Analysis
-
max time kernel
150s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
07-06-2023 01:34
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
General
-
Target
file.exe
-
Size
271KB
-
MD5
33c128ec877611207088b9ca2500e20c
-
SHA1
35af516f6a332fbd468b05342547535fd2d87578
-
SHA256
2a4ab7936bf50e890d3d4dee9e2b00cf81e60a022ed440245fe1734c4f8fd663
-
SHA512
c60a177cc011c1f89333eb387e50388343438e2b6db2da17bac0dffae6fc50bc8ab6e4488ac357bfb6eaa6edf70b4f7bbe48ff1efae7b7db94d48da08e134979
-
SSDEEP
3072:WRE3e//m9hDEz2H+fpxF9uqfjjv/OI2scwPcxwabpe2nXv:N3eG9hozRDnRiw0xd
Malware Config
Extracted
smokeloader
2022
http://potunulit.org/
http://hutnilior.net/
http://bulimu55t.net/
http://soryytlic4.net/
http://novanosa5org.org/
http://nuljjjnuli.org/
http://tolilolihul.net/
http://somatoka51hub.net/
http://hujukui3.net/
http://bukubuka1.net/
http://golilopaster.org/
http://newzelannd66.org/
http://otriluyttn.org/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
file.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
file.exepid process 1424 file.exe 1424 file.exe 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1272 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
file.exepid process 1424 file.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1272-56-0x0000000002720000-0x0000000002736000-memory.dmpFilesize
88KB
-
memory/1272-60-0x000007FEE57D0000-0x000007FEE57DA000-memory.dmpFilesize
40KB
-
memory/1272-61-0x000007FEE57D0000-0x000007FEE57DA000-memory.dmpFilesize
40KB
-
memory/1424-55-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/1424-57-0x0000000000400000-0x0000000002CEA000-memory.dmpFilesize
40.9MB