Analysis
-
max time kernel
150s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
22-09-2022 09:01
Static task
static1
Behavioral task
behavioral1
Sample
7737c4db7c1bb8a1765ea4b6346da60a7bf4146b11307.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7737c4db7c1bb8a1765ea4b6346da60a7bf4146b11307.exe
Resource
win10v2004-20220812-en
General
-
Target
7737c4db7c1bb8a1765ea4b6346da60a7bf4146b11307.exe
-
Size
282KB
-
MD5
4442350e88cc21b47340c4f29907ee7e
-
SHA1
4d043bcec3c41d50633ac54c681ca0f19650abd8
-
SHA256
7737c4db7c1bb8a1765ea4b6346da60a7bf4146b11307053254a266e3602cc8f
-
SHA512
a6dd15179651a80ddf6ffc8b34974faf22483e400bdf555f1baaeb05753cfdb4d94f2152097b395f44f8a0f5d741b58f28c28682420870af060f0e2a8203a3c3
-
SSDEEP
6144:96DVCUAmDd1FT29eKUlWhyAsCzgX2DG3oq02AigavwVfU6:96D/A01FTkyeyAVsX2D2A2I
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1576-56-0x00000000001B0000-0x00000000001B9000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
7737c4db7c1bb8a1765ea4b6346da60a7bf4146b11307.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 7737c4db7c1bb8a1765ea4b6346da60a7bf4146b11307.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 7737c4db7c1bb8a1765ea4b6346da60a7bf4146b11307.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 7737c4db7c1bb8a1765ea4b6346da60a7bf4146b11307.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
7737c4db7c1bb8a1765ea4b6346da60a7bf4146b11307.exepid process 1576 7737c4db7c1bb8a1765ea4b6346da60a7bf4146b11307.exe 1576 7737c4db7c1bb8a1765ea4b6346da60a7bf4146b11307.exe 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 1276 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
7737c4db7c1bb8a1765ea4b6346da60a7bf4146b11307.exepid process 1576 7737c4db7c1bb8a1765ea4b6346da60a7bf4146b11307.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1576-54-0x0000000075B11000-0x0000000075B13000-memory.dmpFilesize
8KB
-
memory/1576-56-0x00000000001B0000-0x00000000001B9000-memory.dmpFilesize
36KB
-
memory/1576-55-0x000000000026E000-0x000000000027E000-memory.dmpFilesize
64KB
-
memory/1576-57-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/1576-58-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB