Analysis
-
max time kernel
152s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
13/10/2023, 04:58
General
-
Target
JC_345f442091f1730da64ca3ad6660a433d79014f31c9b9af15400bd3e4fcde6a1.exe
-
Size
271KB
-
MD5
fb3eae7e4376c4888d3714409d9b0b51
-
SHA1
23cef127d094193e2f4a73712b92c7e6942880f8
-
SHA256
345f442091f1730da64ca3ad6660a433d79014f31c9b9af15400bd3e4fcde6a1
-
SHA512
e19849c6d2594c649a814d9fc45b195fb893583bc1181b8ae784369fb92bb4ae90dfa94789e83c489c9bac194eb6fc415641b677be784e600a50675bc0b0c295
-
SSDEEP
3072:COf2VejeJbk44KJylyeftI8FoecQoExiH2sCTZW0ZkfMVI1:alJH4DJtOecKiWsCTLEMV
Malware Config
Extracted
smokeloader
2022
http://potunulit.org/
http://hutnilior.net/
http://bulimu55t.net/
http://soryytlic4.net/
http://novanosa5org.org/
http://nuljjjnuli.org/
http://tolilolihul.net/
http://somatoka51hub.net/
http://hujukui3.net/
http://bukubuka1.net/
http://golilopaster.org/
http://newzelannd66.org/
http://otriluyttn.org/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JC_345f442091f1730da64ca3ad6660a433d79014f31c9b9af15400bd3e4fcde6a1.exe"C:\Users\Admin\AppData\Local\Temp\JC_345f442091f1730da64ca3ad6660a433d79014f31c9b9af15400bd3e4fcde6a1.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
-
Filesize
1024KB
-
Filesize
36KB
-
Filesize
30.9MB
-
Filesize
30.9MB
-
Filesize
36KB