Resubmissions
24-01-2025 23:30
250124-3hgcsatray 1009-04-2024 08:35
240409-kg6xyaag48 1009-04-2024 08:35
240409-kg2m8aea6s 1009-04-2024 08:35
240409-kg12paag46 1009-04-2024 08:35
240409-kg1qxsag45 1023-02-2024 00:53
240223-a8rxzsha6z 1022-02-2024 06:18
240222-g2y62sdc6x 10Analysis
-
max time kernel
1200s -
max time network
1170s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
-
submitted
09-04-2024 08:35
General
-
Target
d874c5f6b10e26cfd96af59be1a40b173d0614770703a36fb84dd855900fd78c.exe
-
Size
141KB
-
MD5
3151d44dd03886e5f64f34481b116c81
-
SHA1
ebef87d5fd54925493385fbff5ba4d175c046fbc
-
SHA256
d874c5f6b10e26cfd96af59be1a40b173d0614770703a36fb84dd855900fd78c
-
SHA512
6ebcb293583a6858a023bf71a347783b788064f9415421503155e2f87426ff52d7881f2a680331d4332e4062153901295f4b92771a1afd527624bb15230bbcc6
-
SSDEEP
3072:p13jvfNcgSRb5hPi9OTtA5HljuEa9ckZKD4Xxh:bTX2gSJL3t0HlyEa9cM
Malware Config
Extracted
smokeloader
2022
http://selebration17io.io/index.php
http://vacantion18ffeu.cc/index.php
http://valarioulinity1.net/index.php
http://buriatiarutuhuob.net/index.php
http://cassiosssionunu.me/index.php
http://sulugilioiu19.net/index.php
http://goodfooggooftool.net/index.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d874c5f6b10e26cfd96af59be1a40b173d0614770703a36fb84dd855900fd78c.exe"C:\Users\Admin\AppData\Local\Temp\d874c5f6b10e26cfd96af59be1a40b173d0614770703a36fb84dd855900fd78c.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\dwfsfsrC:\Users\Admin\AppData\Roaming\dwfsfsr1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\dwfsfsrC:\Users\Admin\AppData\Roaming\dwfsfsr1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
141KB
MD53151d44dd03886e5f64f34481b116c81
SHA1ebef87d5fd54925493385fbff5ba4d175c046fbc
SHA256d874c5f6b10e26cfd96af59be1a40b173d0614770703a36fb84dd855900fd78c
SHA5126ebcb293583a6858a023bf71a347783b788064f9415421503155e2f87426ff52d7881f2a680331d4332e4062153901295f4b92771a1afd527624bb15230bbcc6
-
Filesize
44KB
-
Filesize
4.1MB
-
Filesize
4.1MB
-
Filesize
1024KB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
4.1MB
-
Filesize
4.1MB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
4.1MB
-
Filesize
4.1MB