Analysis
- max time kernel
150s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
29/05/2022, 14:24
Static task
static1
Behavioral task
behavioral1
Sample
fa86f89afab84bea33de01d50a56fc1f.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
fa86f89afab84bea33de01d50a56fc1f.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target fa86f89afab84bea33de01d50a56fc1f.exe
- Size 311KB
- Sample220529-rqphkshgdn
- SHA256 712b9c35cccb19d613a72ca131dfea33aea7b6e59b0dac798f5435993a33d991
- MD5 fa86f89afab84bea33de01d50a56fc1f
- SHA1 0632b38d3ca887e4b4f21ccf83edd2e0a34fc545
- SHA512 7b315ba19b5e715a7dba67735c05a69997924b2fa85fd51d5bba373b74baeeabcddf3f5253ecab1fc4ed6544caf717fe57494c06953afbcb7044a500721db456
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2348 set thread context of 3136 2348 fa86f89afab84bea33de01d50a56fc1f.exe 78 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fa86f89afab84bea33de01d50a56fc1f.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fa86f89afab84bea33de01d50a56fc1f.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fa86f89afab84bea33de01d50a56fc1f.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3136 fa86f89afab84bea33de01d50a56fc1f.exe 3136 fa86f89afab84bea33de01d50a56fc1f.exe 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found 648 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 648 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3136 fa86f89afab84bea33de01d50a56fc1f.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2348 wrote to memory of 3136 2348 fa86f89afab84bea33de01d50a56fc1f.exe 78 PID 2348 wrote to memory of 3136 2348 fa86f89afab84bea33de01d50a56fc1f.exe 78 PID 2348 wrote to memory of 3136 2348 fa86f89afab84bea33de01d50a56fc1f.exe 78 PID 2348 wrote to memory of 3136 2348 fa86f89afab84bea33de01d50a56fc1f.exe 78 PID 2348 wrote to memory of 3136 2348 fa86f89afab84bea33de01d50a56fc1f.exe 78 PID 2348 wrote to memory of 3136 2348 fa86f89afab84bea33de01d50a56fc1f.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa86f89afab84bea33de01d50a56fc1f.exe"C:\Users\Admin\AppData\Local\Temp\fa86f89afab84bea33de01d50a56fc1f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\fa86f89afab84bea33de01d50a56fc1f.exe"C:\Users\Admin\AppData\Local\Temp\fa86f89afab84bea33de01d50a56fc1f.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3136
-