Analysis
- max time kernel
151s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
29/09/2022, 18:28
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target file.exe
- Size 284KB
- Sample220929-w4azkacfbp
- SHA256 deabbce15465142febcf0ae98d11c28d1e919911d9e3e91e3e1b57bfa67e3de5
- MD5 b76978e613ccd629f5c1c0e4b093f05d
- SHA1 d4344734006176dd871dd7b68be17fd92e8596b6
- SHA512 7625f7986db005d3da1bea3007817ae373391f2ad934fa832850de9cf8e51873cfbb9b1250016651b0be8d01bb9480bd56c64bd2e4b4f5f5e0714d8be9664565
- SSDEEP 6144:x8P+Bi6CRhtjZIopuzbgwuO09YJv+wVfgyL:xRi632unnw9Yxyy
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/3524-133-0x0000000000590000-0x0000000000599000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Executes dropped EXE 1 IoCs
pid Process 1528 aeewwfs - Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aeewwfs Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aeewwfs Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aeewwfs Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3524 file.exe 3524 file.exe 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found 2832 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2832 Process not Found - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 3524 file.exe 1528 aeewwfs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3524
-
C:\Users\Admin\AppData\Roaming\aeewwfsC:\Users\Admin\AppData\Roaming\aeewwfs1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1528
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\aeewwfs
- Size 284KB
- SHA256 deabbce15465142febcf0ae98d11c28d1e919911d9e3e91e3e1b57bfa67e3de5
- MD5 b76978e613ccd629f5c1c0e4b093f05d
- SHA1 d4344734006176dd871dd7b68be17fd92e8596b6
- SHA512 7625f7986db005d3da1bea3007817ae373391f2ad934fa832850de9cf8e51873cfbb9b1250016651b0be8d01bb9480bd56c64bd2e4b4f5f5e0714d8be9664565
- SSDEEP 6144:x8P+Bi6CRhtjZIopuzbgwuO09YJv+wVfgyL:xRi632unnw9Yxyy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\aeewwfs
- Size 284KB
- SHA256 deabbce15465142febcf0ae98d11c28d1e919911d9e3e91e3e1b57bfa67e3de5
- MD5 b76978e613ccd629f5c1c0e4b093f05d
- SHA1 d4344734006176dd871dd7b68be17fd92e8596b6
- SHA512 7625f7986db005d3da1bea3007817ae373391f2ad934fa832850de9cf8e51873cfbb9b1250016651b0be8d01bb9480bd56c64bd2e4b4f5f5e0714d8be9664565
- SSDEEP 6144:x8P+Bi6CRhtjZIopuzbgwuO09YJv+wVfgyL:xRi632unnw9Yxyy
- MD5 SHA1 SHA512 SSDEEP