Analysis
-
max time kernel
150s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
22-09-2022 07:27
Static task
static1
Behavioral task
behavioral1
Sample
75886104d568a27718a638d30dc9dac6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
75886104d568a27718a638d30dc9dac6.exe
Resource
win10v2004-20220812-en
General
-
Target
75886104d568a27718a638d30dc9dac6.exe
-
Size
280KB
-
MD5
75886104d568a27718a638d30dc9dac6
-
SHA1
20fc49d43cf0495bf8d74d31f945e3a6bbef9fb4
-
SHA256
62812b2c1a73e5144eafb5d091d6534e60b5cc23f2e0d35918eff0570fd92465
-
SHA512
2abb0be3d11a0c6131f6a5751b294e4037a2c10b28c9907bdf21fe428c1e5d50bc0d43a1ecd48d7757bd0befbb1a49bf734c1c9a969a9fdded6b961dc837d0ff
-
SSDEEP
6144:1AoycR8qZwFVxWm6mgSK26taTRpb0XVigavwVff:1AoHxwFVxNujI
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1680-56-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
75886104d568a27718a638d30dc9dac6.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 75886104d568a27718a638d30dc9dac6.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 75886104d568a27718a638d30dc9dac6.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 75886104d568a27718a638d30dc9dac6.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
75886104d568a27718a638d30dc9dac6.exepid process 1680 75886104d568a27718a638d30dc9dac6.exe 1680 75886104d568a27718a638d30dc9dac6.exe 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
75886104d568a27718a638d30dc9dac6.exepid process 1680 75886104d568a27718a638d30dc9dac6.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1680-54-0x0000000075281000-0x0000000075283000-memory.dmpFilesize
8KB
-
memory/1680-56-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/1680-55-0x000000000051E000-0x000000000052E000-memory.dmpFilesize
64KB
-
memory/1680-57-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/1680-58-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB