Analysis
- max time kernel
150s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
01/06/2022, 22:22
Static task
static1
Behavioral task
behavioral1
Sample
1286f2546e331f703a1a15a66d2725f0.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1286f2546e331f703a1a15a66d2725f0.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target 1286f2546e331f703a1a15a66d2725f0.exe
- Size 282KB
- Sample220601-197ypscac2
- SHA256 a85ff96e995d7de699d455c7b5f9ca4fc832892080fa640a3d80332c361c624b
- MD5 1286f2546e331f703a1a15a66d2725f0
- SHA1 b53b5376e18bc03a85e8d714df1099090f3395c6
- SHA512 ebae78dc9a6b63bd2bb7d5cf119ec922c7b3bcb2043f8622f6ac4e8e2e9e58a8a4baa0deae2e6ca20d30c0ef13606e80966782b9087612552871d1eb7d9aa30f
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4260 set thread context of 304 4260 1286f2546e331f703a1a15a66d2725f0.exe 80 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1286f2546e331f703a1a15a66d2725f0.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1286f2546e331f703a1a15a66d2725f0.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1286f2546e331f703a1a15a66d2725f0.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 304 1286f2546e331f703a1a15a66d2725f0.exe 304 1286f2546e331f703a1a15a66d2725f0.exe 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2628 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 304 1286f2546e331f703a1a15a66d2725f0.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4260 wrote to memory of 304 4260 1286f2546e331f703a1a15a66d2725f0.exe 80 PID 4260 wrote to memory of 304 4260 1286f2546e331f703a1a15a66d2725f0.exe 80 PID 4260 wrote to memory of 304 4260 1286f2546e331f703a1a15a66d2725f0.exe 80 PID 4260 wrote to memory of 304 4260 1286f2546e331f703a1a15a66d2725f0.exe 80 PID 4260 wrote to memory of 304 4260 1286f2546e331f703a1a15a66d2725f0.exe 80 PID 4260 wrote to memory of 304 4260 1286f2546e331f703a1a15a66d2725f0.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\1286f2546e331f703a1a15a66d2725f0.exe"C:\Users\Admin\AppData\Local\Temp\1286f2546e331f703a1a15a66d2725f0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\1286f2546e331f703a1a15a66d2725f0.exe"C:\Users\Admin\AppData\Local\Temp\1286f2546e331f703a1a15a66d2725f0.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:304
-