Resubmissions
09/04/2024, 07:26
240409-h9p4sahe34 1009/04/2024, 07:25
240409-h8859scg41 1009/04/2024, 07:25
240409-h8ydrshd88 1009/04/2024, 07:24
240409-h8gq1shd78 1004/02/2024, 03:55
240204-eha9rsbddj 10Analysis
-
max time kernel
1200s -
max time network
1165s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
-
submitted
09/04/2024, 07:25
General
-
Target
c14c3db7340277d58f53d5ff4f28a67fda54636fdb9b07fba60992c9ed03ae57.exe
-
Size
289KB
-
MD5
982b330786cb34fd69849d9d7cb296a9
-
SHA1
536c5f37004cd255cfbeff9330bf4d7f7795d87d
-
SHA256
c14c3db7340277d58f53d5ff4f28a67fda54636fdb9b07fba60992c9ed03ae57
-
SHA512
d9a943fb547d74acc2dc44fbf847729705426b2d81cf034daefdf680968a43defc2d1b9565a563e01cd7cdd7a9581527136018e573bb4516e861c3ede5562d70
-
SSDEEP
3072:AfSJIG3VDgzl3rLJEBTdD96DttL2WHCfaTqCXyhZfLhaWblDmj3nnX7GHBrR4ulT:AnggFrLu5d96Dtt6Ww841kr7EBD5Fp6
Malware Config
Extracted
smokeloader
2022
http://onualituyrs.org/
http://sumagulituyo.org/
http://snukerukeutit.org/
http://lightseinsteniki.org/
http://liuliuoumumy.org/
http://stualialuyastrelia.net/
http://kumbuyartyty.net/
http://criogetikfenbut.org/
http://tonimiuyaytre.org/
http://tyiuiunuewqy.org/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c14c3db7340277d58f53d5ff4f28a67fda54636fdb9b07fba60992c9ed03ae57.exe"C:\Users\Admin\AppData\Local\Temp\c14c3db7340277d58f53d5ff4f28a67fda54636fdb9b07fba60992c9ed03ae57.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\ugjfrteC:\Users\Admin\AppData\Roaming\ugjfrte1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\ugjfrteC:\Users\Admin\AppData\Roaming\ugjfrte1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
289KB
MD5982b330786cb34fd69849d9d7cb296a9
SHA1536c5f37004cd255cfbeff9330bf4d7f7795d87d
SHA256c14c3db7340277d58f53d5ff4f28a67fda54636fdb9b07fba60992c9ed03ae57
SHA512d9a943fb547d74acc2dc44fbf847729705426b2d81cf034daefdf680968a43defc2d1b9565a563e01cd7cdd7a9581527136018e573bb4516e861c3ede5562d70
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
1024KB
-
Filesize
3.8MB
-
Filesize
1024KB
-
Filesize
3.8MB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
3.8MB
-
Filesize
1024KB
-
Filesize
3.8MB
-
Filesize
44KB