Analysis
- max time kernel
150s - max time network
30s - platform
windows7_x64 - resource
win7-20230220-en - resource tags
- submitted
21/05/2023, 11:16
General
- Target 234433512990.exe
- Size 321KB
- Sample230521-nc69pace6s
- SHA256 5c631beffefdbf081fb1fee93398a5752e4889bd00a4f767ca31b13b6ecfe4d5
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2022
C2
-
http://potunulit.org/
-
http://hutnilior.net/
-
http://bulimu55t.net/
-
http://soryytlic4.net/
-
http://novanosa5org.org/
-
http://nuljjjnuli.org/
-
http://tolilolihul.net/
-
http://somatoka51hub.net/
-
http://hujukui3.net/
-
http://bukubuka1.net/
-
http://golilopaster.org/
-
http://newzelannd66.org/
-
http://otriluyttn.org/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\234433512990.exe"C:\Users\Admin\AppData\Local\Temp\234433512990.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/284-55-0x00000000001B0000-0x00000000001B9000-memory.dmp
memory/284-57-0x0000000000400000-0x0000000000915000-memory.dmp
memory/1336-56-0x0000000002230000-0x0000000002246000-memory.dmp
memory/1336-60-0x000007FEBF6B0000-0x000007FEBF6BA000-memory.dmp