Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
05/01/2024, 16:32
General
-
Target
5bdbb3c46fdbc4c6e02a1a79c31bf98e.exe
-
Size
231KB
-
MD5
5bdbb3c46fdbc4c6e02a1a79c31bf98e
-
SHA1
4cd68f2aaf4f66b06c78c3451f5d666160d7dd3e
-
SHA256
4e5eed42429be79e4a35d0e137149356319debf7e20ec9a8ca744564ddd95f43
-
SHA512
afa1dfaad63267e4ba5c7bf877c98e0244a06a2a4183adbe97defd9ab5f186b5eec9cd17f535f9c71407ed477320bd07950e8d8326a1401c159daa094d5b7858
-
SSDEEP
3072:4VoDDLUyxjbSRW51yOfz6gK+HcG0YdncxTjBLtlkQinZWTMJIe:4Vo3LXdSRWyOfe8FB0jBpSv
Malware Config
Extracted
smokeloader
2022
http://sinuptinulium.net/index.php
http://thethuthe3.net/index.php
http://rakutenmakutern.net/index.php
http://sindusyndy.net/index.php
http://lovelyloversbouuyrs.net/index.php
http://stanystarysturu.net/index.php
http://tybytimemunutere.net/index.php
http://opengamerstypepsy.net/index.php
http://lumustruoues.net/index.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5bdbb3c46fdbc4c6e02a1a79c31bf98e.exe"C:\Users\Admin\AppData\Local\Temp\5bdbb3c46fdbc4c6e02a1a79c31bf98e.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
44KB