Analysis
- max time kernel
150s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system - submitted
04/08/2023, 13:57
Behavioral task
behavioral1
Sample
1cbda8a11e39c27e414d6853bacfd4f9.exe
Resource
win7-20230712-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
1cbda8a11e39c27e414d6853bacfd4f9.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 1cbda8a11e39c27e414d6853bacfd4f9.exe
- Size 38KB
- Sample230804-q8849sbb56
- SHA256 62b64d39c67835bc47de4e7e899acc4cfb72d61570f7a6a3830cf0821dd2abd0
- MD5 1cbda8a11e39c27e414d6853bacfd4f9
- SHA1 f04b6713bf3e8a000bf19c78c772c84e55319414
- SHA512 74913ab78cf9c6ad2036468a30b42fe1cbe9bf1c40f62a55b9d3ae51f8b9c7e49df219128779962622c5183bf9b4bb1ccfbc7e288b344ca54ecbfe3c258f46c7
- SSDEEP 384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2022
C2
-
http://77.91.68.29/fks/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1308 1cbda8a11e39c27e414d6853bacfd4f9.exe 1308 1cbda8a11e39c27e414d6853bacfd4f9.exe 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found 3228 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3228 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1308 1cbda8a11e39c27e414d6853bacfd4f9.exe