Analysis
-
max time kernel
150s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
24-03-2023 01:50
Static task
static1
Behavioral task
behavioral1
Sample
1bc8d666e4db3a12f4b6c39367aecc4da6d0824965842f4d0dd714cc9d7e0e40.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1bc8d666e4db3a12f4b6c39367aecc4da6d0824965842f4d0dd714cc9d7e0e40.exe
Resource
win10v2004-20230220-en
General
-
Target
1bc8d666e4db3a12f4b6c39367aecc4da6d0824965842f4d0dd714cc9d7e0e40.exe
-
Size
261KB
-
MD5
96cf925b7679c76f3307dc926c196006
-
SHA1
a6b4558585492fcfa208b8e34bc99425944e825c
-
SHA256
1bc8d666e4db3a12f4b6c39367aecc4da6d0824965842f4d0dd714cc9d7e0e40
-
SHA512
c40ab4344a1f4121928e75ad134a0acfeb42d80c7e7fc81b0a271ef6551caaf0b2f38436e6b1db2ec23e87d0f1dacc544e7ba5401cb06704a9936f408843546b
-
SSDEEP
3072:URsoEfeLVeB6U8XifhRLknsNJHG9pXgh3ey7y2MGCYhuh5m5aDmUhENRDhGFpy1p:XfeLVfZijsM5GPwde8X4Ja99
Malware Config
Extracted
smokeloader
2022
http://potunulit.org/
http://hutnilior.net/
http://bulimu55t.net/
http://soryytlic4.net/
http://novanosa5org.org/
http://nuljjjnuli.org/
http://tolilolihul.net/
http://somatoka51hub.net/
http://hujukui3.net/
http://bukubuka1.net/
http://golilopaster.org/
http://newzelannd66.org/
http://otriluyttn.org/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
1bc8d666e4db3a12f4b6c39367aecc4da6d0824965842f4d0dd714cc9d7e0e40.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1bc8d666e4db3a12f4b6c39367aecc4da6d0824965842f4d0dd714cc9d7e0e40.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1bc8d666e4db3a12f4b6c39367aecc4da6d0824965842f4d0dd714cc9d7e0e40.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1bc8d666e4db3a12f4b6c39367aecc4da6d0824965842f4d0dd714cc9d7e0e40.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
1bc8d666e4db3a12f4b6c39367aecc4da6d0824965842f4d0dd714cc9d7e0e40.exepid process 2040 1bc8d666e4db3a12f4b6c39367aecc4da6d0824965842f4d0dd714cc9d7e0e40.exe 2040 1bc8d666e4db3a12f4b6c39367aecc4da6d0824965842f4d0dd714cc9d7e0e40.exe 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 1244 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1244 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
1bc8d666e4db3a12f4b6c39367aecc4da6d0824965842f4d0dd714cc9d7e0e40.exepid process 2040 1bc8d666e4db3a12f4b6c39367aecc4da6d0824965842f4d0dd714cc9d7e0e40.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1bc8d666e4db3a12f4b6c39367aecc4da6d0824965842f4d0dd714cc9d7e0e40.exe"C:\Users\Admin\AppData\Local\Temp\1bc8d666e4db3a12f4b6c39367aecc4da6d0824965842f4d0dd714cc9d7e0e40.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection