Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07-04-2024 19:45
Static task
static1
Behavioral task
behavioral1
Sample
0d004910cd7d50bd27d3217de549760a24090a2d51c9660790e3c444c801f1af.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0d004910cd7d50bd27d3217de549760a24090a2d51c9660790e3c444c801f1af.exe
Resource
win10v2004-20240226-en
General
-
Target
0d004910cd7d50bd27d3217de549760a24090a2d51c9660790e3c444c801f1af.exe
-
Size
235KB
-
MD5
6351131f454daa11a6b391f78e6178d8
-
SHA1
53f5aff7291729897d06351e2dc8ac008b416b24
-
SHA256
0d004910cd7d50bd27d3217de549760a24090a2d51c9660790e3c444c801f1af
-
SHA512
0b78054f4d044918d7e005c12758f662046765b23bbacb3b0ddf1985c5342812bcaa1d7d2226e1ab6a1e1aaf42d264f5450c181b34bc20f758e0e272049e48f3
-
SSDEEP
3072:9ITjce5c5NyCqfcy1Xigd+YZiXhD/NzHsVBw2Wpbb49DO612VK+BJ4O5OnSR49oe:JIwN/qf9RDk5dH8mbb4NOcKvGFojT
Malware Config
Extracted
smokeloader
pub3
Extracted
smokeloader
2022
http://nidoe.org/tmp/index.php
http://sodez.ru/tmp/index.php
http://uama.com.ua/tmp/index.php
http://talesofpirates.net/tmp/index.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1188 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
0d004910cd7d50bd27d3217de549760a24090a2d51c9660790e3c444c801f1af.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0d004910cd7d50bd27d3217de549760a24090a2d51c9660790e3c444c801f1af.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0d004910cd7d50bd27d3217de549760a24090a2d51c9660790e3c444c801f1af.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0d004910cd7d50bd27d3217de549760a24090a2d51c9660790e3c444c801f1af.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
0d004910cd7d50bd27d3217de549760a24090a2d51c9660790e3c444c801f1af.exepid process 2252 0d004910cd7d50bd27d3217de549760a24090a2d51c9660790e3c444c801f1af.exe 2252 0d004910cd7d50bd27d3217de549760a24090a2d51c9660790e3c444c801f1af.exe 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
0d004910cd7d50bd27d3217de549760a24090a2d51c9660790e3c444c801f1af.exepid process 2252 0d004910cd7d50bd27d3217de549760a24090a2d51c9660790e3c444c801f1af.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d004910cd7d50bd27d3217de549760a24090a2d51c9660790e3c444c801f1af.exe"C:\Users\Admin\AppData\Local\Temp\0d004910cd7d50bd27d3217de549760a24090a2d51c9660790e3c444c801f1af.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1188-4-0x00000000031D0000-0x00000000031E6000-memory.dmpFilesize
88KB
-
memory/2252-1-0x0000000000980000-0x0000000000A80000-memory.dmpFilesize
1024KB
-
memory/2252-2-0x0000000000220000-0x000000000022B000-memory.dmpFilesize
44KB
-
memory/2252-3-0x0000000000400000-0x0000000000857000-memory.dmpFilesize
4.3MB
-
memory/2252-5-0x0000000000400000-0x0000000000857000-memory.dmpFilesize
4.3MB