Analysis
- max time kernel
150s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
17/06/2022, 09:26
Static task
static1
Behavioral task
behavioral1
Sample
408f50b15c2c14dec999d62e8e6cd8d8.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
408f50b15c2c14dec999d62e8e6cd8d8.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target 408f50b15c2c14dec999d62e8e6cd8d8.exe
- Size 245KB
- Sample220617-ld69zabdan
- SHA256 b77c99b2ff7ff3cdb760dd225abc944f04807f3679d765b7f0a2865a3c60af2e
- MD5 408f50b15c2c14dec999d62e8e6cd8d8
- SHA1 c64d2a50bf31122772d9d2c1ed35358785a30384
- SHA512 0eeac40a28227fca43e7dd1108a63f04097877826035c2c614ad81421ad99ff609e563f3dde173c489591c8065a36856724f60e9001a9335d06c583c91ce889e
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3020 set thread context of 4156 3020 408f50b15c2c14dec999d62e8e6cd8d8.exe 79 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 408f50b15c2c14dec999d62e8e6cd8d8.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 408f50b15c2c14dec999d62e8e6cd8d8.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 408f50b15c2c14dec999d62e8e6cd8d8.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4156 408f50b15c2c14dec999d62e8e6cd8d8.exe 4156 408f50b15c2c14dec999d62e8e6cd8d8.exe 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3120 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4156 408f50b15c2c14dec999d62e8e6cd8d8.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3020 wrote to memory of 4156 3020 408f50b15c2c14dec999d62e8e6cd8d8.exe 79 PID 3020 wrote to memory of 4156 3020 408f50b15c2c14dec999d62e8e6cd8d8.exe 79 PID 3020 wrote to memory of 4156 3020 408f50b15c2c14dec999d62e8e6cd8d8.exe 79 PID 3020 wrote to memory of 4156 3020 408f50b15c2c14dec999d62e8e6cd8d8.exe 79 PID 3020 wrote to memory of 4156 3020 408f50b15c2c14dec999d62e8e6cd8d8.exe 79 PID 3020 wrote to memory of 4156 3020 408f50b15c2c14dec999d62e8e6cd8d8.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\408f50b15c2c14dec999d62e8e6cd8d8.exe"C:\Users\Admin\AppData\Local\Temp\408f50b15c2c14dec999d62e8e6cd8d8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\408f50b15c2c14dec999d62e8e6cd8d8.exe"C:\Users\Admin\AppData\Local\Temp\408f50b15c2c14dec999d62e8e6cd8d8.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4156
-