Analysis
-
max time kernel
150s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-09-2022 06:11
Static task
static1
Behavioral task
behavioral1
Sample
73da121d98bdca9426ff5a71556d343d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
73da121d98bdca9426ff5a71556d343d.exe
Resource
win10v2004-20220812-en
General
-
Target
73da121d98bdca9426ff5a71556d343d.exe
-
Size
280KB
-
MD5
73da121d98bdca9426ff5a71556d343d
-
SHA1
a961be6cb8e7a12727e4ef2e67037fd9b530688d
-
SHA256
da59178b5bdf3c372a7ee466713990a0021e2ac5880b8d19b2ddb035ca0e2c9c
-
SHA512
aed31e0f79037a85e455bf679ca0cbda3262e949fab4b21b83ab58367ce63e16e7bef3365bc94a20efe2395077d30670181dda47da68ad4efceca89d0c578fa9
-
SSDEEP
6144:8BKNEDlt+TLUPyCMk9lgIiYW8VexrYYvL0+1ELigavwVfJ:8BCG+syCMkbiYW8exrYYI2
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1680-56-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
73da121d98bdca9426ff5a71556d343d.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 73da121d98bdca9426ff5a71556d343d.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 73da121d98bdca9426ff5a71556d343d.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 73da121d98bdca9426ff5a71556d343d.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
73da121d98bdca9426ff5a71556d343d.exepid process 1680 73da121d98bdca9426ff5a71556d343d.exe 1680 73da121d98bdca9426ff5a71556d343d.exe 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 1208 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
73da121d98bdca9426ff5a71556d343d.exepid process 1680 73da121d98bdca9426ff5a71556d343d.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1680-54-0x0000000075281000-0x0000000075283000-memory.dmpFilesize
8KB
-
memory/1680-56-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/1680-55-0x000000000057E000-0x000000000058E000-memory.dmpFilesize
64KB
-
memory/1680-57-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/1680-58-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB