Analysis
-
max time kernel
150s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
19-03-2023 20:16
Static task
static1
Behavioral task
behavioral1
Sample
163aa44b6d872f21bb6b0067e451b303.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
163aa44b6d872f21bb6b0067e451b303.exe
Resource
win10v2004-20230220-en
General
-
Target
163aa44b6d872f21bb6b0067e451b303.exe
-
Size
292KB
-
MD5
163aa44b6d872f21bb6b0067e451b303
-
SHA1
c9b6f0bbf586df36632df19b6fdcf8a238329dd5
-
SHA256
f94af74455b29a7c4073a0c2974e9a1d22bf28aeb3dc7338d34e1ed5b771e25d
-
SHA512
684083a8fa48c0604b76d83bac34c8a548349032bb67697a4a7cf1c61357e536b9d2f863fc77e2f5ac4937e505b685d9dac662a0d71f799574552d589ee7dccc
-
SSDEEP
3072:8D1HOX9LWDdEuJKEBxHrU3Skp8gxzdbTdu5nbriJhxE:BX9LWDyuJKEBxLU3SE8g1dbxgvMh
Malware Config
Extracted
smokeloader
2022
http://potunulit.org/
http://hutnilior.net/
http://bulimu55t.net/
http://soryytlic4.net/
http://novanosa5org.org/
http://nuljjjnuli.org/
http://tolilolihul.net/
http://somatoka51hub.net/
http://hujukui3.net/
http://bukubuka1.net/
http://golilopaster.org/
http://newzelannd66.org/
http://otriluyttn.org/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
163aa44b6d872f21bb6b0067e451b303.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 163aa44b6d872f21bb6b0067e451b303.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 163aa44b6d872f21bb6b0067e451b303.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 163aa44b6d872f21bb6b0067e451b303.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
163aa44b6d872f21bb6b0067e451b303.exepid process 2044 163aa44b6d872f21bb6b0067e451b303.exe 2044 163aa44b6d872f21bb6b0067e451b303.exe 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 1212 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1212 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
163aa44b6d872f21bb6b0067e451b303.exepid process 2044 163aa44b6d872f21bb6b0067e451b303.exe