Analysis
-
max time kernel
142s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
22/04/2024, 11:08
General
-
Target
2024-04-22_e03faac527c01a278274eae8d710dc7b_karagany_mafia.exe
-
Size
268KB
-
MD5
e03faac527c01a278274eae8d710dc7b
-
SHA1
c0d5846543166ffde73514c9a6f8ff4797764a54
-
SHA256
076dedb7de1101b00cbeedfbbdaa8a17c96543df9ca190837d24b905bb3fbdcb
-
SHA512
f458c64f85e252080d9e3bdd29f3e2142565049d59830434ab9a401f084935014e5ef5c7e517988fa10477b7e8b6c4eb759ce849abdfa33f9068e8a4e8600471
-
SSDEEP
3072:/91QjsVE6yEmOCpT+wBNJjNvdMKEnv5yZN7nUZmfjWVoqnM4e:/9tVE4XCUYP3MN8IZmfjWWAM4e
Score
10/10
Malware Config
Extracted
Family
smokeloader
Version
2018
C2
http://xrbwgb.com/gate.php
http://th5ijd5gds.xyz/gate.php
http://c82psxpjd8.top/gate.php
http://7ui3n2rezz.top/gate.php
rc4.i32
rc4.i32
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Suspicious behavior: MapViewOfSection 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-22_e03faac527c01a278274eae8d710dc7b_karagany_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-22_e03faac527c01a278274eae8d710dc7b_karagany_mafia.exe"1⤵
- Maps connected drives based on registry
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
1024KB
-
Filesize
1024KB