Analysis
-
max time kernel
150s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
28-03-2023 01:33
Static task
static1
Behavioral task
behavioral1
Sample
761c71f8126a6f6cb6c40f60492d463a2614e63ed6434a67d6998dccdd5aad70.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
761c71f8126a6f6cb6c40f60492d463a2614e63ed6434a67d6998dccdd5aad70.exe
Resource
win10v2004-20230220-en
General
-
Target
761c71f8126a6f6cb6c40f60492d463a2614e63ed6434a67d6998dccdd5aad70.exe
-
Size
274KB
-
MD5
4cb907abf1db2b4b0fe03ed3c65097e3
-
SHA1
0224f76608e3d02a7c92c9552961c381a3e3638b
-
SHA256
761c71f8126a6f6cb6c40f60492d463a2614e63ed6434a67d6998dccdd5aad70
-
SHA512
f7aea677795a4529933d96997771b8a07ab546818bec66964a9d6b54a0c9eb6dfd74517acb98f9d98b96b0d84c8c5def4e25b4cbbc955a466c6e0219ec1881fd
-
SSDEEP
3072:Crtp5aAZ6ZYe93I20MR8sS1LQ6yIB4k0BmuAoftk4996w/npNN4TJY:fAca2t0MBYGk0BXh96w/pNN4T
Malware Config
Extracted
smokeloader
2022
http://potunulit.org/
http://hutnilior.net/
http://bulimu55t.net/
http://soryytlic4.net/
http://novanosa5org.org/
http://nuljjjnuli.org/
http://tolilolihul.net/
http://somatoka51hub.net/
http://hujukui3.net/
http://bukubuka1.net/
http://golilopaster.org/
http://newzelannd66.org/
http://otriluyttn.org/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
761c71f8126a6f6cb6c40f60492d463a2614e63ed6434a67d6998dccdd5aad70.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 761c71f8126a6f6cb6c40f60492d463a2614e63ed6434a67d6998dccdd5aad70.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 761c71f8126a6f6cb6c40f60492d463a2614e63ed6434a67d6998dccdd5aad70.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 761c71f8126a6f6cb6c40f60492d463a2614e63ed6434a67d6998dccdd5aad70.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
761c71f8126a6f6cb6c40f60492d463a2614e63ed6434a67d6998dccdd5aad70.exepid process 1308 761c71f8126a6f6cb6c40f60492d463a2614e63ed6434a67d6998dccdd5aad70.exe 1308 761c71f8126a6f6cb6c40f60492d463a2614e63ed6434a67d6998dccdd5aad70.exe 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1208 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
761c71f8126a6f6cb6c40f60492d463a2614e63ed6434a67d6998dccdd5aad70.exepid process 1308 761c71f8126a6f6cb6c40f60492d463a2614e63ed6434a67d6998dccdd5aad70.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\761c71f8126a6f6cb6c40f60492d463a2614e63ed6434a67d6998dccdd5aad70.exe"C:\Users\Admin\AppData\Local\Temp\761c71f8126a6f6cb6c40f60492d463a2614e63ed6434a67d6998dccdd5aad70.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1208-56-0x0000000002BB0000-0x0000000002BC6000-memory.dmpFilesize
88KB
-
memory/1208-60-0x000007FE88710000-0x000007FE8871A000-memory.dmpFilesize
40KB
-
memory/1308-55-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/1308-57-0x0000000000400000-0x0000000002B72000-memory.dmpFilesize
39.4MB