Analysis
-
max time kernel
151s -
max time network
133s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
-
submitted
25/08/2023, 15:55
General
-
Target
d640056b46af7987634622b7e97bfa30dbea9793699be28853f3149d4cd8bc72.exe
-
Size
271KB
-
MD5
be8fcf160f765426678b822bd0f4eabe
-
SHA1
f944d426fbdc22f3f2fd0105a9680085ab0f6823
-
SHA256
d640056b46af7987634622b7e97bfa30dbea9793699be28853f3149d4cd8bc72
-
SHA512
0f92f304f4af4f80be5015ed1d8e6a884936eec6ef100e1756af1113b5b3ef4162fc8bb3506d50e1cae8f1a13b265ec3eb7a6bd05a64dbc33793a38b6da8c137
-
SSDEEP
3072:iFXQ8Ig/TtqLe9W6rfZURjQsZZ6kCme7W6KlYMwZtqC+o15RTTAGRO:iB2CTMLeE6rfZ09eqBl2ZtqCzJTT9R
Score
10/10
Malware Config
Extracted
Family
smokeloader
Botnet
pub1
Extracted
Family
smokeloader
Version
2020
C2
http://host-file-host6.com/
http://host-host-file8.com/
rc4.i32
rc4.i32
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d640056b46af7987634622b7e97bfa30dbea9793699be28853f3149d4cd8bc72.exe"C:\Users\Admin\AppData\Local\Temp\d640056b46af7987634622b7e97bfa30dbea9793699be28853f3149d4cd8bc72.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d640056b46af7987634622b7e97bfa30dbea9793699be28853f3149d4cd8bc72.exe"C:\Users\Admin\AppData\Local\Temp\d640056b46af7987634622b7e97bfa30dbea9793699be28853f3149d4cd8bc72.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
-
Filesize
84KB
-
Filesize
36KB
-
Filesize
84KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
36KB