Analysis

  • max time kernel
    150s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    10/09/2022, 10:11

General

  • Target

    abd6cd3cfb180beacd03e0a97a2d7547.exe

  • Size

    275KB

  • MD5

    abd6cd3cfb180beacd03e0a97a2d7547

  • SHA1

    40957e0425ebc0f02dd10437ad020a341aa87aed

  • SHA256

    585a35f120f39562e9acba6c1dfbf18ff814cf4c59254499b75790665dc749e7

  • SHA512

    bf6f7cc14b789a8a6fa522fdefef48035730e6d97fea3760e162681a44b83686a97f7758b101732ef30c3d3944b534afbd59c3bdad7c5a8fa003b19b1ca5d23f

  • SSDEEP

    6144:pEE2kMZFfyDuL9vG08X/aNJ39IYQVsCX69YHZV/lghR:yE2/Ffy65O08X/aNJ39ITsCXF5PgP

Malware Config

Signatures

  • Detects Smokeloader packer 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\abd6cd3cfb180beacd03e0a97a2d7547.exe
    "C:\Users\Admin\AppData\Local\Temp\abd6cd3cfb180beacd03e0a97a2d7547.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:1096

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1096-55-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

          Filesize

          8KB

        • memory/1096-56-0x0000000000230000-0x0000000000330000-memory.dmp

          Filesize

          1024KB

        • memory/1096-57-0x00000000003A0000-0x00000000003A9000-memory.dmp

          Filesize

          36KB

        • memory/1096-58-0x0000000000400000-0x0000000000847000-memory.dmp

          Filesize

          4.3MB

        • memory/1096-59-0x0000000000400000-0x0000000000847000-memory.dmp

          Filesize

          4.3MB