Analysis

  • max time kernel
    150s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    09/09/2022, 11:35

General

  • Target

    file.exe

  • Size

    205KB

  • MD5

    615565761d99b28eeefa2d631a9096ac

  • SHA1

    6373733534b4d76807f2d41f5d6820374707ab9a

  • SHA256

    6967ae85bfa1e72317ffed9593170e3b48e7644b79b3b4aae49d1bccb8284835

  • SHA512

    fbe1ac308c94d25fc439bd9f0389ac339c4e08993a1fb007795fbd9a654fc5fe1b35cc387b85a6a749c2068aefbdc5b110de19d625cb5e591d0ae0d477592ae2

  • SSDEEP

    3072:ZBcRqAoChhLtLnL5q01N06/Z/h04UL2/W+GtNJqEz1Urp4pwW:YR3LZEE0UZ/hpY/tNJ3RWipw

Malware Config

Signatures

  • Detects Smokeloader packer 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:1884

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1884-54-0x0000000075571000-0x0000000075573000-memory.dmp

          Filesize

          8KB

        • memory/1884-56-0x00000000001B0000-0x00000000001B9000-memory.dmp

          Filesize

          36KB

        • memory/1884-55-0x00000000002AE000-0x00000000002BE000-memory.dmp

          Filesize

          64KB

        • memory/1884-57-0x0000000000400000-0x0000000002B7E000-memory.dmp

          Filesize

          39.5MB

        • memory/1884-58-0x0000000000400000-0x0000000002B7E000-memory.dmp

          Filesize

          39.5MB