Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-06-2024 09:53
Static task
static1
Behavioral task
behavioral1
Sample
d4556c1ca8a5a8aa8184bc8db0b05293.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d4556c1ca8a5a8aa8184bc8db0b05293.exe
Resource
win10v2004-20240611-en
General
-
Target
d4556c1ca8a5a8aa8184bc8db0b05293.exe
-
Size
323KB
-
MD5
d4556c1ca8a5a8aa8184bc8db0b05293
-
SHA1
a40633ef6985adaf97960fcc2618c234b6174f0e
-
SHA256
1185bbb96c1dd9981f02615f71872b6c40f75d18ef3f7d284d21fdc3231ce50d
-
SHA512
cae24c6b5c1b6f83e83098e91786116335a46d60303536d2a56d846b6e847d8451e1f9df69bf2a7fe43376c384eee6b3619aee8f304dfc38a185360c97fa4d88
-
SSDEEP
3072:gXK6LgkFjfKyY9fGuD3URlDI1bi5Xut4LtADa1Ek1EqxTEqS:gXvLgkNfrifGIERVI2+8zNm
Malware Config
Extracted
smokeloader
pub1
Extracted
smokeloader
2022
http://movlat.com/tmp/
http://llcbc.org/tmp/
http://lindex24.ru/tmp/
http://qeqei.xyz/tmp/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1224 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
d4556c1ca8a5a8aa8184bc8db0b05293.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d4556c1ca8a5a8aa8184bc8db0b05293.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d4556c1ca8a5a8aa8184bc8db0b05293.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d4556c1ca8a5a8aa8184bc8db0b05293.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
d4556c1ca8a5a8aa8184bc8db0b05293.exepid process 1800 d4556c1ca8a5a8aa8184bc8db0b05293.exe 1800 d4556c1ca8a5a8aa8184bc8db0b05293.exe 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 1224 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
d4556c1ca8a5a8aa8184bc8db0b05293.exepid process 1800 d4556c1ca8a5a8aa8184bc8db0b05293.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1224-4-0x0000000002980000-0x0000000002996000-memory.dmpFilesize
88KB
-
memory/1800-1-0x0000000002810000-0x0000000002910000-memory.dmpFilesize
1024KB
-
memory/1800-2-0x0000000000220000-0x000000000022B000-memory.dmpFilesize
44KB
-
memory/1800-3-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1800-9-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1800-8-0x0000000000220000-0x000000000022B000-memory.dmpFilesize
44KB
-
memory/1800-5-0x0000000000400000-0x000000000273E000-memory.dmpFilesize
35.2MB