Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
06-01-2025 22:26
General
-
Target
sant.exe
-
Size
12KB
-
MD5
5effca91c3f1e9c87d364460097f8048
-
SHA1
28387c043ab6857aaa51865346046cf5dc4c7b49
-
SHA256
3fd826fc0c032721466b94ab3ec7dcfe006cc284e16132af6b91dfbc064b0907
-
SHA512
b0dba30fde295d3f7858db9d1463239b30cd84921971032b2afb96f811a53ac12c1e6f72013d2eff397b0b89c371e7c023c951cd2102f94157cba9918cd2c3e0
-
SSDEEP
192:I0EFK6COuHNlcW/1bXMvP8trt2mS3+dlRXwaziCP4kAIschKp0jeaJYrIC+sD:I0m/50t9bGPMrXSyGCP4kA6LyrIle
Score
10/10
Malware Config
Extracted
Family
smokeloader
Version
2017
C2
http://92.53.105.14/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Smokeloader family
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\sant.exe"C:\Users\Admin\AppData\Local\Temp\sant.exe"1⤵
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
16KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
16KB