General
-
Target
bae2d7a4aa83d9443f46561543c410b4
-
Size
144KB
-
Sample
231222-rjb9nsgbhm
-
MD5
bae2d7a4aa83d9443f46561543c410b4
-
SHA1
e16573ae071329b1f4203dcdc32e3fcddc9e8018
-
SHA256
ff3c37194588b0ab57806755deda730040c591668356edb8d461ef85e357196b
-
SHA512
0f9159c9209bbe82480806dcebfc3f4e09cdbb4fe70241555e71ca3eb311e990313fbe9368d2737f8cbde3578b6136b600919196cabc072d689d513eaae2cb0f
-
SSDEEP
3072:RZoPg8mxPhquqY+geqKV6i5blkFaEUiS:RiwhYge7VTOaiS
Static task
static1
Behavioral task
behavioral1
Sample
bae2d7a4aa83d9443f46561543c410b4.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
bae2d7a4aa83d9443f46561543c410b4.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
smokeloader
2020
http://varmisende.com/upload/
http://fernandomayol.com/upload/
http://nextlytm.com/upload/
http://people4jan.com/upload/
http://asfaltwerk.com/upload/
Targets
-
-
Target
bae2d7a4aa83d9443f46561543c410b4
-
Size
144KB
-
MD5
bae2d7a4aa83d9443f46561543c410b4
-
SHA1
e16573ae071329b1f4203dcdc32e3fcddc9e8018
-
SHA256
ff3c37194588b0ab57806755deda730040c591668356edb8d461ef85e357196b
-
SHA512
0f9159c9209bbe82480806dcebfc3f4e09cdbb4fe70241555e71ca3eb311e990313fbe9368d2737f8cbde3578b6136b600919196cabc072d689d513eaae2cb0f
-
SSDEEP
3072:RZoPg8mxPhquqY+geqKV6i5blkFaEUiS:RiwhYge7VTOaiS
-
Modifies firewall policy service
-
Sets file execution options in registry
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Deletes itself
-
Executes dropped EXE
-
Adds Run key to start application
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2