Analysis
-
max time kernel
150s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
04-03-2023 07:51
Static task
static1
Behavioral task
behavioral1
Sample
81f40a8afc158898f127f509853b4c8a.exe
Resource
win7-20230220-en
General
-
Target
81f40a8afc158898f127f509853b4c8a.exe
-
Size
252KB
-
MD5
81f40a8afc158898f127f509853b4c8a
-
SHA1
1f41f28fdf07718d72791e84c373c6bb615fdff9
-
SHA256
c6df64c1c448ccfccd92366ee2bdbb28c413fda5ba9aaaad1648caf76d6950fb
-
SHA512
eae89917788e74d23aa3724930f7f46c034914bf5ff9e069df57586d2d6486ab074455f230d7bc6ec09cfcfaa972896acb2f3d96bd1cb6558c9468c7f0b6a8cb
-
SSDEEP
3072:2gGBWVLdtTuyp9AMlCGjAww/RN7nG/409epf6n3ummj3mh09Gu2v3TQBupbtq/Cx:JBLKA9ZRHw/f4FKSneD2h09o8B7/CAm
Malware Config
Extracted
smokeloader
2022
http://c3g6gx853u6j.xyz/
http://04yh16065cdi.xyz/
http://33qd2w560vnx.xyz/
http://neriir0f76gr.com/
http://b4y08hrp3jdb.com/
http://swp6fbywla09.com/
http://7iqt53dr345u.com/
http://mj4aj8r55mho.com/
http://ne4ym7bjn1ts.com/
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1732-55-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
81f40a8afc158898f127f509853b4c8a.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 81f40a8afc158898f127f509853b4c8a.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 81f40a8afc158898f127f509853b4c8a.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 81f40a8afc158898f127f509853b4c8a.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
81f40a8afc158898f127f509853b4c8a.exepid process 1732 81f40a8afc158898f127f509853b4c8a.exe 1732 81f40a8afc158898f127f509853b4c8a.exe 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 1200 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1200 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
81f40a8afc158898f127f509853b4c8a.exepid process 1732 81f40a8afc158898f127f509853b4c8a.exe