Analysis

  • max time kernel
    141s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    22-04-2024 19:30

General

  • Target

    2024-04-22_51f9da5c7336f878afb83b4366d3b442_karagany_mafia.exe

  • Size

    268KB

  • MD5

    51f9da5c7336f878afb83b4366d3b442

  • SHA1

    bad82bb20b0c5826e48ea1ac0bc6dc6eaf762e95

  • SHA256

    0879b74ea2708f7b6f2fa7c6ba97026251f76c9fc6d175e0bfb437bf2433b979

  • SHA512

    6a3ae11bd60d5fd1247cd4e5a8cdf4a1e305e128dc96243e196914295da2ca44f811ed1757c2799b6df11066b83e0f6a3c3315ba6716f222df248e55bd73f2a5

  • SSDEEP

    3072:/9DRjsVE6yEmOCPT+wBNJjNvdMKEnv5yZN7nUZmfjWVoqnM4s:/9uVE4XCqYP3MN8IZmfjWWAM4s

Malware Config

Extracted

Family

smokeloader

Version

2018

C2

http://xrbwgb.com/gate.php

http://th5ijd5gds.xyz/gate.php

http://c82psxpjd8.top/gate.php

http://7ui3n2rezz.top/gate.php

rc4.i32
rc4.i32

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious behavior: MapViewOfSection 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-22_51f9da5c7336f878afb83b4366d3b442_karagany_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-22_51f9da5c7336f878afb83b4366d3b442_karagany_mafia.exe"
    1⤵
    • Maps connected drives based on registry
    • Suspicious behavior: MapViewOfSection
    PID:2684

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1256-4-0x0000000002130000-0x0000000002145000-memory.dmp

    Filesize

    84KB

  • memory/1256-5-0x0000000002150000-0x0000000002151000-memory.dmp

    Filesize

    4KB

  • memory/1256-9-0x0000000002130000-0x0000000002145000-memory.dmp

    Filesize

    84KB

  • memory/2684-1-0x0000000000400000-0x00000000012C8000-memory.dmp

    Filesize

    14.8MB

  • memory/2684-2-0x0000000001350000-0x0000000001450000-memory.dmp

    Filesize

    1024KB

  • memory/2684-3-0x0000000000400000-0x00000000012C8000-memory.dmp

    Filesize

    14.8MB

  • memory/2684-7-0x0000000001350000-0x0000000001450000-memory.dmp

    Filesize

    1024KB