Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
26/09/2022, 09:18
General
-
Target
file.exe
-
Size
153KB
-
MD5
f3be15e87c00f23212cf9d35ee75c2d0
-
SHA1
15000eada216d5d108c88d35b2e02e22c17be884
-
SHA256
9d0ed29da9c72921ceac602504df0abe90d6c17a9f7dfa14a81c86dabcfb9c14
-
SHA512
a54ccc9b2c72988231ff2486c9d7e975e64ba72a8aca0b5697c29532c68bc9b5727b7fef53f2ffc09b6eb95d35c9ede45524fdea0221ee410cb8ee073de478b7
-
SSDEEP
3072:FwNJjwz5iX3qHhsEz0soRYCdUX7X2dM0wYM0EVBJh3g46J8+5B:Ausa1iwJYMjxhw46a
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\iaehbivC:\Users\Admin\AppData\Roaming\iaehbiv1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
153KB
MD5f3be15e87c00f23212cf9d35ee75c2d0
SHA115000eada216d5d108c88d35b2e02e22c17be884
SHA2569d0ed29da9c72921ceac602504df0abe90d6c17a9f7dfa14a81c86dabcfb9c14
SHA512a54ccc9b2c72988231ff2486c9d7e975e64ba72a8aca0b5697c29532c68bc9b5727b7fef53f2ffc09b6eb95d35c9ede45524fdea0221ee410cb8ee073de478b7
-
Filesize
153KB
MD5f3be15e87c00f23212cf9d35ee75c2d0
SHA115000eada216d5d108c88d35b2e02e22c17be884
SHA2569d0ed29da9c72921ceac602504df0abe90d6c17a9f7dfa14a81c86dabcfb9c14
SHA512a54ccc9b2c72988231ff2486c9d7e975e64ba72a8aca0b5697c29532c68bc9b5727b7fef53f2ffc09b6eb95d35c9ede45524fdea0221ee410cb8ee073de478b7
-
Filesize
68KB
-
Filesize
36KB
-
Filesize
1.5MB
-
Filesize
68KB
-
Filesize
1.5MB
-
Filesize
68KB
-
Filesize
1.5MB
-
Filesize
1.5MB