General
-
Target
a2a5b77b07d83496073fc3613aa7384f.exe
-
Size
270KB
-
Sample
230328-wf94raea2x
-
MD5
a2a5b77b07d83496073fc3613aa7384f
-
SHA1
6dbf458de23eff5b42f43c8c7ac685517ebb0286
-
SHA256
3fcf17a312da09e7d7cb7a69b3575e791de5494420eb99e7bd00f6a63cb40988
-
SHA512
4cb73542d6621ae23e29c084919d38cc5322693c6d553111a70f7685fc6e3fa6fcf12100bdf012f659a74a977cceef606b5a2851be4d5ff96622f5f63fa20d03
-
SSDEEP
3072:RrJQF/YTMuU2y2fAS8vPVC/a6w1H1yTBJazm4fHQcaBeylmhZ:feYHU2zfA31MTDazmoHc+
Static task
static1
Behavioral task
behavioral1
Sample
a2a5b77b07d83496073fc3613aa7384f.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
a2a5b77b07d83496073fc3613aa7384f.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
smokeloader
pub4
Extracted
smokeloader
2022
http://aapu.at/tmp/
http://poudineh.com/tmp/
http://firsttrusteedrx.ru/tmp/
http://kingpirate.ru/tmp/
Targets
-
-
Target
a2a5b77b07d83496073fc3613aa7384f.exe
-
Size
270KB
-
MD5
a2a5b77b07d83496073fc3613aa7384f
-
SHA1
6dbf458de23eff5b42f43c8c7ac685517ebb0286
-
SHA256
3fcf17a312da09e7d7cb7a69b3575e791de5494420eb99e7bd00f6a63cb40988
-
SHA512
4cb73542d6621ae23e29c084919d38cc5322693c6d553111a70f7685fc6e3fa6fcf12100bdf012f659a74a977cceef606b5a2851be4d5ff96622f5f63fa20d03
-
SSDEEP
3072:RrJQF/YTMuU2y2fAS8vPVC/a6w1H1yTBJazm4fHQcaBeylmhZ:feYHU2zfA31MTDazmoHc+
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Sets DLL path for service in the registry
-
Sets service image path in registry
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-