Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
112s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
17/09/2022, 20:03
Static task
static1
Behavioral task
behavioral1
Sample
1da1751a7d92b95aa405f39ff52b944729729d450efda568c6a340aee8373b0a.exe
Resource
win10-20220812-en
General
-
Target
1da1751a7d92b95aa405f39ff52b944729729d450efda568c6a340aee8373b0a.exe
-
Size
291KB
-
MD5
362101cc9247e703d2fd75f87a38273f
-
SHA1
d473e1b1f8c46e314321b1766cc2418065fbb6ec
-
SHA256
1da1751a7d92b95aa405f39ff52b944729729d450efda568c6a340aee8373b0a
-
SHA512
6b0973fa2c9feb3fe5655ee7df053f849f53a6da0d013104ff472b670156d376f4dd65e305567b3e415c50e0d3ba258a565e099d30396d581bd7c07536fc3180
-
SSDEEP
3072:WXLDHO0YD67LFw7TCsueg5I1rH2vlg8Bth2dOkOQ0K6wwtgKM/h3BsxkgaBChU/x:+ye7LK7TdRrGTQZOQ03ZnigabwVf+
Malware Config
Signatures
-
Detects Smokeloader packer 5 IoCs
resource yara_rule behavioral1/memory/376-148-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/376-149-0x0000000000402DD8-mapping.dmp family_smokeloader behavioral1/memory/2300-153-0x00000000001E0000-0x00000000001E9000-memory.dmp family_smokeloader behavioral1/memory/376-159-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/376-182-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
pid Process 2576 Process not Found -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2300 set thread context of 376 2300 1da1751a7d92b95aa405f39ff52b944729729d450efda568c6a340aee8373b0a.exe 66 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1da1751a7d92b95aa405f39ff52b944729729d450efda568c6a340aee8373b0a.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1da1751a7d92b95aa405f39ff52b944729729d450efda568c6a340aee8373b0a.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1da1751a7d92b95aa405f39ff52b944729729d450efda568c6a340aee8373b0a.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 376 1da1751a7d92b95aa405f39ff52b944729729d450efda568c6a340aee8373b0a.exe 376 1da1751a7d92b95aa405f39ff52b944729729d450efda568c6a340aee8373b0a.exe 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found 2576 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2576 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 376 1da1751a7d92b95aa405f39ff52b944729729d450efda568c6a340aee8373b0a.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2300 wrote to memory of 376 2300 1da1751a7d92b95aa405f39ff52b944729729d450efda568c6a340aee8373b0a.exe 66 PID 2300 wrote to memory of 376 2300 1da1751a7d92b95aa405f39ff52b944729729d450efda568c6a340aee8373b0a.exe 66 PID 2300 wrote to memory of 376 2300 1da1751a7d92b95aa405f39ff52b944729729d450efda568c6a340aee8373b0a.exe 66 PID 2300 wrote to memory of 376 2300 1da1751a7d92b95aa405f39ff52b944729729d450efda568c6a340aee8373b0a.exe 66 PID 2300 wrote to memory of 376 2300 1da1751a7d92b95aa405f39ff52b944729729d450efda568c6a340aee8373b0a.exe 66 PID 2300 wrote to memory of 376 2300 1da1751a7d92b95aa405f39ff52b944729729d450efda568c6a340aee8373b0a.exe 66
Processes
-
C:\Users\Admin\AppData\Local\Temp\1da1751a7d92b95aa405f39ff52b944729729d450efda568c6a340aee8373b0a.exe"C:\Users\Admin\AppData\Local\Temp\1da1751a7d92b95aa405f39ff52b944729729d450efda568c6a340aee8373b0a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\1da1751a7d92b95aa405f39ff52b944729729d450efda568c6a340aee8373b0a.exe"C:\Users\Admin\AppData\Local\Temp\1da1751a7d92b95aa405f39ff52b944729729d450efda568c6a340aee8373b0a.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:376
-