Analysis
-
max time kernel
150s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-09-2022 13:08
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
General
-
Target
file.exe
-
Size
153KB
-
MD5
7d53fa419ac8d29b79078ca0c4bb85c6
-
SHA1
e051e6cf509d78cad4337ee84b1f4ffaa0c3ac8b
-
SHA256
bc1c19fb9559d3e0f6ede05232c6f72d8306f8858f740bf9a8dd768c0cba92de
-
SHA512
9232370c1f86cfae4c67b545c3a61374381d67bfa97ca64ee0bb9bc4b53f9de3c33ef0fcef012998fdde482c0ab5a7e52a55d0d32787c44a9f388a294929ce53
-
SSDEEP
1536:VTcMoYs1izSP44tTF5YuMdb47ZPaEF1J3IcP9WlY9aRFucLyOGgxjYj1Ei/UunL2:VTSzTF5eb079pUx3TylgGBtJ+/aK5B
Score
10/10
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2012-56-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
file.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
file.exepid process 2012 file.exe 2012 file.exe 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 1204 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
file.exepid process 2012 file.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2012-54-0x0000000075BA1000-0x0000000075BA3000-memory.dmpFilesize
8KB
-
memory/2012-56-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/2012-55-0x000000000066B000-0x000000000067C000-memory.dmpFilesize
68KB
-
memory/2012-57-0x0000000000400000-0x0000000000583000-memory.dmpFilesize
1.5MB
-
memory/2012-58-0x0000000000400000-0x0000000000583000-memory.dmpFilesize
1.5MB