Analysis
-
max time kernel
144s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
05/01/2024, 11:48
General
-
Target
4382ba1ba4ef6706728111964b5d2514.exe
-
Size
331KB
-
MD5
4382ba1ba4ef6706728111964b5d2514
-
SHA1
c8a184b27b2465813b534130a77b59247748f14e
-
SHA256
a2d58f2c37790969f079091835fec1595e43c8c082d58f45e11277a2223342d7
-
SHA512
881bca53fa24c72a81d50bb9772aac5f7a41f2c307c30fe16af96ebd7dc8c2a216e9dee340e2fb481e8b89f0bf2f1ba813b2ccbc2d7df69ebc1666935ef9e006
-
SSDEEP
6144:QwoucIdUUO6+jcpPFSFYlUjCdCjk/5KDQYasrMYCKSmAIdgvkJEgygq9:SzId7sjOSwagBvtw7TNEAq
Malware Config
Extracted
smokeloader
pub3
Extracted
smokeloader
2020
http://conceitosseg.com/upload/
http://integrasidata.com/upload/
http://ozentekstil.com/upload/
http://finbelportal.com/upload/
http://telanganadigital.com/upload/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4382ba1ba4ef6706728111964b5d2514.exe"C:\Users\Admin\AppData\Local\Temp\4382ba1ba4ef6706728111964b5d2514.exe"1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD5c0672525f350e7c6dd398bf2d1759c4d
SHA1d3ae72d012ca7f6564d6a263f86b41625c2172ad
SHA256f85f820613e4e975247d02c94365def40de206055f81dbeace4d22ae2401f88f
SHA5123c876c8e3508711fa92d47e769f670bb7b88b31259a6138f29b43436702245aaa4951681cc0881ab138f29e6c94d1ee3f2b4b7a1dbf1699171c0f9ccc2ba5252
-
Filesize
84KB
-
Filesize
36KB
-
Filesize
440KB
-
Filesize
1024KB
-
Filesize
440KB