Analysis
-
max time kernel
154s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
11-10-2023 06:11
General
-
Target
0fd5d12ecd023e00a35c3f22158709f4088e49c3b9fce7ac6ebbf7228f874978_JC.exe
-
Size
242KB
-
MD5
6ccda75559212c7844b6f438e1529fdb
-
SHA1
21725740126bcf0f58e7d2e5294a4ec297568da0
-
SHA256
0fd5d12ecd023e00a35c3f22158709f4088e49c3b9fce7ac6ebbf7228f874978
-
SHA512
5b84271a5703e6d453455bb7e290e0b2260eed250ab10e604d0a4ce2a447af4d101e6242a35bb5547320958055eaa5cfeb622844e091e7ffd048e3e2f76ec993
-
SSDEEP
3072:hnb4exKruCLlIKvKmVpve6WGX9uin5s3yDKdpPQ6T5cbac6TOac:B6uCLiK5nyGX5n5sf9Ubac6TO
Malware Config
Extracted
smokeloader
pub4
Extracted
smokeloader
2022
http://gudintas.at/tmp/
http://pik96.ru/tmp/
http://rosatiauto.com/tmp/
http://kingpirate.ru/tmp/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0fd5d12ecd023e00a35c3f22158709f4088e49c3b9fce7ac6ebbf7228f874978_JC.exe"C:\Users\Admin\AppData\Local\Temp\0fd5d12ecd023e00a35c3f22158709f4088e49c3b9fce7ac6ebbf7228f874978_JC.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\egewejcC:\Users\Admin\AppData\Roaming\egewejc1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
242KB
MD56ccda75559212c7844b6f438e1529fdb
SHA121725740126bcf0f58e7d2e5294a4ec297568da0
SHA2560fd5d12ecd023e00a35c3f22158709f4088e49c3b9fce7ac6ebbf7228f874978
SHA5125b84271a5703e6d453455bb7e290e0b2260eed250ab10e604d0a4ce2a447af4d101e6242a35bb5547320958055eaa5cfeb622844e091e7ffd048e3e2f76ec993
-
Filesize
242KB
MD56ccda75559212c7844b6f438e1529fdb
SHA121725740126bcf0f58e7d2e5294a4ec297568da0
SHA2560fd5d12ecd023e00a35c3f22158709f4088e49c3b9fce7ac6ebbf7228f874978
SHA5125b84271a5703e6d453455bb7e290e0b2260eed250ab10e604d0a4ce2a447af4d101e6242a35bb5547320958055eaa5cfeb622844e091e7ffd048e3e2f76ec993
-
Filesize
88KB
-
Filesize
84KB
-
Filesize
36KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
84KB
-
Filesize
36KB