MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 72701fd89271a881e14bfb170ee86d28f5c08fdb73f1be8c6904337c102bf7d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 15


Intelligence 15 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 72701fd89271a881e14bfb170ee86d28f5c08fdb73f1be8c6904337c102bf7d7
SHA3-384 hash: 003383cb8b5d612ae3f745136cebfdfe1a7f5f94fb456aa3edea17cff05a36a93942ff66997d702fb9fcb5ef97b1acb4
SHA1 hash: 11745387b652df3e64697fc430d207251fb70fdd
MD5 hash: 74cb59a86f4df8375836fd2bc3bbfd08
humanhash: avocado-uncle-speaker-echo
File name:#20240627_Edlen_A.xls
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:104'960 bytes
First seen:2024-05-27 16:33:36 UTC
Last seen:Never
File type:Excel file xls
MIME type:application/vnd.ms-excel
ssdeep 1536:wTjKXZuqDBMmz9ntWp8eeej47Wnj85IrJI7reF+/DfghBUZFkMgdQ94QgLJ0:CK4QBMK9ntqj40jEgJIfeEbfbZF6j
TLSH T1A2A312BB9106C5F0D2A95C3CC9D1B2A09610AE6412DB4C56BBCDFB4C98B42E766C335B
TrID 58.2% (.XLS) Microsoft Excel sheet (alternate) (56500/1/4)
33.5% (.XLS) Microsoft Excel sheet (32500/1/3)
8.2% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter lowmal3
Tags:Smoke Loader xls

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE dump

MalwareBazaar was able to identify 7 sections in this file using oledump:

Section IDSection sizeSection name
1114 bytesCompObj
2244 bytesDocumentSummaryInformation
3200 bytesSummaryInformation
499 bytesMBD00057C23/CompObj
515635 bytesMBD00057C23/Package
6338 bytesMBD00057C24/Ole
783519 bytesWorkbook

Intelligence

File Origin
# of uploads :
1
# of downloads :
478
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
72701fd89271a881e14bfb170ee86d28f5c08fdb73f1be8c6904337c102bf7d7.xls
Verdict:
Suspicious activity
Analysis date:
2024-05-27 16:37:32 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/d5b24052-81e4-4b25-b435-b24a9727548a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
TwinWave.EvilDoc.93TilInfinity.20240412.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6654b60602ef56c532bc539fwin7simulatehigh_evasion
Tags:
h e u r
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Using the Windows Management Instrumentation requests
Creating a window
DNS request
Sending an HTTP GET request
Searching for synchronization primitives
Launching a process
Сreating synchronization primitives
Creating a file
Connection attempt
Sending a custom TCP request
Connection attempt by exploiting the app vulnerability
Launching a process by exploiting the app vulnerability
Result
Verdict:
Malicious
File Type:
Legacy Office File
Link:
https://app.docguard.net/72701fd89271a881e14bfb170ee86d28f5c08fdb73f1be8c6904337c102bf7d7/results/dashboard
Payload URLs
URL
File name
http://z2.ink/nXPJ
Embedded Ole
Behaviour
SuspiciousRTF detected
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
language-tr macros
Link:
https://www.filescan.io/uploads/6654b5fc02418d09ec5985d2/reports/61586427-93cc-435e-87e1-6468e20a60a8/overview
Verdict:
Suspicious
Labled as:
CVE-2017-0199
Link:
https://www.hybrid-analysis.com/sample/72701fd89271a881e14bfb170ee86d28f5c08fdb73f1be8c6904337c102bf7d7
Gathering data
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/72701fd89271a881e14bfb170ee86d28f5c08fdb73f1be8c6904337c102bf7d7
Result
Threat name:
SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
spre.bank.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1448086
Signature
Antivirus detection for dropped file
Antivirus detection for URL or domain
Benign windows process drops PE files
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if browser processes are running
Checks if the current machine is a virtual machine (disk enumeration)
Connects to a pastebin service (likely for C&C)
Contains functionality to compare user and computer (likely to detect sandboxes)
Creates a thread in another existing process (thread injection)
Document exploit detected (process start blacklist hit)
Excel sheet contains many unusual embedded objects
Found evasive API chain (may stop execution after checking mutex)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Installs new ROOT certificates
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Microsoft Office drops suspicious files
Microsoft Office launches external ms-search protocol handler (WebDAV)
Multi AV Scanner detection for domain / URL
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Office viewer loads remote template
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: EQNEDT32.EXE connecting to internet
Sigma detected: Equation Editor Network Connection
Sigma detected: File Dropped By EQNEDT32EXE
Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Powershell download and load assembly
Sigma detected: Powershell download payload from hardcoded c2 list
Sigma detected: Script Initiated Connection to Non-Local Network
Sigma detected: Suspicious Microsoft Office Child Process
Sigma detected: WScript or CScript Dropper
Snort IDS alert for network traffic
Suspicious execution chain found
Suspicious powershell command line found
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Very long command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected Generic Downloader
Yara detected Powershell download and execute
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1448086 Sample: #20240627_Edlen_A.xls Startdate: 27/05/2024 Architecture: WINDOWS Score: 100 71 z2.ink 2->71 91 Snort IDS alert for network traffic 2->91 93 Multi AV Scanner detection for domain / URL 2->93 95 Found malware configuration 2->95 97 21 other signatures 2->97 12 EXCEL.EXE 57 31 2->12         started        16 taskeng.exe 1 2->16         started        signatures3 process4 dnsIp5 81 198.46.177.156, 49162, 49167, 49170 AS-COLOCROSSINGUS United States 12->81 83 z2.ink 54.241.153.192, 49161, 49163, 49164 AMAZON-02US United States 12->83 65 lionsarebeautifult...ionbeautiufl[1].doc, ISO-8859 12->65 dropped 18 wscript.exe 11 12->18         started        22 WINWORD.EXE 339 33 12->22         started        25 rugtucw 16->25         started        file6 process7 dnsIp8 73 paste.ee 18->73 75 paste.ee 188.114.96.3, 443, 49172 CLOUDFLARENETUS European Union 18->75 99 System process connects to network (likely due to code injection or exploit) 18->99 101 Suspicious powershell command line found 18->101 103 Wscript starts Powershell (via cmd or directly) 18->103 113 5 other signatures 18->113 27 powershell.exe 4 18->27         started        77 z2.ink 22->77 55 C:\Users\user\AppData\Roaming\...\z2.ink.url, MS 22->55 dropped 57 C:\Users\user\AppData\Roaming\...\nXPJ.url, MS 22->57 dropped 59 ~WRF{D9BCE685-2557...C-EEF401A63014}.tmp, Composite 22->59 dropped 61 C:\Users\user\AppData\Local\...\1B25204E.doc, ISO-8859 22->61 dropped 105 Microsoft Office launches external ms-search protocol handler (WebDAV) 22->105 107 Office viewer loads remote template 22->107 109 Microsoft Office drops suspicious files 22->109 30 EQNEDT32.EXE 12 22->30         started        file9 111 Connects to a pastebin service (likely for C&C) 73->111 signatures10 process11 file12 131 Suspicious powershell command line found 27->131 133 Suspicious execution chain found 27->133 33 powershell.exe 12 5 27->33         started        67 C:\Users\...\lionarekingofjungleimageshe.vbs, Unicode 30->67 dropped 135 Office equation editor establishes network connection 30->135 137 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 30->137 signatures13 process14 dnsIp15 69 uploaddeimagens.com.br 188.114.97.3, 443, 49173, 49174 CLOUDFLARENETUS European Union 33->69 87 Writes to foreign memory regions 33->87 89 Injects a PE file into a foreign processes 33->89 37 RegAsm.exe 33->37         started        signatures16 process17 signatures18 115 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 37->115 117 Maps a DLL or memory area into another process 37->117 119 Checks if the current machine is a virtual machine (disk enumeration) 37->119 121 Creates a thread in another existing process (thread injection) 37->121 40 explorer.exe 3 5 37->40 injected process19 dnsIp20 79 prolinice.ga 77.232.129.190, 49176, 49177, 80 BSTV-ASRU Russian Federation 40->79 63 C:\Users\user\AppData\Roaming\rugtucw, PE32 40->63 dropped 123 Benign windows process drops PE files 40->123 125 Injects code into the Windows Explorer (explorer.exe) 40->125 127 Writes to foreign memory regions 40->127 129 Hides that the sample has been downloaded from the Internet (zone.identifier) 40->129 45 explorer.exe 6 40->45         started        49 explorer.exe 40->49         started        51 explorer.exe 40->51         started        53 6 other processes 40->53 file21 signatures22 process23 dnsIp24 85 prolinice.ga 45->85 139 System process connects to network (likely due to code injection or exploit) 45->139 141 Found evasive API chain (may stop execution after checking mutex) 45->141 143 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 45->143 147 3 other signatures 45->147 145 Tries to harvest and steal browser information (history, passwords, etc) 49->145 signatures25
Detection:
cve-2017-11882-shellcode
Create hunting rule
Link:
https://mwdb.cert.pl/sample/72701fd89271a881e14bfb170ee86d28f5c08fdb73f1be8c6904337c102bf7d7/
Threat name:
Document-Excel.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2024-05-27 11:33:33 UTC
File Type:
Document
Extracted files:
17
AV detection:
6 of 38 (15.79%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ojyb7wesoguidykl7mlq52dnfd24bd63opy35ddjaqzxyebl67lq._file
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader backdoor collection execution trojan
Link:
https://tria.ge/reports/240527-t23wfsac7t/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Enumerates system info in registry
Launches Equation Editor
Modifies Internet Explorer settings
Modifies registry class
Modifies system certificate store
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Uses Volume Shadow Copy WMI provider
Uses Volume Shadow Copy service COM API
outlook_office_path
outlook_win_path
Office loads VBA resources, possible macro or embedded object present
Enumerates physical storage devices
Drops file in System32 directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Abuses OpenXML format to download file from external location
Blocklisted process makes network request
Command and Scripting Interpreter: PowerShell
SmokeLoader
Malware Config
C2 Extraction:
http://prolinice.ga/index.php
http://vilendar.ga/index.php
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/e16bd085-75a8-4c3a-af6a-fac63e79a91b
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/72701fd89271/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/72701fd89271a881e14bfb170ee86d28f5c08fdb73f1be8c6904337c102bf7d7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:maldoc_OLE_file_magic_number
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Smoke Loader

Excel file xls 72701fd89271a881e14bfb170ee86d28f5c08fdb73f1be8c6904337c102bf7d7

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments