Analysis
-
max time kernel
150s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
10-03-2023 08:54
Static task
static1
Behavioral task
behavioral1
Sample
6f88b9e1e4e6f5e2898e401f1826b99739654752ee83bf0495ff048dca422b76.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
6f88b9e1e4e6f5e2898e401f1826b99739654752ee83bf0495ff048dca422b76.exe
Resource
win10v2004-20230220-en
General
-
Target
6f88b9e1e4e6f5e2898e401f1826b99739654752ee83bf0495ff048dca422b76.exe
-
Size
244KB
-
MD5
78860803c7f6f7e9a9a21034adc13db1
-
SHA1
c6ed85e97a01f2111af9ce5a376203cb8ea4594b
-
SHA256
6f88b9e1e4e6f5e2898e401f1826b99739654752ee83bf0495ff048dca422b76
-
SHA512
e217b35d38740796a25700c90d1e657fc9d62bbe9b7149dd667b1fa453f0eb7e0ac5f3edb305a5167c666c632164bc1ae7a7329895f38051eeb4a48daded3270
-
SSDEEP
3072:atjySptLGcM23soO+xvmMwf7uRZDF0L3+OVnv+KxGyDnx4CR2a0:asYtLj3FO+af7qDF0L3+OVWKxGUuM2a
Malware Config
Extracted
smokeloader
2023
Extracted
smokeloader
2022
http://c3g6gx853u6j.xyz/
http://04yh16065cdi.xyz/
http://33qd2w560vnx.xyz/
http://neriir0f76gr.com/
http://b4y08hrp3jdb.com/
http://swp6fbywla09.com/
http://7iqt53dr345u.com/
http://mj4aj8r55mho.com/
http://ne4ym7bjn1ts.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
6f88b9e1e4e6f5e2898e401f1826b99739654752ee83bf0495ff048dca422b76.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6f88b9e1e4e6f5e2898e401f1826b99739654752ee83bf0495ff048dca422b76.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6f88b9e1e4e6f5e2898e401f1826b99739654752ee83bf0495ff048dca422b76.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6f88b9e1e4e6f5e2898e401f1826b99739654752ee83bf0495ff048dca422b76.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
6f88b9e1e4e6f5e2898e401f1826b99739654752ee83bf0495ff048dca422b76.exepid process 2024 6f88b9e1e4e6f5e2898e401f1826b99739654752ee83bf0495ff048dca422b76.exe 2024 6f88b9e1e4e6f5e2898e401f1826b99739654752ee83bf0495ff048dca422b76.exe 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1244 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
6f88b9e1e4e6f5e2898e401f1826b99739654752ee83bf0495ff048dca422b76.exepid process 2024 6f88b9e1e4e6f5e2898e401f1826b99739654752ee83bf0495ff048dca422b76.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f88b9e1e4e6f5e2898e401f1826b99739654752ee83bf0495ff048dca422b76.exe"C:\Users\Admin\AppData\Local\Temp\6f88b9e1e4e6f5e2898e401f1826b99739654752ee83bf0495ff048dca422b76.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection