Analysis
-
max time kernel
150s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-09-2022 18:23
Static task
static1
Behavioral task
behavioral1
Sample
f090029ecd2264b984721ed50bf04094fcf183311b879.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f090029ecd2264b984721ed50bf04094fcf183311b879.exe
Resource
win10v2004-20220812-en
General
-
Target
f090029ecd2264b984721ed50bf04094fcf183311b879.exe
-
Size
197KB
-
MD5
c507b5f547dbb35624bcbc775dac2582
-
SHA1
2e584e20627ced95dac4c12ae46050cbc3433b4d
-
SHA256
f090029ecd2264b984721ed50bf04094fcf183311b87930d1816534f4dd6da4e
-
SHA512
b5fce0eebea28adef568a5b7249603ae2f5912a84fef0ba343f1a15e3e718ef54b03f63f1500d817e3af20bdcdf2233a86782d0e47914f3b10ad312e6141d092
-
SSDEEP
3072:sb1gPyLpop1VVOA5nACKUIA+20c5v4Ytsn8hBGCyUuNQ/Pkk4x:2LpkVVPqUj71onnT
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1636-56-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
f090029ecd2264b984721ed50bf04094fcf183311b879.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f090029ecd2264b984721ed50bf04094fcf183311b879.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f090029ecd2264b984721ed50bf04094fcf183311b879.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f090029ecd2264b984721ed50bf04094fcf183311b879.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
f090029ecd2264b984721ed50bf04094fcf183311b879.exepid process 1636 f090029ecd2264b984721ed50bf04094fcf183311b879.exe 1636 f090029ecd2264b984721ed50bf04094fcf183311b879.exe 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 1340 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
f090029ecd2264b984721ed50bf04094fcf183311b879.exepid process 1636 f090029ecd2264b984721ed50bf04094fcf183311b879.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1636-54-0x0000000075E51000-0x0000000075E53000-memory.dmpFilesize
8KB
-
memory/1636-55-0x000000000069B000-0x00000000006AC000-memory.dmpFilesize
68KB
-
memory/1636-56-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/1636-57-0x0000000000400000-0x000000000058B000-memory.dmpFilesize
1.5MB
-
memory/1636-58-0x0000000000400000-0x000000000058B000-memory.dmpFilesize
1.5MB