Analysis
-
max time kernel
150s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
11/04/2023, 01:37
Static task
static1
Behavioral task
behavioral1
Sample
bcd15ceab5706e27b0b8e5ed1e93d1c829d1b6fdc5d3b63620b2529b36dda091.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
bcd15ceab5706e27b0b8e5ed1e93d1c829d1b6fdc5d3b63620b2529b36dda091.exe
Resource
win10v2004-20230220-en
General
-
Target
bcd15ceab5706e27b0b8e5ed1e93d1c829d1b6fdc5d3b63620b2529b36dda091.exe
-
Size
202KB
-
MD5
d32263b6c45b9b6d3caa2661b4781b23
-
SHA1
892adff4f54375c719f4fd3e6cea940e9591d12f
-
SHA256
bcd15ceab5706e27b0b8e5ed1e93d1c829d1b6fdc5d3b63620b2529b36dda091
-
SHA512
62469dda2f22a58b2807efc4104ba67dffff4949b267ec306c0631d867844ee6c570edca99e5c7dca1bc06351668b6f703f1bbf46b3d9799b5f1bf15d5c3c775
-
SSDEEP
1536:dHLR6OCaHvUlFFrsxZpOxWc/t6WjIP2NxlKZ/cKb+kJpdTdKuIirJStWgYtfC8lu:dF5ChVQvevCp3xjrJngWCqzC5OEbMW
Malware Config
Extracted
smokeloader
2022
http://potunulit.org/
http://hutnilior.net/
http://bulimu55t.net/
http://soryytlic4.net/
http://novanosa5org.org/
http://nuljjjnuli.org/
http://tolilolihul.net/
http://somatoka51hub.net/
http://hujukui3.net/
http://bukubuka1.net/
http://golilopaster.org/
http://newzelannd66.org/
http://otriluyttn.org/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bcd15ceab5706e27b0b8e5ed1e93d1c829d1b6fdc5d3b63620b2529b36dda091.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bcd15ceab5706e27b0b8e5ed1e93d1c829d1b6fdc5d3b63620b2529b36dda091.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bcd15ceab5706e27b0b8e5ed1e93d1c829d1b6fdc5d3b63620b2529b36dda091.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1712 bcd15ceab5706e27b0b8e5ed1e93d1c829d1b6fdc5d3b63620b2529b36dda091.exe 1712 bcd15ceab5706e27b0b8e5ed1e93d1c829d1b6fdc5d3b63620b2529b36dda091.exe 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1252 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1712 bcd15ceab5706e27b0b8e5ed1e93d1c829d1b6fdc5d3b63620b2529b36dda091.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bcd15ceab5706e27b0b8e5ed1e93d1c829d1b6fdc5d3b63620b2529b36dda091.exe"C:\Users\Admin\AppData\Local\Temp\bcd15ceab5706e27b0b8e5ed1e93d1c829d1b6fdc5d3b63620b2529b36dda091.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1712