Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
01/08/2023, 00:00
Behavioral task
behavioral1
Sample
0x0009000000016592-111.exe
Resource
win7-20230712-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
0x0009000000016592-111.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
0x0009000000016592-111.exe
-
Size
37KB
-
MD5
8692ca9311f4f80ffe280831434efdf6
-
SHA1
52ec2c8171239b64462cc175093e2efcee15d20a
-
SHA256
5619fc9f106cb00ca2a488f7219345fa042fcb925fd370a469263ce97d9ea301
-
SHA512
64ebd22890cab3542239e64ad37b68ad6d83f6d76bcef685ae6f2f1f331537b88c98953cc01bb0bdc22f781cd8b732f77ef904267dee1af7183d4ac4dfdf5d96
-
SSDEEP
384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW
Score
10/10
Malware Config
Extracted
Family
smokeloader
Version
2022
C2
http://77.91.68.29/fks/
rc4.i32
rc4.i32
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
pid Process 1196 Process not Found -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2108 0x0009000000016592-111.exe 2108 0x0009000000016592-111.exe 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1196 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2108 0x0009000000016592-111.exe