Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
26-05-2024 15:05
General
-
Target
febb01c58274dc2b7127823be1da06a8f9715bcef8c20ef480696d96e0ed7d7b.exe
-
Size
40KB
-
MD5
a1dec75a2b2f3c5abdf498a6c7c512c8
-
SHA1
fdb3b8eca89fc351bc9eee84b4489fc9a89452ef
-
SHA256
febb01c58274dc2b7127823be1da06a8f9715bcef8c20ef480696d96e0ed7d7b
-
SHA512
0c9c060083e3064124e49b3c13bcc39a44dac3939e7a4d33525f097c787938dd88aa8b179e8a90ea6fbebe5e243ac9c5412a6c6b9e379ba5ae20306be21afa2e
-
SSDEEP
768:yBQB1CTmqUQHXQkkU3NIZjKQu/MGQ2lsDBw7en:yBc0+yQmNIZreMp28O7Y
Score
10/10
Malware Config
Extracted
Family
smokeloader
Botnet
pub2
Extracted
Family
smokeloader
Version
2022
C2
http://dbfhns.in/tmp/index.php
http://guteyr.cc/tmp/index.php
http://greendag.ru/tmp/index.php
http://lobulraualov.in.net/tmp/index.php
rc4.i32
rc4.i32
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\febb01c58274dc2b7127823be1da06a8f9715bcef8c20ef480696d96e0ed7d7b.exe"C:\Users\Admin\AppData\Local\Temp\febb01c58274dc2b7127823be1da06a8f9715bcef8c20ef480696d96e0ed7d7b.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
-
Filesize
44KB
-
Filesize
44KB