Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

c66ef4f4be...ee.exe

windows7-x64

10

c66ef4f4be...ee.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    154s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/04/2024, 13:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c66ef4f4bed4a422bf7bcbc54628ae0d34f8bcb8385f49abde1c230f9dbc30ee.exe

  • Size

    222KB

  • MD5

    1355fb43dfd7723b915bcffed805a456

  • SHA1

    1fb37db9f02259a73c7cd630c3f2fb2f6b6ad139

  • SHA256

    c66ef4f4bed4a422bf7bcbc54628ae0d34f8bcb8385f49abde1c230f9dbc30ee

  • SHA512

    9458086f922b91332c5fae4765b7f656fdd7475854f7706a6909c4b46f8ccfadb4cffca7b9d28536f10bf09020c53967bea0cd8b10a1b9b74e57bb032e0c09cc

  • SSDEEP

    3072:Umnchpc/KlKa9B/xccOlVNPZY2EkGBdpR8YNa:UqchpkKlp9B/xccszZDhGP

Score
10/10
smokeloaderbackdoortrojan

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://selebration17io.io/index.php

http://vacantion18ffeu.cc/index.php

http://valarioulinity1.net/index.php

http://buriatiarutuhuob.net/index.php

http://cassiosssionunu.me/index.php

http://sulugilioiu19.net/index.php

http://goodfooggooftool.net/index.php
rc4.i32
rc4.i32

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\c66ef4f4bed4a422bf7bcbc54628ae0d34f8bcb8385f49abde1c230f9dbc30ee.exe
    "C:\Users\Admin\AppData\Local\Temp\c66ef4f4bed4a422bf7bcbc54628ae0d34f8bcb8385f49abde1c230f9dbc30ee.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:3532
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4068 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:3580
    • C:\Users\Admin\AppData\Local\Temp\D26E.exe
      C:\Users\Admin\AppData\Local\Temp\D26E.exe
      1⤵
      • Executes dropped EXE
      PID:1020
    • C:\Users\Admin\AppData\Local\Temp\D52E.exe
      C:\Users\Admin\AppData\Local\Temp\D52E.exe
      1⤵
      • Executes dropped EXE
      PID:2984

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\D26E.exe
      Filesize

      5.0MB

      MD5

      4871b0cc9f2c5d9831805ce8dbf3e51c

      SHA1

      15aa462a7ceba6c033064a56fa9984aa7ec15e0a

      SHA256

      e8b3976718b6a4a2c2c8bbe91ef6830876275ccbf78a72e8d1816328e4e627eb

      SHA512

      73532e6febf109aa489858ffc989bb69fdeefe8ade30261ecc9e9635e390714e77a70ca0c8ab3bc836c5318e2ec22dba1a063144fce23cbfd0dbd0b8400d0e6b

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\D52E.exe
      Filesize

      513KB

      MD5

      982035bc968af21d8078f6f11d420317

      SHA1

      036d697eb600cc0c2481b112f4475de42ca389c6

      SHA256

      5164258993a4db297eafcd03cadafb054a9fa9bae024ea0e047917a664c5c1b0

      SHA512

      bd3bedd6d1c93cec19257e5bb0b994790f9d08b9f76092cd79a3a558afc884a08c6250ef1889d4eb7a6c1a6f555d00a1a48108a63072007dc9d802b91cc24055

      Download Submit

    • memory/1020-23-0x00000000026A0000-0x0000000002727000-memory.dmp

      Filesize

      540KB

      Download

    • memory/1020-31-0x00000000FFDB0000-0x00000000FFE3A000-memory.dmp

      Filesize

      552KB

      Download

    • memory/1020-30-0x00000000026A0000-0x0000000002727000-memory.dmp

      Filesize

      540KB

      Download

    • memory/1020-29-0x00000000FFDB0000-0x00000000FFE3A000-memory.dmp

      Filesize

      552KB

      Download

    • memory/1020-25-0x00000000FFDB0000-0x00000000FFE3A000-memory.dmp

      Filesize

      552KB

      Download

    • memory/1020-24-0x00000000026A0000-0x0000000002727000-memory.dmp

      Filesize

      540KB

      Download

    • memory/2984-18-0x0000000000010000-0x0000000000096000-memory.dmp

      Filesize

      536KB

      Download

    • memory/2984-21-0x0000000077100000-0x0000000077315000-memory.dmp

      Filesize

      2.1MB

      Download

    • memory/2984-22-0x0000000000010000-0x0000000000096000-memory.dmp

      Filesize

      536KB

      Download

    • memory/3240-4-0x0000000002AE0000-0x0000000002AF6000-memory.dmp

      Filesize

      88KB

      Download

    • memory/3532-1-0x0000000000660000-0x0000000000760000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/3532-8-0x0000000000620000-0x000000000062B000-memory.dmp

      Filesize

      44KB

      Download

    • memory/3532-5-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

      Download

    • memory/3532-3-0x0000000000400000-0x0000000000478000-memory.dmp

      Filesize

      480KB

      Download

    • memory/3532-2-0x0000000000620000-0x000000000062B000-memory.dmp

      Filesize

      44KB

      Download