Analysis
-
max time kernel
151s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
19-12-2023 10:59
General
-
Target
0ed0ed66bca7dea4b4db2d774d0bc20c.exe
-
Size
299KB
-
MD5
0ed0ed66bca7dea4b4db2d774d0bc20c
-
SHA1
990d7397df84500308f3469a148e7b1ad86d9309
-
SHA256
c3bf65401ec1efe7d49bcaf30073800089212b8d8dd5b8c56cdbcc661c713d88
-
SHA512
2c5b80e60e1d9a210dd94a420ff09e41250baa095704d7f18eec80bde5b79c962a1fe255b83b2f9d093816d37f46d78dfd9ad47bd343bea80c55a0258d49f9b6
-
SSDEEP
6144:PYfcSPf0NL+K5PzXlCG3xTqJL6SAJOOhxxdeTr/ekI:Pm8zzXA4mL6SSzxd6L
Score
10/10
Malware Config
Extracted
Family
smokeloader
Version
2020
C2
http://fiskahlilian16.top/
http://paishancho17.top/
http://ydiannetter18.top/
http://azarehanelle19.top/
http://quericeriant20.top/
rc4.i32
rc4.i32
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ed0ed66bca7dea4b4db2d774d0bc20c.exe"C:\Users\Admin\AppData\Local\Temp\0ed0ed66bca7dea4b4db2d774d0bc20c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0ed0ed66bca7dea4b4db2d774d0bc20c.exe"C:\Users\Admin\AppData\Local\Temp\0ed0ed66bca7dea4b4db2d774d0bc20c.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
84KB
-
Filesize
36KB
-
Filesize
1024KB