Analysis
-
max time kernel
111s -
max time network
163s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
11-01-2024 02:28
General
-
Target
55cc830f41f9e74fbcfe2259d304c99b.exe
-
Size
312KB
-
MD5
55cc830f41f9e74fbcfe2259d304c99b
-
SHA1
f72fd071a6df30d6b0f145463ed4fe2f7d248e2b
-
SHA256
e6e106a5206be28f2b76c0190d3c1ba85d4f4bf759babd66c64d9a17a4219ddb
-
SHA512
293f62b48bda53c1d575636d30813cbb49865ee0d67302c001db3b1fec1de22a8fd2ae3945eca10903e15ee579e5ca22599fb8fb5a03594f593144c36c3aa131
-
SSDEEP
3072:rjEaOZ+J2LBo0V/NqF4wDa98Egq4IlmWUkbKUGn9zSw5n2iT9BARTYFkc:rSZ/LS0xNKr+9vdlm6bKUGnZnT3Fk
Malware Config
Extracted
smokeloader
2022
http://selebration17io.io/index.php
http://vacantion18ffeu.cc/index.php
http://valarioulinity1.net/index.php
http://buriatiarutuhuob.net/index.php
http://cassiosssionunu.me/index.php
http://sulugilioiu19.net/index.php
http://goodfooggooftool.net/index.php
http://legdfls2369.com/index.php
http://fpodsp0532xc.com/index.php
http://gucc352093520.com/index.php
Extracted
smokeloader
autm
Signatures
-
Detect ZGRat V1 3 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
ZGRat
ZGRat is remote access trojan written in C#.
-
.NET Reactor proctector 3 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of SetThreadContext 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of WriteProcessMemory 29 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\55cc830f41f9e74fbcfe2259d304c99b.exe"C:\Users\Admin\AppData\Local\Temp\55cc830f41f9e74fbcfe2259d304c99b.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\C0B0.exeC:\Users\Admin\AppData\Local\Temp\C0B0.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\E65A.exeC:\Users\Admin\AppData\Local\Temp\E65A.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\4694.dll1⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\4694.dll2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AA56.exeC:\Users\Admin\AppData\Local\Temp\AA56.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\AA56.exeC:\Users\Admin\AppData\Local\Temp\AA56.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\B9E1.exeC:\Users\Admin\AppData\Local\Temp\B9E1.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
242KB
MD530f6f4bde71c3e564fe02254ba1eea44
SHA1fe3b8ae2be6985376ba0bfbc44f23d2c82cfb061
SHA2563279936781c2bf91da87ba7100fb441e4e99b4f5b4d8cf3ab903f00c6b9bd24f
SHA5121cc898f8a33eb140838d1438c968ba76e31d567274cbe5c83e9eb1b5a28132bc1e096b70dbfd39731beca65eccc8ce7ce5254d53916c21f317e5913e3804f996
-
Filesize
53KB
MD5dbd071767afc70bd5eefc67d33b59310
SHA1b987d495e7cc731a8b9b01fe594989603592836e
SHA256e10645db62c702c90808fc4ac5f97aa80d3eff7c0542cb54882dbda1a92247a3
SHA5127b16b0b0b71db485dba52f12f495a129e1d7b507a6bdd3353d62ee696447b23b34618dcfb6ad86f1ca044c6123835be501f7cfd0a736304d5bf471334cda9c41
-
Filesize
75KB
MD5f5743172e162dbb2ecb42c0e4ab8c992
SHA1d0ea595efb5fb62001ee24a5b15fdbee754c907b
SHA25652fd1c623501bad1956dc4bcbb887d04514a48c8b239caca87646414b08bbd13
SHA51219036ba9c841a82ce40374f309f30c3b6e5a8c3df8aa8919289583227f6af45384fb02236ba7e96ae870d3cdc291776c7120f5b7c669b28c07ce9ab61fa98243
-
Filesize
25KB
MD552ddc0178168c85e4872e321968bef04
SHA1b9779dfcc5eb0e4af08f250d631c344ad53ffb94
SHA25692895a9041c13b5919c95e987b7ae6d3c3489e21e89b48379f9f82ac82b31dcc
SHA5129c475110256dcc23bdf5d032aa7e1b04dcd5e88d30d509c0934518b37896e46b3fdcd76c1891aa21851706025ee57238833bf268adf463dc7ac81ebce3097c17
-
Filesize
5KB
MD5ce8f34d12a94d1a8940021647f3e7156
SHA112640aa97e05ed47e6b985d468bc597c8e6a5501
SHA256d30da651adab8b86c2119d3419c614365c14ea2216132c5a36942e83d90e54cf
SHA512a4abda74bfbbd9fe162277472c6c52e2513a23e91243248997b68151fdd7fcea294f89179351f4f9b085559e9a9fa869c23d4a0a06a3fc88034a8e24089f6775
-
Filesize
99KB
MD56dd25fde9d8d7a9c1a4cd6c2ef04cbc6
SHA19af77ea6b9576f6bb8ab8b3f594a10e69bfc09e5
SHA256fef0d4bee4681aaed0cf739210c9b865dca996545452d626fa83fe74cf1ef1ec
SHA5125a91f8204b6754f6cf12982e48ac0c7a5072191363fdb3c4afdf52dd9d28048580db5c21207e305a52917a7117d32b2f7b90545fc6bc39d5dc6efeb56212de65
-
Filesize
61KB
MD5753047978a9169d2fff18174d9144213
SHA19741766d1b53e8f22fc171cb68776866c33c0591
SHA256f6ad8a797bc0748e8d4ed3f7033a48dbf6352be704367cd5bb4902a6e1f259b1
SHA5128964f0804690f230bacabc41cc6b6c1ad15d09902a25d1267bfbeb85233200fb4fe6fd07eaf009f231da247217f3461af90be06795717c73ce991c0bf5ff2423
-
Filesize
92KB
MD58106a216bda4cfe0e0cd74e2220b3601
SHA1a40292e5ebbac8e6ab219aed727d481d5e0fcbcf
SHA25605eb190c9ea1818d19e4c412d90c9a82b71be1a74f882e1389aae99b13a79f64
SHA5128d51212f69d2cf4e060910e9c152cccab74aa3dfe1daa9148f043958feb169504d8391aad45e9d91adcc133de2d23e4d3e400d05b588a0ee1c5d0826249afa13
-
Filesize
85KB
MD5405e137e2df2092a7f958b4e6b14481b
SHA1388de715d3512586ae4917aa712abbbe4ef80a70
SHA256b57f42eccb4c10210afd44ed8aa77c9b43962385002f2e434bf92e05653d08fe
SHA5129d2097d2210dbea9180aebdb144070e2981b716915b8c8d1e2e02ae0d161a2d9976ce06e26de437fdf425c2f76307f308c55c783b3194004c86643dfd0651c71
-
Filesize
161KB
MD58a0249ffc1b8a1118efb28a1fcdb8a0f
SHA141b7a63d5795a677ee31ba3eb0ce8b08c52c53da
SHA256a95984f5c37a6baecf23b337493fd21b7a29119a58d182bd874c87263d861f37
SHA5126a08213a2264b6243841a574abd3848238c23a6a6334fe91b26533d3174a3e71b68dbbf9cee3ce5fcd045ed15a5dfbfb8084fad60a93cd9c1f761d3944211f52
-
Filesize
14KB
MD5baac483a6006651f610ec326585339ed
SHA189bdb3b3fdcdc7b15573869ab8e54f22df340868
SHA256908bf150e99270a1ced71b558103f21003fd959d916a41239f1a2e9101308ed2
SHA512da2c666cb750d4132d38de2166091bf5ec217d48db54025020b0c0f6b413b8b2fcf730ff5c601e7194c3821514eb18a2dfda4cb276ce5f79819dc8a4d739814d
-
Filesize
143KB
MD5ec0aeb9a7f75c8fa0105a6ec7b391696
SHA139cb11be9a4b69651e9123397b2776bf5bc10cdd
SHA256fb9f4995b55392500568cb57f08c634547ecf6a2dc026231e8837bb2f131c223
SHA512e6ee48e68f32bb26bafa7280387a26456d662ce8995ce769147441dbd2e8714324bc8b13ae2aa128b8941ac0167037d9079e6d82a25bd3056b57554a72e0b9fe
-
Filesize
86KB
MD53791cb909f825e30b90a8d8926d36d18
SHA14f061fa297f6743394a7ad9c34cf8eb5170b4ceb
SHA25652e48db680bf94725faee691485bdf9ab7649b6cab8eafa50354e763f493055b
SHA512d76e728951d94ad29cf06f951b0f09fbf93252f929dbf6ce7b7624097c20d747451574ce3d972cf9bade8dbfcf2ccaf66499f28cead87254503bd7d227e23cd3
-
Filesize
1KB
MD5f18b89b657eb57c4d584b80dae322eca
SHA1d4a6290f22c6439b3beabe99e31b9acfe4df9a6e
SHA25621db171f73a43bfec7253e56348e0591196de5276e9203f21d8cbcb39758ab29
SHA5125ef018041965e67dd6719ca358ed45f0fbafdee2e4e5535c2353f270e03753c64ed6765f57f1c4ecfbeac13acbdd87ee1687f8772d84ebdc95611232ad60168b
-
Filesize
68KB
MD5ab5c681e72cc3b10ee0d32858e75375f
SHA15b2f2e40d4d252a39c3b34ba2ba7ce046ace6fb9
SHA2566ed8b397c4f9a8ae3a7bc06762fcfea303f07d4cd43c15555c5364509f0e671a
SHA512fb6963be8a9cf85fb94b9172407a83c02da23031b4c1e1ab10c21b303fccd34a4a53c794157cfad4636e71f2017956fdd9c88e57265ef41958c7203e385a44c6
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
1024KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
4KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
368KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
4.3MB
-
Filesize
4KB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.2MB
-
Filesize
4.3MB
-
Filesize
24KB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
2.2MB
-
Filesize
24KB
-
Filesize
1.2MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
1024KB
-
Filesize
1.6MB
-
Filesize
256KB
-
Filesize
2.1MB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
3.9MB
-
Filesize
64KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
44KB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
1024KB