Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
23-08-2023 16:51
Behavioral task
behavioral1
Sample
79979f9c74f039b33a61b1588681e74d1b18bc09f622138faeb112b9dad0ea65_JC.exe
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral2
Sample
79979f9c74f039b33a61b1588681e74d1b18bc09f622138faeb112b9dad0ea65_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
General
-
Target
79979f9c74f039b33a61b1588681e74d1b18bc09f622138faeb112b9dad0ea65_JC.exe
-
Size
44KB
-
MD5
0521e4a3c3b66345306c573fd162020d
-
SHA1
418f8ae9c852073d2294d3fbf49b3e1e23608e55
-
SHA256
79979f9c74f039b33a61b1588681e74d1b18bc09f622138faeb112b9dad0ea65
-
SHA512
da9a8d2e0b667b023d2538d9f1c18d4fc2f51c2b816e1f1835fb14ab6139e0eeab86a9e45fb14952f5dbbf706245a58f50ebb2b5edd0548abbdd4507922cd809
-
SSDEEP
384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW
Malware Config
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
pid Process 1356 Process not Found -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2168 79979f9c74f039b33a61b1588681e74d1b18bc09f622138faeb112b9dad0ea65_JC.exe 2168 79979f9c74f039b33a61b1588681e74d1b18bc09f622138faeb112b9dad0ea65_JC.exe 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found 1356 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1356 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2168 79979f9c74f039b33a61b1588681e74d1b18bc09f622138faeb112b9dad0ea65_JC.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1356 Process not Found 1356 Process not Found -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1356 Process not Found 1356 Process not Found
Processes
-
C:\Users\Admin\AppData\Local\Temp\79979f9c74f039b33a61b1588681e74d1b18bc09f622138faeb112b9dad0ea65_JC.exe"C:\Users\Admin\AppData\Local\Temp\79979f9c74f039b33a61b1588681e74d1b18bc09f622138faeb112b9dad0ea65_JC.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2168