Analysis
-
max time kernel
150s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
27-03-2023 18:16
Static task
static1
Behavioral task
behavioral1
Sample
e9cdefece19e843004c7f3db7eb8fe6408ee5ae9760e82906c762a12e124516d.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
e9cdefece19e843004c7f3db7eb8fe6408ee5ae9760e82906c762a12e124516d.exe
Resource
win10v2004-20230220-en
General
-
Target
e9cdefece19e843004c7f3db7eb8fe6408ee5ae9760e82906c762a12e124516d.exe
-
Size
267KB
-
MD5
49cd88e363a5f738cbbd54d592512330
-
SHA1
f37c06f3f2f9e57a47a1715ad868b08e8266c28a
-
SHA256
e9cdefece19e843004c7f3db7eb8fe6408ee5ae9760e82906c762a12e124516d
-
SHA512
be8af7be3bbe50311ae5de510195dc4b182f237806f0f91770bda9ee537eb3e21b834f6c10bb125c679ee8e3eaaeaffe10fedb43e4d51cdb1419c32edf1a39d3
-
SSDEEP
3072:9F48sKF1adV2dk5LySNCA/N/fJAsZSsUzD/qC+1VSPJBfZNWa+84Dj5qsyLCU3wZ:jzsrVOk5LlNF/1fJpUDqC+IJxHtTsym
Malware Config
Extracted
smokeloader
2022
http://potunulit.org/
http://hutnilior.net/
http://bulimu55t.net/
http://soryytlic4.net/
http://novanosa5org.org/
http://nuljjjnuli.org/
http://tolilolihul.net/
http://somatoka51hub.net/
http://hujukui3.net/
http://bukubuka1.net/
http://golilopaster.org/
http://newzelannd66.org/
http://otriluyttn.org/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
e9cdefece19e843004c7f3db7eb8fe6408ee5ae9760e82906c762a12e124516d.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e9cdefece19e843004c7f3db7eb8fe6408ee5ae9760e82906c762a12e124516d.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e9cdefece19e843004c7f3db7eb8fe6408ee5ae9760e82906c762a12e124516d.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e9cdefece19e843004c7f3db7eb8fe6408ee5ae9760e82906c762a12e124516d.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e9cdefece19e843004c7f3db7eb8fe6408ee5ae9760e82906c762a12e124516d.exepid process 2028 e9cdefece19e843004c7f3db7eb8fe6408ee5ae9760e82906c762a12e124516d.exe 2028 e9cdefece19e843004c7f3db7eb8fe6408ee5ae9760e82906c762a12e124516d.exe 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 1308 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1308 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
e9cdefece19e843004c7f3db7eb8fe6408ee5ae9760e82906c762a12e124516d.exepid process 2028 e9cdefece19e843004c7f3db7eb8fe6408ee5ae9760e82906c762a12e124516d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9cdefece19e843004c7f3db7eb8fe6408ee5ae9760e82906c762a12e124516d.exe"C:\Users\Admin\AppData\Local\Temp\e9cdefece19e843004c7f3db7eb8fe6408ee5ae9760e82906c762a12e124516d.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection