Overview

overview

10

Static

static

10

сентя...49.exe

windows7-x64

10

сентя...49.exe

windows10-2004-x64

10

сентя...df.exe

windows7-x64

10

сентя...df.exe

windows10-2004-x64

10

сентя...5d.exe

windows7-x64

8

сентя...5d.exe

windows10-2004-x64

8

сентя...ba.exe

windows7-x64

10

сентя...ba.exe

windows10-2004-x64

10

сентя...bd.exe

windows7-x64

7

сентя...bd.exe

windows10-2004-x64

7

сентя...14.exe

windows7-x64

3

сентя...14.exe

windows10-2004-x64

3

сентя...04.exe

windows7-x64

10

сентя...04.exe

windows10-2004-x64

10

сентя...73.exe

windows7-x64

10

сентя...73.exe

windows10-2004-x64

сентя...4b.exe

windows7-x64

1

сентя...4b.exe

windows10-2004-x64

10

сентя...ee.exe

windows7-x64

3

сентя...ee.exe

windows10-2004-x64

7

сентя...75.exe

windows7-x64

3

сентя...75.exe

windows10-2004-x64

7

сентя...53.exe

windows7-x64

10

сентя...53.exe

windows10-2004-x64

сентя...fa.exe

windows7-x64

10

сентя...fa.exe

windows10-2004-x64

10

сентя...e3.exe

windows7-x64

10

сентя...e3.exe

windows10-2004-x64

10

сентя...3a.exe

windows7-x64

3

сентя...3a.exe

windows10-2004-x64

3

сентя...25.exe

windows7-x64

10

сентя...25.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    242s
  • max time network
    348s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    31-12-2023 02:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    сентябрь 2023(570)/05d828574c74668fdd02f3a0e093e947cf7e1ee0970be402c775ebb236b812fa.exe

  • Size

    196KB

  • MD5

    49d8743b2ca1a7b66775d58fbf1945da

  • SHA1

    93291502aca15f8f12db3b4143d37e2824af2cbb

  • SHA256

    05d828574c74668fdd02f3a0e093e947cf7e1ee0970be402c775ebb236b812fa

  • SHA512

    693f4f69ebaf32c7d17bd51aab24acafc6113b198c9b5f5b8b0933d76fd828556f0ee1acdd3bd864ce146a73cdfed3ff6b5b86cfc6cc8ada3943dbd3d7a330bb

  • SSDEEP

    3072:iHhTzLMu8J2m6XSvoX6Ymdr+GZ/agfrZ84C5ER3QRK568bTTTR4P:WTzLM34UgXfWqGZvfrU5ERu2TTV4

Score
10/10
smokeloaderbackdoortrojan

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://potunulit.org/

http://hutnilior.net/

http://bulimu55t.net/

http://soryytlic4.net/

http://novanosa5org.org/

http://nuljjjnuli.org/

http://tolilolihul.net/

http://somatoka51hub.net/

http://hujukui3.net/

http://bukubuka1.net/

http://golilopaster.org/

http://newzelannd66.org/

http://otriluyttn.org/
rc4.i32
rc4.i32

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\сентябрь 2023(570)\05d828574c74668fdd02f3a0e093e947cf7e1ee0970be402c775ebb236b812fa.exe
    "C:\Users\Admin\AppData\Local\Temp\сентябрь 2023(570)\05d828574c74668fdd02f3a0e093e947cf7e1ee0970be402c775ebb236b812fa.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:3000
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {936857C8-0ED5-4B8D-8C31-AA82D3A4C01C} S-1-5-21-452311807-3713411997-1028535425-1000:OZEMQECW\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1416
    • C:\Users\Admin\AppData\Roaming\tfveauv
      C:\Users\Admin\AppData\Roaming\tfveauv
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:2128

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\tfveauv
    Filesize

    196KB

    MD5

    49d8743b2ca1a7b66775d58fbf1945da

    SHA1

    93291502aca15f8f12db3b4143d37e2824af2cbb

    SHA256

    05d828574c74668fdd02f3a0e093e947cf7e1ee0970be402c775ebb236b812fa

    SHA512

    693f4f69ebaf32c7d17bd51aab24acafc6113b198c9b5f5b8b0933d76fd828556f0ee1acdd3bd864ce146a73cdfed3ff6b5b86cfc6cc8ada3943dbd3d7a330bb

    Download Submit

  • memory/1260-3-0x0000000002A10000-0x0000000002A26000-memory.dmp

    Filesize

    88KB

    Download

  • memory/1260-15-0x0000000002B10000-0x0000000002B26000-memory.dmp

    Filesize

    88KB

    Download

  • memory/2128-14-0x0000000000400000-0x0000000000480000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2128-16-0x0000000000400000-0x0000000000480000-memory.dmp

    Filesize

    512KB

    Download

  • memory/3000-0-0x00000000003C0000-0x00000000003D5000-memory.dmp

    Filesize

    84KB

    Download

  • memory/3000-1-0x00000000003E0000-0x00000000003E9000-memory.dmp

    Filesize

    36KB

    Download

  • memory/3000-2-0x0000000000400000-0x0000000000480000-memory.dmp

    Filesize

    512KB

    Download

  • memory/3000-4-0x0000000000400000-0x0000000000480000-memory.dmp

    Filesize

    512KB

    Download

  • memory/3000-7-0x00000000003C0000-0x00000000003D5000-memory.dmp

    Filesize

    84KB

    Download

  • memory/3000-8-0x00000000003E0000-0x00000000003E9000-memory.dmp

    Filesize

    36KB

    Download