Analysis
-
max time kernel
150s -
max time network
29s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
23-03-2023 14:40
Static task
static1
Behavioral task
behavioral1
Sample
a754e3d045adbd88b59a7b80ea127636f710c4183001cce2b7614611b7c141e4.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
a754e3d045adbd88b59a7b80ea127636f710c4183001cce2b7614611b7c141e4.exe
Resource
win10v2004-20230220-en
General
-
Target
a754e3d045adbd88b59a7b80ea127636f710c4183001cce2b7614611b7c141e4.exe
-
Size
194KB
-
MD5
de2cc5ab0c1b901b1d57a0e10c0185be
-
SHA1
f7d3144acc8e7473b8fb0c93cdc69632ea2de3ac
-
SHA256
a754e3d045adbd88b59a7b80ea127636f710c4183001cce2b7614611b7c141e4
-
SHA512
492fea5d91d8121432779fb4e01c6a5371b9fbe6675ecc9a32e416c583107e60ea160eeaa010cc83e7ace640ed7e31172ab1f4a3217526412cc9810960510be7
-
SSDEEP
3072:lSbONVWNIbrL8vTk1Wi5XiKR0Cf6MzjN+C1HQJISv5f9juaQE4nL:lSbFcrL8o1fikjNzQJn51juaQE
Malware Config
Extracted
smokeloader
2023
Extracted
smokeloader
2022
http://c3g6gx853u6j.xyz/
http://04yh16065cdi.xyz/
http://33qd2w560vnx.xyz/
http://neriir0f76gr.com/
http://b4y08hrp3jdb.com/
http://swp6fbywla09.com/
http://7iqt53dr345u.com/
http://mj4aj8r55mho.com/
http://ne4ym7bjn1ts.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
a754e3d045adbd88b59a7b80ea127636f710c4183001cce2b7614611b7c141e4.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a754e3d045adbd88b59a7b80ea127636f710c4183001cce2b7614611b7c141e4.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a754e3d045adbd88b59a7b80ea127636f710c4183001cce2b7614611b7c141e4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a754e3d045adbd88b59a7b80ea127636f710c4183001cce2b7614611b7c141e4.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a754e3d045adbd88b59a7b80ea127636f710c4183001cce2b7614611b7c141e4.exepid process 824 a754e3d045adbd88b59a7b80ea127636f710c4183001cce2b7614611b7c141e4.exe 824 a754e3d045adbd88b59a7b80ea127636f710c4183001cce2b7614611b7c141e4.exe 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 1360 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1360 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
a754e3d045adbd88b59a7b80ea127636f710c4183001cce2b7614611b7c141e4.exepid process 824 a754e3d045adbd88b59a7b80ea127636f710c4183001cce2b7614611b7c141e4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a754e3d045adbd88b59a7b80ea127636f710c4183001cce2b7614611b7c141e4.exe"C:\Users\Admin\AppData\Local\Temp\a754e3d045adbd88b59a7b80ea127636f710c4183001cce2b7614611b7c141e4.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:824