Analysis
-
max time kernel
150s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-09-2022 16:51
Static task
static1
Behavioral task
behavioral1
Sample
ac200dfd46cb14b4c59f30198d261a64a5a90972ec043.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ac200dfd46cb14b4c59f30198d261a64a5a90972ec043.exe
Resource
win10v2004-20220901-en
General
-
Target
ac200dfd46cb14b4c59f30198d261a64a5a90972ec043.exe
-
Size
196KB
-
MD5
b82c8c268ecc9deb17353564981cd3f3
-
SHA1
c58afd85dec0194f04fc7bd5333374bb9e462aa8
-
SHA256
ac200dfd46cb14b4c59f30198d261a64a5a90972ec0439d0da7ec6c2fc209a69
-
SHA512
a448a7d8bc59ac182dd755e5ea0a32c3b872bab76b3a883c3662cf32a407358e6fadb8999aa54272f26895b6820b6b5e54209fd9b27a9ddb046a8c1d7fb92bb0
-
SSDEEP
3072:kxiXNL5uzRwA5mJ+i0cCsM5dMIm80ExdBWqXb/Pkk4x:/LwRQULJ5dJmpS
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1672-56-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
ac200dfd46cb14b4c59f30198d261a64a5a90972ec043.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ac200dfd46cb14b4c59f30198d261a64a5a90972ec043.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ac200dfd46cb14b4c59f30198d261a64a5a90972ec043.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ac200dfd46cb14b4c59f30198d261a64a5a90972ec043.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ac200dfd46cb14b4c59f30198d261a64a5a90972ec043.exepid process 1672 ac200dfd46cb14b4c59f30198d261a64a5a90972ec043.exe 1672 ac200dfd46cb14b4c59f30198d261a64a5a90972ec043.exe 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 1268 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
ac200dfd46cb14b4c59f30198d261a64a5a90972ec043.exepid process 1672 ac200dfd46cb14b4c59f30198d261a64a5a90972ec043.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1672-54-0x0000000075201000-0x0000000075203000-memory.dmpFilesize
8KB
-
memory/1672-56-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/1672-55-0x000000000074B000-0x000000000075C000-memory.dmpFilesize
68KB
-
memory/1672-57-0x0000000000400000-0x000000000058B000-memory.dmpFilesize
1.5MB
-
memory/1672-58-0x0000000000400000-0x000000000058B000-memory.dmpFilesize
1.5MB