Analysis
-
max time kernel
34s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
-
submitted
07-12-2023 16:47
General
-
Target
9ec4fa1c7dd344a3be39d7a33cf28d7f.bin.exe
-
Size
253KB
-
MD5
9ec4fa1c7dd344a3be39d7a33cf28d7f
-
SHA1
db2f29ce4ff4571a8103c6e9425d8f8d466dff93
-
SHA256
5c9e63169f3e5a1ff89a63c18a0f2e9b465f4d9ceaf8ae3212ac421f21aaf63c
-
SHA512
4b0c2ad627ae70c5b43c37347e9ac7a977aedd4f611b3237a5b4314bad6006bf35f8faff7eb6ed2828e73ca05afacc3238a22df4fcf18f4993bd47ded01ecc75
-
SSDEEP
1536:wu/iYQIsCNSfhYbo0X7kNWPtkMJW3nT/cWwocLHAR5ttOTd50hKxYzNCdWwBbCSX:l/SqoXNu23T/nwoGq5tFZapPCxL0
Malware Config
Extracted
smokeloader
pub1
Extracted
smokeloader
2022
http://humydrole.com/tmp/index.php
http://trunk-co.ru/tmp/index.php
http://weareelight.com/tmp/index.php
http://pirateking.online/tmp/index.php
http://piratia.pw/tmp/index.php
http://go-piratia.ru/tmp/index.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ec4fa1c7dd344a3be39d7a33cf28d7f.bin.exe"C:\Users\Admin\AppData\Local\Temp\9ec4fa1c7dd344a3be39d7a33cf28d7f.bin.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\taskeng.exetaskeng.exe {A6F34570-C44B-4930-8C2C-2CAFA8D44E27} S-1-5-21-3618187007-3650799920-3290345941-1000:BPDFUYWR\Admin:Interactive:[1]1⤵
-
C:\Users\Admin\AppData\Roaming\whjvftrC:\Users\Admin\AppData\Roaming\whjvftr2⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD5f7c5871f9914771e8fabcc2f4f68df72
SHA1679900c3d1a8ab4015adb61b9db68dc2c28adbdc
SHA2565346a1e5da349a6f195ac4f55665faa2938404eb3b8d0a80bfd7b727e731bfee
SHA512f39050781d7101bd4c7b00cf690e6bc2d9fee5a10c6dfbd6c7d4ce06de1b278bded244e9e262c0b45cdaac2db0bdb3a4befa4e5336e25d5404d1e94a3b659133
-
Filesize
253KB
MD59ec4fa1c7dd344a3be39d7a33cf28d7f
SHA1db2f29ce4ff4571a8103c6e9425d8f8d466dff93
SHA2565c9e63169f3e5a1ff89a63c18a0f2e9b465f4d9ceaf8ae3212ac421f21aaf63c
SHA5124b0c2ad627ae70c5b43c37347e9ac7a977aedd4f611b3237a5b4314bad6006bf35f8faff7eb6ed2828e73ca05afacc3238a22df4fcf18f4993bd47ded01ecc75
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
1024KB
-
Filesize
4.4MB
-
Filesize
4.4MB