Analysis
-
max time kernel
150s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
28-03-2023 01:40
Static task
static1
Behavioral task
behavioral1
Sample
9e50c6be3c3bfba4776826dc13d61f3073cfa18c66f2a37f5decda472a224175.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
9e50c6be3c3bfba4776826dc13d61f3073cfa18c66f2a37f5decda472a224175.exe
Resource
win10v2004-20230220-en
General
-
Target
9e50c6be3c3bfba4776826dc13d61f3073cfa18c66f2a37f5decda472a224175.exe
-
Size
275KB
-
MD5
6908e5f4f40f67ecf2c8f0bb29bae77f
-
SHA1
9a971279d9c5f866505a4dcaa53ae4d057514f49
-
SHA256
9e50c6be3c3bfba4776826dc13d61f3073cfa18c66f2a37f5decda472a224175
-
SHA512
e1f7b789e5d7050f2155a06d614056823aff41f2a3059f530483c49e89c8f05fee590c9639d1d812346bc02e902e715d29414a84b253c3cc010a0b7dae5f3004
-
SSDEEP
3072:43oXRWdU0zuaKItqHDui72bZsSQR1ohgTTi2GKAoFadoBuT/hdkpNN4TJY:f4rK0qHBSA1PT7vw/hdCNN4T
Malware Config
Extracted
smokeloader
pub4
Extracted
smokeloader
2022
http://aapu.at/tmp/
http://poudineh.com/tmp/
http://firsttrusteedrx.ru/tmp/
http://kingpirate.ru/tmp/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
9e50c6be3c3bfba4776826dc13d61f3073cfa18c66f2a37f5decda472a224175.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9e50c6be3c3bfba4776826dc13d61f3073cfa18c66f2a37f5decda472a224175.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9e50c6be3c3bfba4776826dc13d61f3073cfa18c66f2a37f5decda472a224175.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9e50c6be3c3bfba4776826dc13d61f3073cfa18c66f2a37f5decda472a224175.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
9e50c6be3c3bfba4776826dc13d61f3073cfa18c66f2a37f5decda472a224175.exepid process 1432 9e50c6be3c3bfba4776826dc13d61f3073cfa18c66f2a37f5decda472a224175.exe 1432 9e50c6be3c3bfba4776826dc13d61f3073cfa18c66f2a37f5decda472a224175.exe 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1248 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
9e50c6be3c3bfba4776826dc13d61f3073cfa18c66f2a37f5decda472a224175.exepid process 1432 9e50c6be3c3bfba4776826dc13d61f3073cfa18c66f2a37f5decda472a224175.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e50c6be3c3bfba4776826dc13d61f3073cfa18c66f2a37f5decda472a224175.exe"C:\Users\Admin\AppData\Local\Temp\9e50c6be3c3bfba4776826dc13d61f3073cfa18c66f2a37f5decda472a224175.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1248-56-0x00000000026B0000-0x00000000026C6000-memory.dmpFilesize
88KB
-
memory/1248-60-0x000007FEAE070000-0x000007FEAE07A000-memory.dmpFilesize
40KB
-
memory/1432-55-0x00000000002A0000-0x00000000002A9000-memory.dmpFilesize
36KB
-
memory/1432-57-0x0000000000400000-0x0000000002B72000-memory.dmpFilesize
39.4MB