Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
05-04-2024 01:45
General
-
Target
3aa10c423534ff2d40c7dea7eec430677de9f09a05e8176094325d52b63ffd6c.exe
-
Size
289KB
-
MD5
72ff63bdf42abfedc8f625b46d6f61c9
-
SHA1
803bb0b47e83a9b40bd127f4987e7c4d7161e81d
-
SHA256
3aa10c423534ff2d40c7dea7eec430677de9f09a05e8176094325d52b63ffd6c
-
SHA512
756c04247e83bad1ba7544ee07da4acb883294a92065a8d1cac087858f056d71400a1229e4e1709d3a71cbd65faa9702d1153ab5f47e29ca0d25471c04f7b9f1
-
SSDEEP
3072:m7tOMmPJYu491s1wTrPpiZADE9h+WGWld5c0xEVKZ6OKKs6vg33qN:m0dRYu4915pBMQWGACyEcNPg33q
Malware Config
Extracted
smokeloader
pub3
Extracted
smokeloader
2022
http://nidoe.org/tmp/index.php
http://sodez.ru/tmp/index.php
http://uama.com.ua/tmp/index.php
http://talesofpirates.net/tmp/index.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3aa10c423534ff2d40c7dea7eec430677de9f09a05e8176094325d52b63ffd6c.exe"C:\Users\Admin\AppData\Local\Temp\3aa10c423534ff2d40c7dea7eec430677de9f09a05e8176094325d52b63ffd6c.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
39.4MB
-
Filesize
39.4MB