Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
05/08/2023, 03:05
Behavioral task
behavioral1
Sample
0x000400000001931d-112.exe
Resource
win7-20230712-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
0x000400000001931d-112.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
0x000400000001931d-112.exe
-
Size
40KB
-
MD5
c1a2dff2cf2daea49e61c26aabadfbdd
-
SHA1
1950f541f64fc33968e3ce11029731413c073b6d
-
SHA256
261740babff0b1d45121abc326907e1393734d12613cc22eda2805efefefbd6d
-
SHA512
ee2948504ed84e7fa675d6dd3210607c99a62b00cb740f655f7a1dab60c151b184fbec40182c611f364c210d7da73628322385fe80c67ee7a619f43a4a90980d
-
SSDEEP
384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW
Score
10/10
Malware Config
Extracted
Family
smokeloader
Version
2022
C2
http://77.91.68.29/fks/
rc4.i32
rc4.i32
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1684 0x000400000001931d-112.exe 1684 0x000400000001931d-112.exe 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found 408 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 408 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1684 0x000400000001931d-112.exe