    • Target

      78c4d267a2b4d59ad56c102f05e666bbc8a5eeefb9b3c577705b8d944c593a0b

    • Size

      274KB

    • MD5

      5119b6abdd57f8d1af1d4a401de017d4

    • SHA1

      730320fe2202f15b2007032ab1ef24373f1c91ef

    • SHA256

      78c4d267a2b4d59ad56c102f05e666bbc8a5eeefb9b3c577705b8d944c593a0b

    • SHA512

      b7b9421940068262d3bf72c78efb80d23ad4310c3644518a22f4eb2394fed8ee0142d67fe929aa1300431bcc86c30d7e7297930d779dae6854f31a24700331c0

    • SSDEEP

      3072:HUXVUDYJk77MdLbAWR5yID5qrcz4pDNvIjzvcALdviVRvJTcpovU69UYgV2qs64j:HQ9dLb0acbVKjzvcALdvIDcP69IVS

    Score
    10/10
    smokeloaderbackdoortrojancollectiondiscoveryspywarestealer

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

2
T1114

Exfiltration

Command and Control

Impact

Tasks