Overview
overview
10Static
static
10PL/6523.exe
windows7-x64
10PL/6523.exe
windows10-2004-x64
10PL/Galaxy.exe
windows7-x64
8PL/Galaxy.exe
windows10-2004-x64
10PL/Service.exe
windows7-x64
10PL/Service.exe
windows10-2004-x64
10PL/Une1.exe
windows7-x64
8PL/Une1.exe
windows10-2004-x64
8PL/pb1115.exe
windows7-x64
8PL/pb1115.exe
windows10-2004-x64
8PL/setup.exe
windows7-x64
10PL/setup.exe
windows10-2004-x64
10PL/setup.exe
windows7-x64
8PL/setup.exe
windows10-2004-x64
8PL/setup331.exe
windows7-x64
7PL/setup331.exe
windows10-2004-x64
7Analysis
-
max time kernel
152s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04-10-2022 21:11
Behavioral task
behavioral1
Sample
PL/6523.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
PL/6523.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
PL/Galaxy.exe
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
PL/Galaxy.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
PL/Service.exe
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
PL/Service.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral7
Sample
PL/Une1.exe
Resource
win7-20220901-en
Behavioral task
behavioral8
Sample
PL/Une1.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral9
Sample
PL/pb1115.exe
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
PL/pb1115.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
PL/setup.exe
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
PL/setup.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral13
Sample
PL/setup.exe
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
PL/setup.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
PL/setup331.exe
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
PL/setup331.exe
Resource
win10v2004-20220812-en
General
-
Target
PL/6523.exe
-
Size
264KB
-
MD5
b2949b2eb9db982c3782953de8a2573f
-
SHA1
34ff1afa580b8ca0c23d818f62aafe11e9e16fc2
-
SHA256
ef5b55fdd770f3c9cbd4a86cc0afe70e79d4d634bd7c88d6d48e07d5a6742dca
-
SHA512
368d9851bce5bd3aa35d41a2b64ad84f4ebe8ff7611fe4b09ca61db298ac8a5590dd11c8ca56786088c311ab7c5c83ac4da819b50cf449b50704c88b482e33d2
-
SSDEEP
6144:9+dLV/BxVCLYAXfIeyJuzbgwu70kmiHwVfU:9a5/BxsLYAXWunnsSiv
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1808-56-0x0000000000230000-0x0000000000239000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
6523.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6523.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6523.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6523.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
6523.exepid process 1808 6523.exe 1808 6523.exe 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 1216 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
6523.exepid process 1808 6523.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 1216 1216 -
Suspicious use of SendNotifyMessage 6 IoCs
Processes:
pid process 1216 1216 1216 1216 1216 1216
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1808-54-0x0000000076171000-0x0000000076173000-memory.dmpFilesize
8KB
-
memory/1808-55-0x000000000057C000-0x000000000058C000-memory.dmpFilesize
64KB
-
memory/1808-56-0x0000000000230000-0x0000000000239000-memory.dmpFilesize
36KB
-
memory/1808-57-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB
-
memory/1808-58-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB