Analysis
-
max time kernel
150s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27-09-2022 18:27
Static task
static1
Behavioral task
behavioral1
Sample
ed610eacae33e876b8dcce69b94ec41d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ed610eacae33e876b8dcce69b94ec41d.exe
Resource
win10v2004-20220901-en
General
-
Target
ed610eacae33e876b8dcce69b94ec41d.exe
-
Size
328KB
-
MD5
ed610eacae33e876b8dcce69b94ec41d
-
SHA1
bdc5ebaf624325366cefec5c56151cde98b83ba7
-
SHA256
d7ce5c446babcebb082adc57a95ee0987e64f30abce2c258cf8d1469186df3d9
-
SHA512
c6e08354acb5c27143cd38cf04634522c2f5c439bd01f750b77a6fe721f0ad30dafd72ee9319e4ae1e5db41a36770f21bbdb930c166f2a374928f93d1f4ff0ae
-
SSDEEP
6144:Qp8/r00tCZvd4ULzolg0ECIfKhnigabwVfs:Qp8Y0tm14UL47iB
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/864-56-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
ed610eacae33e876b8dcce69b94ec41d.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ed610eacae33e876b8dcce69b94ec41d.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ed610eacae33e876b8dcce69b94ec41d.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ed610eacae33e876b8dcce69b94ec41d.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ed610eacae33e876b8dcce69b94ec41d.exepid process 864 ed610eacae33e876b8dcce69b94ec41d.exe 864 ed610eacae33e876b8dcce69b94ec41d.exe 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 1296 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
ed610eacae33e876b8dcce69b94ec41d.exepid process 864 ed610eacae33e876b8dcce69b94ec41d.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/864-54-0x0000000075141000-0x0000000075143000-memory.dmpFilesize
8KB
-
memory/864-56-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/864-55-0x00000000005CE000-0x00000000005DE000-memory.dmpFilesize
64KB
-
memory/864-57-0x0000000000400000-0x0000000000492000-memory.dmpFilesize
584KB
-
memory/864-58-0x0000000000400000-0x0000000000492000-memory.dmpFilesize
584KB