Analysis
-
max time kernel
150s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
07-09-2022 07:41
General
-
Target
dd7a2c32149ecb5cf5fc3f33e3afe9c2.exe
-
Size
207KB
-
MD5
dd7a2c32149ecb5cf5fc3f33e3afe9c2
-
SHA1
6ea869fc1e1fd589af1afb2da42ab5a57d1b2f40
-
SHA256
802a13363d4e03beb34b9ef21c2419db8c97a6c88ed8dc0bd18d0413973f2a11
-
SHA512
20742cd3407e007bd82e576842f992f7741ad6ee0551fe5edccdf41a6f754ee5e83c5d526ccbaecdc00d1e941b41119e4f7c0ed8290d266c222452a46142c3aa
-
SSDEEP
3072:x9aKmVbtAR+eLDllmZes9CcYQlwtaDE8CHOP7TGuCTBc9biRv4K+:abtKVoZehc88Cs/GuMBiO
Score
10/10
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd7a2c32149ecb5cf5fc3f33e3afe9c2.exe"C:\Users\Admin\AppData\Local\Temp\dd7a2c32149ecb5cf5fc3f33e3afe9c2.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
36KB
-
Filesize
64KB
-
Filesize
39.5MB
-
Filesize
39.5MB