Analysis
- max time kernel
150s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
29/09/2022, 10:20
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target file.exe
- Size 291KB
- Sample220929-mc4ccsadg6
- SHA256 3fe5bc3d2a9845a8893c8f5e82edb9b135d1ecb1b2759a1fd1d22673d7953b8c
- MD5 3df34a18ed44346b541553c08623efbe
- SHA1 68c0a783669b99f3c20838d8644ee774a93129b5
- SHA512 9183d5dbfcc37d0127d450d96b79450e1053b5550e2f7df89d72152fe3a5109865cb553792ca82e2d21f98bb818ada2b1cdb6e4ab05c5d9c5d4d01689098c907
- SSDEEP 3072:pXhG+IfyYLJQXr8X357Bcw51q2VQkxCA/UUjdONfGyXNb0K4M/h3JpZa9uD6Vdyk:NcRLQXr8Z4sxRUUj4NOQB0RwwVfgM
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/5072-133-0x0000000002040000-0x0000000002049000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5072 file.exe 5072 file.exe 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found 760 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 760 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 5072 file.exe