Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
17-04-2024 14:34
Static task
static1
Behavioral task
behavioral1
Sample
3e36b2179d0f16855160f2a119d5343622b797b75d45b277b3b0616501f18da0.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
3e36b2179d0f16855160f2a119d5343622b797b75d45b277b3b0616501f18da0.exe
Resource
win10v2004-20240412-en
General
-
Target
3e36b2179d0f16855160f2a119d5343622b797b75d45b277b3b0616501f18da0.exe
-
Size
290KB
-
MD5
982d0f785eb918d8410ca6723517d899
-
SHA1
5c50c6ea9ed6553382aed1e9ddb6688b54631e4f
-
SHA256
3e36b2179d0f16855160f2a119d5343622b797b75d45b277b3b0616501f18da0
-
SHA512
8d6e84eea4a0e33f6c02cf026afc28b9d4a0b964cdce951fda7b91bce74998860761001853cb169acbe70203afe3df7bfc7990d2e46ee02029bd5e8c32ee3cf6
-
SSDEEP
3072:U0CR85KgNgVH293SHLRdBtKsUStUWoSKneWPJIX2PEXalv2iuY5CcPzb6P0k4iNX:Bm85jNgVH29sRRNUTeWkXalvmSH1kqc
Malware Config
Extracted
smokeloader
pub1
Extracted
smokeloader
2022
http://sjyey.com/tmp/index.php
http://babonwo.ru/tmp/index.php
http://mth.com.ua/tmp/index.php
http://piratia.pw/tmp/index.php
http://go-piratia.ru/tmp/index.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1304 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
3e36b2179d0f16855160f2a119d5343622b797b75d45b277b3b0616501f18da0.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3e36b2179d0f16855160f2a119d5343622b797b75d45b277b3b0616501f18da0.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3e36b2179d0f16855160f2a119d5343622b797b75d45b277b3b0616501f18da0.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3e36b2179d0f16855160f2a119d5343622b797b75d45b277b3b0616501f18da0.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
3e36b2179d0f16855160f2a119d5343622b797b75d45b277b3b0616501f18da0.exepid process 2268 3e36b2179d0f16855160f2a119d5343622b797b75d45b277b3b0616501f18da0.exe 2268 3e36b2179d0f16855160f2a119d5343622b797b75d45b277b3b0616501f18da0.exe 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 1304 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
3e36b2179d0f16855160f2a119d5343622b797b75d45b277b3b0616501f18da0.exepid process 2268 3e36b2179d0f16855160f2a119d5343622b797b75d45b277b3b0616501f18da0.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 1304 1304 -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
pid process 1304 1304
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e36b2179d0f16855160f2a119d5343622b797b75d45b277b3b0616501f18da0.exe"C:\Users\Admin\AppData\Local\Temp\3e36b2179d0f16855160f2a119d5343622b797b75d45b277b3b0616501f18da0.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2268
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD58a300bc48ae6729b080742c5994b0e8d
SHA1a555aa8fa13f9127b44f1c676418d03eed84384e
SHA256138a2825fe19594ccdfefe3e4a1ea267e3c4884da381313c4137d2c5c4f3383c
SHA51207d2436a39ce79e9e648a5984b3d676bd890cc06e7d6b275f1c1c1fd1b506613190b049645b8d53260ed672de51f96802956d27d9fe99163f92ff8ec68b0e8ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
242B
MD5f73a0eb630e3749e37b985f31d07c670
SHA195f6a1e5215d7aa003e6620209e7c79311ed09d7
SHA2561863e7d602a51e212120ac903d35583de8c6f36663ee97c864694273450e52f5
SHA5127cf885ead1e73c7e93fb651dd5e32759567c7581e3c5a6487e5f3be0a6992289df8760c3965bc480ea43a35fe7f631a91dc29a5ebd8a4fa1bfe4d69de55ecd84
-
C:\Users\Admin\AppData\Local\Temp\Tar68E6.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
memory/1304-4-0x00000000024E0000-0x00000000024F6000-memory.dmpFilesize
88KB
-
memory/2268-2-0x0000000000220000-0x000000000022B000-memory.dmpFilesize
44KB
-
memory/2268-1-0x00000000008A0000-0x00000000009A0000-memory.dmpFilesize
1024KB
-
memory/2268-3-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/2268-5-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB