Analysis
-
max time kernel
150s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-09-2022 19:01
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
General
-
Target
file.exe
-
Size
142KB
-
MD5
14f82defd9867c62cd08b6a16441d164
-
SHA1
22c1a067f15f5c72144574708927a7c71c51540b
-
SHA256
7a58d328cc90c473cdaef40c12a73df4629b128f3d27da3f39291b6591f0cf16
-
SHA512
a5148abe8f0bd585fe2e82a2751d18054c1c56bcbb1fa2450391b4cd05a2155a25ee9db101b73d8a9b090ffc4db67affa788432bb16135b18c0a5d0580d60827
-
SSDEEP
3072:aGiUBiqXGRWmF+BtkgnBwN0gZRvJ8OdKdZrX8wK:Iqmckg4HvJ8sKdJXO
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1664-56-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
file.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
file.exepid process 1664 file.exe 1664 file.exe 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 1324 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
file.exepid process 1664 file.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1664-54-0x0000000075981000-0x0000000075983000-memory.dmpFilesize
8KB
-
memory/1664-56-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/1664-55-0x000000000076D000-0x000000000077E000-memory.dmpFilesize
68KB
-
memory/1664-57-0x0000000000400000-0x0000000000580000-memory.dmpFilesize
1.5MB
-
memory/1664-58-0x0000000000400000-0x0000000000580000-memory.dmpFilesize
1.5MB