Analysis
-
max time kernel
151s -
max time network
140s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
03-10-2022 07:30
Static task
static1
Behavioral task
behavioral1
Sample
d0a63ae6aa3fd171f1ede99215a26254fb191bafa2dd6042d6e54578c0a38145.exe
Resource
win10-20220812-en
General
-
Target
d0a63ae6aa3fd171f1ede99215a26254fb191bafa2dd6042d6e54578c0a38145.exe
-
Size
133KB
-
MD5
8e819bf1576d59f9e7a30f8fc6fe28a5
-
SHA1
2fb8efbc65d9de7608425d8d699aa0017461bb78
-
SHA256
d0a63ae6aa3fd171f1ede99215a26254fb191bafa2dd6042d6e54578c0a38145
-
SHA512
9141fdb452013cd45d99b95cecf675e35182f9373c12c7b58afb9938d09cd210a686c455b38f03539193f6707b6def0cf794bcc68dc92f57d837dbf359924859
-
SSDEEP
3072:0BxSOWyORgL6M2ksm2Ta0FQzVX1dVMbi:0/bLT2kGT5FQ11dVp
Malware Config
Signatures
-
Detects Smokeloader packer 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2584-141-0x0000000002290000-0x0000000002299000-memory.dmp family_smokeloader behavioral1/memory/2584-156-0x0000000002290000-0x0000000002299000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 3064 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
d0a63ae6aa3fd171f1ede99215a26254fb191bafa2dd6042d6e54578c0a38145.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d0a63ae6aa3fd171f1ede99215a26254fb191bafa2dd6042d6e54578c0a38145.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d0a63ae6aa3fd171f1ede99215a26254fb191bafa2dd6042d6e54578c0a38145.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d0a63ae6aa3fd171f1ede99215a26254fb191bafa2dd6042d6e54578c0a38145.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
d0a63ae6aa3fd171f1ede99215a26254fb191bafa2dd6042d6e54578c0a38145.exepid process 2584 d0a63ae6aa3fd171f1ede99215a26254fb191bafa2dd6042d6e54578c0a38145.exe 2584 d0a63ae6aa3fd171f1ede99215a26254fb191bafa2dd6042d6e54578c0a38145.exe 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3064 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
d0a63ae6aa3fd171f1ede99215a26254fb191bafa2dd6042d6e54578c0a38145.exepid process 2584 d0a63ae6aa3fd171f1ede99215a26254fb191bafa2dd6042d6e54578c0a38145.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0a63ae6aa3fd171f1ede99215a26254fb191bafa2dd6042d6e54578c0a38145.exe"C:\Users\Admin\AppData\Local\Temp\d0a63ae6aa3fd171f1ede99215a26254fb191bafa2dd6042d6e54578c0a38145.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2584-117-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-118-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-119-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-120-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-121-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-122-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-123-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-124-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-125-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-126-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-127-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-128-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-129-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-130-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-131-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-132-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-133-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-134-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-135-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-136-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-137-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-139-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-140-0x0000000000580000-0x000000000062E000-memory.dmpFilesize
696KB
-
memory/2584-141-0x0000000002290000-0x0000000002299000-memory.dmpFilesize
36KB
-
memory/2584-142-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-143-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-144-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-146-0x0000000000400000-0x000000000057E000-memory.dmpFilesize
1.5MB
-
memory/2584-145-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-147-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-148-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-149-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-150-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-151-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-152-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-153-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-154-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-155-0x0000000000580000-0x000000000062E000-memory.dmpFilesize
696KB
-
memory/2584-156-0x0000000002290000-0x0000000002299000-memory.dmpFilesize
36KB
-
memory/2584-157-0x0000000000400000-0x000000000057E000-memory.dmpFilesize
1.5MB