Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
08-03-2024 18:39
General
-
Target
898a57544bdfbaac62372f1b7bc63610750c0f377c66c372e34909e6c5f474c5.exe
-
Size
179KB
-
MD5
894baeb7be85c01940e2043eacd82c7a
-
SHA1
aff64515061e22951ac3a917dfd4c7a66443d9fb
-
SHA256
898a57544bdfbaac62372f1b7bc63610750c0f377c66c372e34909e6c5f474c5
-
SHA512
15e2093d7082f2a3a2e0175a87061ebea924b8a7b511836bbd8b4f9a2aa11b80b420016d0b9f388724f755e4751f70db5bd77138710f4e8d1764bc569be62c7b
-
SSDEEP
3072:y/yBN6fEr6ADs9r7xOsj139boI2WIkP4eXUkyKc0AFOAL6uQX:yuJ+ADIr7Asjl9b1f4eVyKUFOAL
Malware Config
Extracted
smokeloader
pub4
Extracted
smokeloader
2022
http://wirtshauspost.at/tmp/
http://msktk.ru/tmp/
http://soetegem.com/tmp/
http://gromograd.ru/tmp/
http://talesofpirates.net/tmp/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\898a57544bdfbaac62372f1b7bc63610750c0f377c66c372e34909e6c5f474c5.exe"C:\Users\Admin\AppData\Local\Temp\898a57544bdfbaac62372f1b7bc63610750c0f377c66c372e34909e6c5f474c5.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
3.7MB
-
Filesize
3.7MB