Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04-07-2024 18:56
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240508-en
General
-
Target
file.exe
-
Size
187KB
-
MD5
e337b912b6816939b56c2c03859cabb4
-
SHA1
fbb4ad3e5c3cac638d075b1add6db11c55c50794
-
SHA256
9d7926dac81c4f7200c84298c7839162a2996339262f58bd815d2a94c380a151
-
SHA512
c10a4c025d7c57bb9b05e1dfeb691cfb603ffc4576a9e7d3124ae4f07ed476581ab279b1c2f5df2e56c6b876125181881730bbf77871d103a96cc2d0de3b0b91
-
SSDEEP
3072:VQ/oCSIn5XYG4cGuZVCIZiXuy3LN3IQDEkkNmWKNMnOn9nD:VQlx5TrZ9ZiXV32gNMS9
Malware Config
Extracted
smokeloader
pub1
Extracted
smokeloader
2022
http://evilos.cc/tmp/index.php
http://gebeus.ru/tmp/index.php
http://office-techs.biz/tmp/index.php
http://cx5519.com/tmp/index.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1188 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
file.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
file.exepid process 1904 file.exe 1904 file.exe 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 1188 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
file.exepid process 1904 file.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 1188 1188 -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
pid process 1188 1188
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1188-5-0x0000000002EC0000-0x0000000002ED6000-memory.dmpFilesize
88KB
-
memory/1904-1-0x0000000002CF0000-0x0000000002DF0000-memory.dmpFilesize
1024KB
-
memory/1904-3-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1904-2-0x0000000000220000-0x000000000022B000-memory.dmpFilesize
44KB
-
memory/1904-4-0x0000000000400000-0x0000000002BE7000-memory.dmpFilesize
39.9MB
-
memory/1904-7-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1904-6-0x0000000000400000-0x0000000002BE7000-memory.dmpFilesize
39.9MB