Analysis
-
max time kernel
151s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
03-10-2022 06:01
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220901-en
General
-
Target
file.exe
-
Size
133KB
-
MD5
c9b56fbdacec9564125dad97ff27c1e6
-
SHA1
43d54bbaf3b4c5643985365bcb01aabc4906523d
-
SHA256
aa358e8ab88a109a0147e08138de7614b2b0e13d6ec1ae78b4def773eb54f0b5
-
SHA512
1d93e86a9cc9a1e574fc200015c7d32d19fc48146e087d85cde82aa258b273d47ed1c0d463777bebe9812228d7d8872882715d8ff84d042d6e8cc348b85eead7
-
SSDEEP
1536:dl9EsU7Rgyern+5WGmtHOR54xp7BMgUVzyHnBlX7eKY5ymlN2Ijs0478jrkwpI/O:dLn3ORzlVElX6tlN2IjlJro+7V
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2016-56-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
file.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
file.exepid process 2016 file.exe 2016 file.exe 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 1368 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1368 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
file.exepid process 2016 file.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1368-59-0x000007FEF6600000-0x000007FEF6743000-memory.dmpFilesize
1.3MB
-
memory/1368-60-0x000007FEE42C0000-0x000007FEE42CA000-memory.dmpFilesize
40KB
-
memory/2016-54-0x0000000075A71000-0x0000000075A73000-memory.dmpFilesize
8KB
-
memory/2016-56-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/2016-55-0x00000000006DD000-0x00000000006EE000-memory.dmpFilesize
68KB
-
memory/2016-57-0x0000000000400000-0x000000000057E000-memory.dmpFilesize
1.5MB
-
memory/2016-58-0x0000000000400000-0x000000000057E000-memory.dmpFilesize
1.5MB