Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17-04-2024 07:34
Static task
static1
Behavioral task
behavioral1
Sample
6a97f7067f6aea2c8ba112605d3c067c67f6ded77dd57a648ee3c9c432a58705.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6a97f7067f6aea2c8ba112605d3c067c67f6ded77dd57a648ee3c9c432a58705.exe
Resource
win10v2004-20240412-en
General
-
Target
6a97f7067f6aea2c8ba112605d3c067c67f6ded77dd57a648ee3c9c432a58705.exe
-
Size
237KB
-
MD5
e308b7fa2baf837eecf395b769548ae7
-
SHA1
2a9c7cbeafa17e1a94e61b71589ac89d5e78f89d
-
SHA256
6a97f7067f6aea2c8ba112605d3c067c67f6ded77dd57a648ee3c9c432a58705
-
SHA512
c417e014563048c43f31f6c0d419809972a7ebd33c647d90132ed778b8472ca8c9f983e2f9b0d1aeeccca27e34ec939f8208b4a8d40720d914307ddb2e1b4f8e
-
SSDEEP
3072:FIVndLEHQtlmk5fIBWk/9eJ1il+3k6OPmUT55nlIeONDZuUt5cUQ:FadLEHQH9KVleDilwk6OPPdON1
Malware Config
Extracted
smokeloader
pub3
Extracted
smokeloader
2022
http://nidoe.org/tmp/index.php
http://sodez.ru/tmp/index.php
http://uama.com.ua/tmp/index.php
http://talesofpirates.net/tmp/index.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1404 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
6a97f7067f6aea2c8ba112605d3c067c67f6ded77dd57a648ee3c9c432a58705.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6a97f7067f6aea2c8ba112605d3c067c67f6ded77dd57a648ee3c9c432a58705.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6a97f7067f6aea2c8ba112605d3c067c67f6ded77dd57a648ee3c9c432a58705.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6a97f7067f6aea2c8ba112605d3c067c67f6ded77dd57a648ee3c9c432a58705.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
6a97f7067f6aea2c8ba112605d3c067c67f6ded77dd57a648ee3c9c432a58705.exepid process 936 6a97f7067f6aea2c8ba112605d3c067c67f6ded77dd57a648ee3c9c432a58705.exe 936 6a97f7067f6aea2c8ba112605d3c067c67f6ded77dd57a648ee3c9c432a58705.exe 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 1404 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
6a97f7067f6aea2c8ba112605d3c067c67f6ded77dd57a648ee3c9c432a58705.exepid process 936 6a97f7067f6aea2c8ba112605d3c067c67f6ded77dd57a648ee3c9c432a58705.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a97f7067f6aea2c8ba112605d3c067c67f6ded77dd57a648ee3c9c432a58705.exe"C:\Users\Admin\AppData\Local\Temp\6a97f7067f6aea2c8ba112605d3c067c67f6ded77dd57a648ee3c9c432a58705.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:936
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/936-1-0x0000000003080000-0x0000000003180000-memory.dmpFilesize
1024KB
-
memory/936-2-0x0000000000220000-0x000000000022B000-memory.dmpFilesize
44KB
-
memory/936-3-0x0000000000400000-0x0000000002C1E000-memory.dmpFilesize
40.1MB
-
memory/936-5-0x0000000000400000-0x0000000002C1E000-memory.dmpFilesize
40.1MB
-
memory/1404-4-0x00000000026E0000-0x00000000026F6000-memory.dmpFilesize
88KB